[
    {
        "service_name": "Alexa for Business",
        "prefix": "a4b",
        "privileges": [
            {
                "privilege": "ApproveSkill",
                "description": "Associates a skill with the organization under the customer's AWS account. If a skill is private, the user implicitly accepts access to this skill during enablement.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateContactWithAddressBook",
                "description": "Associates a contact with a given address book.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "addressbook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateDeviceWithRoom",
                "description": "Associates device with given room.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateSkillGroupWithRoom",
                "description": "Associates the skill group with given room. SkillGroup ARN and Room ARN must be specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateSkillWithSkillGroup",
                "description": "Associates a skill with a skill group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateSkillWithUsers",
                "description": "Makes a private skill available for enrolled users to enable on their devices.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteRegistration",
                "description": "Completes the operation of registering an Alexa device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAddressBook",
                "description": "Creates an address book with the specified details.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBusinessReportSchedule",
                "description": "Creates a recurring schedule for usage reports to deliver to the specified S3 location with a specified daily or weekly interval.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConferenceProvider",
                "description": "Adds a new conference provider under the user's AWS account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateContact",
                "description": "Creates a contact with the specified details.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProfile",
                "description": "Creates a new profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoom",
                "description": "Create room with the specified details.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSkillGroup",
                "description": "Creates a skill group with given name and description.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Creates a user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAddressBook",
                "description": "Deletes an address book by the address book ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "addressbook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBusinessReportSchedule",
                "description": "Deletes the recurring report delivery schedule with the specified schedule ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConferenceProvider",
                "description": "Deletes a conference provider.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "conferenceprovider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteContact",
                "description": "Deletes a contact by the contact ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDevice",
                "description": "Removes a device from Alexa For Business.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProfile",
                "description": "Delete profile by profile ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoom",
                "description": "Delete room.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoomSkillParameter",
                "description": "Delete a parameter from a skill and room.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSkillAuthorization",
                "description": "Unlinks a third-party account from a skill.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSkillGroup",
                "description": "Deletes skill group with skill group ARN. Skillgroup ARN must be specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Delete a user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateContactFromAddressBook",
                "description": "Disassociates a contact from a given address book.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "addressbook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDeviceFromRoom",
                "description": "Disassociates device from its current room.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateSkillFromSkillGroup",
                "description": "Disassociates a skill from a skill group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateSkillFromUsers",
                "description": "Makes a private skill unavailable for enrolled users and prevents them from enabling it on their devices.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateSkillGroupFromRoom",
                "description": "Disassociates the skill group from given room. SkillGroup ARN and Room ARN must be specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ForgetSmartHomeAppliances",
                "description": "Forgets smart home appliances associated to a room.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAddressBook",
                "description": "Gets the address book details by the address book ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "addressbook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConferencePreference",
                "description": "Retrieves the existing conference preferences.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConferenceProvider",
                "description": "Gets details about a specific conference provider.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "conferenceprovider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContact",
                "description": "Gets the contact details by the contact ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevice",
                "description": "Get device details.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNetworkProfile",
                "description": "Gets the network profile details by the network profile ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "networkprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProfile",
                "description": "Gets profile when provided with Profile ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRoom",
                "description": "Get room details.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRoomSkillParameter",
                "description": "Get an existing parameter that has been set for a skill and room.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSkillGroup",
                "description": "Gets skill group details with skill group ARN. Skillgroup ARN must be specified.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBusinessReportSchedules",
                "description": "Lists the details of the schedules that a user configured.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConferenceProviders",
                "description": "Lists conference providers under a specific AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeviceEvents",
                "description": "Lists the device event history, including device connection status, for up to 30 days.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSkills",
                "description": "Lists skills.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSkillsStoreCategories",
                "description": "Lists all categories in the Alexa skill store.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSkillsStoreSkillsByCategory",
                "description": "Lists all skills in the Alexa skill store by category.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSmartHomeAppliances",
                "description": "Lists all of the smart home appliances associated with a room.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Lists all tags on a resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "room",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConferencePreference",
                "description": "Sets the conference preferences on a specific conference provider at the account level.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDeviceSetupEvents",
                "description": "Publishes Alexa device setup events.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRoomSkillParameter",
                "description": "Put a room specific parameter for a skill.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSkillAuthorization",
                "description": "Links a user's account to a third-party skill provider. If this API operation is called by an assumed IAM role, the skill being linked must be a private skill. Also, the skill must be owned by the AWS account that assumed the IAM role.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterAVSDevice",
                "description": "Registers an Alexa-enabled device built by an Original Equipment Manufacturer (OEM) using Alexa Voice Service (AVS).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDevice",
                "description": "Registers an Alexa device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectSkill",
                "description": "Disassociates a skill from the organization under a user's AWS account. If the skill is a private skill, it moves to an AcceptStatus of PENDING.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResolveRoom",
                "description": "Returns resolved room information.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeInvitation",
                "description": "Revoke an invitation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchAddressBooks",
                "description": "Searches address books and lists the ones that meet a set of filter and sort criteria.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchContacts",
                "description": "Searches contacts and lists the ones that meet a set of filter and sort criteria.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchDevices",
                "description": "Search for devices.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchNetworkProfiles",
                "description": "Searches network profiles and lists the ones that meet a set of filter and sort criteria.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchProfiles",
                "description": "Search for profiles.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchRooms",
                "description": "Search for rooms.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchSkillGroups",
                "description": "Search for skill groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchUsers",
                "description": "Search for users.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendInvitation",
                "description": "Send an invitation to a user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDeviceSync",
                "description": "Restore the device and its account to its known, default settings by clearing all information and settings set by its previous users.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSmartHomeApplianceDiscovery",
                "description": "Initiates the discovery of any smart home appliances associated with the room.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds metadata tags to a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "room",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes metadata tags from a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "room",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAddressBook",
                "description": "Updates address book details by the address book ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "addressbook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBusinessReportSchedule",
                "description": "Updates the configuration of the report delivery schedule with the specified schedule ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConferenceProvider",
                "description": "Updates an existing conference provider's settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "conferenceprovider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateContact",
                "description": "Updates the contact details by the contact ARN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDevice",
                "description": "Updates device name.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProfile",
                "description": "Updates an existing profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoom",
                "description": "Update room details.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "room*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSkillGroup",
                "description": "Updates skill group details with skill group ARN. Skillgroup ARN must be specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "skillgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "profile",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:profile/${Resource_id}",
                "condition_keys": []
            },
            {
                "resource": "room",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:room/${Resource_id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "device",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:device/${Resource_id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "skillgroup",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:skill-group/${Resource_id}",
                "condition_keys": []
            },
            {
                "resource": "user",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:user/${Resource_id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "addressbook",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:address-book/${Resource_id}",
                "condition_keys": []
            },
            {
                "resource": "conferenceprovider",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:conference-provider/${Resource_id}",
                "condition_keys": []
            },
            {
                "resource": "contact",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:contact/${Resource_id}",
                "condition_keys": []
            },
            {
                "resource": "schedule",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:schedule/${Resource_id}",
                "condition_keys": []
            },
            {
                "resource": "networkprofile",
                "arn": "arn:${Partition}:a4b:${Region}:${Account}:network-profile/${Resource_id}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "a4b:amazonId",
                "description": "Filters actions based on the Amazon Id in the request",
                "type": "String"
            },
            {
                "condition": "a4b:filters_deviceType",
                "description": "Filters actions based on the device type in the request",
                "type": "String"
            },
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "IAM Access Analyzer",
        "prefix": "access-analyzer",
        "privileges": [
            {
                "privilege": "CreateAnalyzer",
                "description": "Grants permission to create an analyzer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateArchiveRule",
                "description": "Grants permission to create an archive rule for the specified analyzer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ArchiveRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAnalyzer",
                "description": "Grants permission to delete the specified analyzer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteArchiveRule",
                "description": "Grants permission to delete archive rules for the specified analyzer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ArchiveRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAnalyzedResource",
                "description": "Grants permission to retrieve information about an analyzed resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAnalyzer",
                "description": "Grants permission to retrieve information about analyzers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetArchiveRule",
                "description": "Grants permission to retrieve information about archive rules for the specified analyzer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ArchiveRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFinding",
                "description": "Grants permission to retrieve findings.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAnalyzedResources",
                "description": "Grants permission to retrieve a list of resources that have been analyzed.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAnalyzers",
                "description": "Grants permission to retrieves a list of analyzers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListArchiveRules",
                "description": "Grants permission to retrieve a list of archive rules from an analyzer.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFindings",
                "description": "Grants permission to retrieve a list of findings from an analyzer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to retrieve a list of tags applied to a resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Analyzer",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartResourceScan",
                "description": "Grants permission to start a scan of the policies applied to a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add a tag to a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Analyzer",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove a tag from a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Analyzer",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateArchiveRule",
                "description": "Grants permission to modify an archive rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Analyzer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ArchiveRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFindings",
                "description": "Grants permission to modify findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Analyzer",
                "arn": "arn:${Partition}:access-analyzer:${Region}:${Account}:analyzer/${analyzerName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "ArchiveRule",
                "arn": "arn:${Partition}:access-analyzer:${Region}:${Account}:analyzer/${analyzerName}/archive-rule/${ruleName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Accounts",
        "prefix": "account",
        "privileges": [
            {
                "privilege": "DisableRegion",
                "description": "Grants permission to disable a region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "account:TargetRegion"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableRegion",
                "description": "Grants permission to enable a region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "account:TargetRegion"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegions",
                "description": "Grants permission to list regions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": [
            {
                "condition": "account:TargetRegion",
                "description": "Filters access by a list of regions",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Certificate Manager",
        "prefix": "acm",
        "privileges": [
            {
                "privilege": "AddTagsToCertificate",
                "description": "Adds one or more tags to a certificate.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCertificate",
                "description": "Deletes a certificate and its associated private key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificate",
                "description": "Returns a list of the fields contained in the specified certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportCertificate",
                "description": "Exports a private certificate issued by a private certificate authority (CA) for use anywhere.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCertificate",
                "description": "Retrieves a certificate and certificate chain for the certificate specified by an ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportCertificate",
                "description": "Imports a 3rd party SSL/TLS certificate into AWS Certificate Manager (ACM).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCertificates",
                "description": "Retrieves a list of the certificate ARNs and the domain name for each ARN.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForCertificate",
                "description": "Lists the tags that have been applied to the certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromCertificate",
                "description": "Remove one or more tags from a certificate. A tag consists of a key-value pair",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RenewCertificate",
                "description": "Renews an eligable private certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestCertificate",
                "description": "Requests a public or private certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResendValidationEmail",
                "description": "Resends an email to request domain ownership validation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCertificateOptions",
                "description": "Updates a certificate. Use to specify whether to opt in to or out of certificate transparency logging.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "certificate",
                "arn": "arn:${Partition}:acm:${Region}:${Account}:certificate/${CertificateId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Certificate Manager Private Certificate Authority",
        "prefix": "acm-pca",
        "privileges": [
            {
                "privilege": "CreateCertificateAuthority",
                "description": "Creates an ACM Private CA and its associated private key and configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCertificateAuthorityAuditReport",
                "description": "Creates an audit report for an ACM Private CA.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePermission",
                "description": "Creates a permission for an ACM Private CA.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCertificateAuthority",
                "description": "Deletes an ACM Private CA and its associated private key and configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePermission",
                "description": "Deletes a permission for an ACM Private CA.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificateAuthority",
                "description": "Returns a list of the configuration and status fields contained in the specified ACM Private CA.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificateAuthorityAuditReport",
                "description": "Returns the status and information about an ACM Private CA audit report.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCertificate",
                "description": "Retrieves an ACM Private CA certificate and certificate chain for the certificate authority specified by an ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCertificateAuthorityCertificate",
                "description": "Retrieves an ACM Private CA certificate and certificate chain for the certificate authority specified by an ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCertificateAuthorityCsr",
                "description": "Retrieves an ACM Private CA certificate signing request (CSR) for the certificate-authority specified by an ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportCertificateAuthorityCertificate",
                "description": "Imports an SSL/TLS certificate into ACM Private CA for use as the CA certificate of an ACM Private CA.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IssueCertificate",
                "description": "Issues an ACM Private CA certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "acm-pca:TemplateArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCertificateAuthorities",
                "description": "Retrieves a list of the ACM Private CA certificate authority ARNs, and a summary of the status of each CA in the calling account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPermissions",
                "description": "Lists the permissions that have been applied to the ACM Private CA certificate authority.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Lists the tags that have been applied to the ACM Private CA certificate authority.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreCertificateAuthority",
                "description": "Restores an ACM Private CA from the deleted state to the state it was in when deleted.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeCertificate",
                "description": "Revokes a certificate issued by an ACM Private CA.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagCertificateAuthority",
                "description": "Adds one or more tags to an ACM Private CA.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagCertificateAuthority",
                "description": "Remove one or more tags from an ACM Private CA.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCertificateAuthority",
                "description": "Updates the configuration of an ACM Private CA.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "certificate-authority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "certificate-authority",
                "arn": "arn:${Partition}:acm-pca:${Region}:${Account}:certificate-authority/${CertificateAuthorityId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "acm-pca:TemplateArn",
                "description": "Filters issue certificate requests based on the presence of TemplateArn in the request.",
                "type": "String"
            },
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Amplify",
        "prefix": "amplify",
        "privileges": [
            {
                "privilege": "CreateApp",
                "description": "Creates a new Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBackendEnvironment",
                "description": "Creates a new backend environment for an Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBranch",
                "description": "Creates a new Branch for an Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeployment",
                "description": "Create a deployment for manual deploy apps. (Apps are not connected to repository)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDomainAssociation",
                "description": "Create a new DomainAssociation on an App",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWebHook",
                "description": "Create a new webhook on an App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApp",
                "description": "Delete an existing Amplify App by appId.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackendEnvironment",
                "description": "Deletes a branch for an Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBranch",
                "description": "Deletes a branch for an Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomainAssociation",
                "description": "Deletes a DomainAssociation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domains*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJob",
                "description": "Delete a job, for an Amplify branch, part of Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWebHook",
                "description": "Delete a webhook by id.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateAccessLogs",
                "description": "Generate website access logs for a specific time range via a pre-signed URL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApp",
                "description": "Retrieves an existing Amplify App by appId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetArtifactUrl",
                "description": "Retrieves artifact info that corresponds to a artifactId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackendEnvironment",
                "description": "Retrieves a backend environment for an Amplify App.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBranch",
                "description": "Retrieves a branch for an Amplify App.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDomainAssociation",
                "description": "Retrieves domain info that corresponds to an appId and domainName.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domains*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJob",
                "description": "Get a job for a branch, part of an Amplify App.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWebHook",
                "description": "Retrieves webhook info that corresponds to a webhookId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApps",
                "description": "Lists existing Amplify Apps.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListArtifacts",
                "description": "List artifacts with an app, a branch, a job and an artifact type.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackendEnvironments",
                "description": "Lists backend environments for an Amplify App.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBranches",
                "description": "Lists branches for an Amplify App.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomainAssociations",
                "description": "List domains with an app",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "List Jobs for a branch, part of an Amplify App.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebHooks",
                "description": "List webhooks on an App.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDeployment",
                "description": "Start a deployment for manual deploy apps. (Apps are not connected to repository)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartJob",
                "description": "Starts a new job for a branch, part of an Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopJob",
                "description": "Stop a job that is in progress, for an Amplify branch, part of Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an AWS Amplify Console resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "apps",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "branches",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "jobs",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from an AWS Amplify Console resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "apps",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "branches",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "jobs",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApp",
                "description": "Updates an existing Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBranch",
                "description": "Updates a branch for an Amplify App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "branches*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainAssociation",
                "description": "Update a DomainAssociation on an App.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domains*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWebHook",
                "description": "Update a webhook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "apps",
                "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "branches",
                "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/branches/${BranchName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "jobs",
                "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/branches/${BranchName}/jobs/${JobId}",
                "condition_keys": []
            },
            {
                "resource": "domains",
                "arn": "arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/domains/${DomainName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Manage Amazon API Gateway",
        "prefix": "apigateway",
        "privileges": [
            {
                "privilege": "DELETE",
                "description": "Used to delete resources",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GET",
                "description": "Used to get information about resources",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PATCH",
                "description": "Used to update resources",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "POST",
                "description": "Used to create child resources",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PUT",
                "description": "Used to update resources (and, although not recommended, can be used to create child resources)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetWebACL",
                "description": "Gives WebAcl permissions to WAF",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRestApiPolicy",
                "description": "Used to update the Resource Policy for a given API",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "apigateway-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "apigateway-general",
                "arn": "arn:${Partition}:apigateway:${Region}::${ApiGatewayResourcePath}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS AppConfig",
        "prefix": "appconfig",
        "privileges": [
            {
                "privilege": "CreateApplication",
                "description": "Grants permission to create an application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationProfile",
                "description": "Grants permission to create a configuration profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeploymentStrategy",
                "description": "Grants permission to create a deployment strategy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentstrategy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEnvironment",
                "description": "Grants permission to create an environment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Grants permission to delete an application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationProfile",
                "description": "Grants permission to delete a configuration profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDeploymentStrategy",
                "description": "Grants permission to delete a deployment strategy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentstrategy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEnvironment",
                "description": "Grants permission to delete an environment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplication",
                "description": "Grants permission to view details about an application",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfiguration",
                "description": "Grants permission to view details about a configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfigurationProfile",
                "description": "Grants permission to view details about a configuration profile",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeployment",
                "description": "Grants permission to view details about a deployment",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentStrategy",
                "description": "Grants permission to view details about a deployment strategy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deploymentstrategy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEnvironment",
                "description": "Grants permission to view details about an environment",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "Grants permission to list the applications in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurationProfiles",
                "description": "Grants permission to list the configuration profiles for an application",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeploymentStrategies",
                "description": "Grants permission to list the deployment strategies for your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeployments",
                "description": "Grants permission to list the deployments for an environment",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEnvironments",
                "description": "Grants permission to list the environments for an application",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to view a list of resource tags for a specified resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deployment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentstrategy",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDeployment",
                "description": "Grants permission to initiate a deployment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentstrategy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDeployment",
                "description": "Grants permission to stop a deployment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag an appconfig resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deployment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentstrategy",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag an appconfig resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deployment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentstrategy",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Grants permission to modify an application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationProfile",
                "description": "Grants permission to modify a configuration profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDeploymentStrategy",
                "description": "Grants permission to modify a deployment strategy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentstrategy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEnvironment",
                "description": "Grants permission to modify an environment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateConfiguration",
                "description": "Grants permission to validate a configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "application",
                "arn": "arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "environment",
                "arn": "arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/environment/${EnvironmentId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "configurationprofile",
                "arn": "arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/configurationprofile/${ConfigurationProfileId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deploymentstrategy",
                "arn": "arn:${Partition}:appconfig:${Region}:${Account}:deploymentstrategy/${DeploymentStrategyId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deployment",
                "arn": "arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/environment/${EnvironmentId}/deployment/${DeploymentNumber}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters 'Create' requests based on the allowed set of values for a specified tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access based on a tag key-value pair assigned to the AWS resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters 'Create' requests based on whether mandatory tags are included in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Application Auto Scaling",
        "prefix": "application-autoscaling",
        "privileges": [
            {
                "privilege": "DeleteScalingPolicy",
                "description": "Deletes an Application Auto Scaling scaling policy that was previously created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScheduledAction",
                "description": "Deletes an Application Auto Scaling scheduled action that was previously created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterScalableTarget",
                "description": "Deregisters a scalable target that was previously registered.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalableTargets",
                "description": "Provides descriptive information for scalable targets with a specified service namespace.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingActivities",
                "description": "Provides descriptive information for scaling activities with a specified service namespace for the previous six weeks.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingPolicies",
                "description": "Provides descriptive information for scaling policies with a specified service namespace.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScheduledActions",
                "description": "Provides descriptive information for scheduled actions with a specified service namespace.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutScalingPolicy",
                "description": "Creates or updates a policy for an existing Application Auto Scaling scalable target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutScheduledAction",
                "description": "Creates or updates a scheduled action for an existing Application Auto Scaling scalable target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterScalableTarget",
                "description": "Registers or updates a scalable target. A scalable target is a resource that can be scaled out or in with Application Auto Scaling.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "CloudWatch Application Insights",
        "prefix": "applicationinsights",
        "privileges": [
            {
                "privilege": "CreateApplication",
                "description": "Creates an application from a resource group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateComponent",
                "description": "Creates a component from a group of resources",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Deletes an application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteComponent",
                "description": "Deletes a component",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplication",
                "description": "Describes an application",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComponent",
                "description": "Describes a component",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComponentConfiguration",
                "description": "Describes a component configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComponentConfigurationRecommendation",
                "description": "Describe the recommended application component configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeObservation",
                "description": "Describes an observation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProblem",
                "description": "Describes a problem",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProblemObservations",
                "description": "Describes the observation in a problem",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "Lists all applications",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListComponents",
                "description": "List an application's components",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProblems",
                "description": "Lists the problems in an application",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Updates an application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateComponent",
                "description": "Updates a component",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateComponentConfiguration",
                "description": "Updates a component configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS App Mesh",
        "prefix": "appmesh",
        "privileges": [
            {
                "privilege": "CreateMesh",
                "description": "Creates a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoute",
                "description": "Creates a route that is associated with a virtual router.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualNode",
                "description": "Creates a virtual node within a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualService",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualRouter",
                "description": "Creates a virtual router within a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualService",
                "description": "Creates a virtual service within a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMesh",
                "description": "Deletes an existing service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoute",
                "description": "Deletes an existing route.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualNode",
                "description": "Deletes an existing virtual node.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualRouter",
                "description": "Deletes an existing virtual router.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualService",
                "description": "Deletes an existing virtual service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMesh",
                "description": "Describes an existing service mesh.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRoute",
                "description": "Describes an existing route.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualNode",
                "description": "Describes an existing virtual node.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualRouter",
                "description": "Describes an existing virtual router.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualService",
                "description": "Describes an existing virtual service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeshes",
                "description": "Returns a list of existing service meshes.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoutes",
                "description": "Returns a list of existing routes in a service mesh.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List the tags for an App Mesh resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "mesh",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualService",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualNodes",
                "description": "Returns a list of existing virtual nodes.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualRouters",
                "description": "Returns a list of existing virtual routers in a service mesh.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualServices",
                "description": "Returns a list of existing virtual services in a service mesh.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StreamAggregatedResources",
                "description": "Allows an Envoy Proxy to receive streamed resources for a VirtualNode.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Associates the specified tags to a resource with the specified resourceArn.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "mesh",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualService",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Deletes specified tags from a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "mesh",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualService",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMesh",
                "description": "Updates an existing service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoute",
                "description": "Updates an existing route for a specified service mesh and virtual router.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualNode",
                "description": "Updates an existing virtual node in a specified service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualRouter",
                "description": "Updates an existing virtual router in a specified service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualService",
                "description": "Updates an existing virtual service in a specified service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "mesh",
                "arn": "arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "virtualService",
                "arn": "arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}/virtualService/${VirtualServiceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "virtualNode",
                "arn": "arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}/virtualNode/${VirtualNodeName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "virtualRouter",
                "arn": "arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "route",
                "arn": "arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}/route/${RouteName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS App Mesh Preview",
        "prefix": "appmesh-preview",
        "privileges": [
            {
                "privilege": "CreateMesh",
                "description": "Creates a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoute",
                "description": "Creates a route that is associated with a virtual router.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualNode",
                "description": "Creates a virtual node within a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualService",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualRouter",
                "description": "Creates a virtual router within a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualService",
                "description": "Creates a virtual service within a service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMesh",
                "description": "Deletes an existing service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoute",
                "description": "Deletes an existing route.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualNode",
                "description": "Deletes an existing virtual node.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualRouter",
                "description": "Deletes an existing virtual router.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualService",
                "description": "Deletes an existing virtual service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMesh",
                "description": "Describes an existing service mesh.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRoute",
                "description": "Describes an existing route.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualNode",
                "description": "Describes an existing virtual node.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualRouter",
                "description": "Describes an existing virtual router.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualService",
                "description": "Describes an existing virtual service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeshes",
                "description": "Returns a list of existing service meshes.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoutes",
                "description": "Returns a list of existing routes in a service mesh.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualNodes",
                "description": "Returns a list of existing virtual nodes.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualRouters",
                "description": "Returns a list of existing virtual routers in a service mesh.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualServices",
                "description": "Returns a list of existing virtual services in a service mesh.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "virtualService*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StreamAggregatedResources",
                "description": "Allows an Envoy Proxy to receive streamed resources for a VirtualNode.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMesh",
                "description": "Updates an existing service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoute",
                "description": "Updates an existing route for a specified service mesh and virtual router.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualNode",
                "description": "Updates an existing virtual node in a specified service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualNode*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualRouter",
                "description": "Updates an existing virtual router in a specified service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "virtualRouter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualService",
                "description": "Updates an existing virtual service in a specified service mesh.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mesh*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualNode",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "virtualRouter",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "mesh",
                "arn": "arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}",
                "condition_keys": []
            },
            {
                "resource": "virtualService",
                "arn": "arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualService/${VirtualServiceName}",
                "condition_keys": []
            },
            {
                "resource": "virtualNode",
                "arn": "arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualNode/${VirtualNodeName}",
                "condition_keys": []
            },
            {
                "resource": "virtualRouter",
                "arn": "arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}",
                "condition_keys": []
            },
            {
                "resource": "route",
                "arn": "arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}/route/${RouteName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon AppStream 2.0",
        "prefix": "appstream",
        "privileges": [
            {
                "privilege": "AssociateFleet",
                "description": "Grants permission to associate the specified fleet with the specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchAssociateUserStack",
                "description": "Grants permission to associate the specified users with the specified stacks. Users in a user pool cannot be assigned to stacks with fleets that are joined to an Active Directory domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDisassociateUserStack",
                "description": "Grants permission to disassociate the specified users from the specified stacks",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyImage",
                "description": "Grants permission to copy the specified image within the same Region or to a new Region within the same AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDirectoryConfig",
                "description": "Grants permission to create a Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFleet",
                "description": "Grants permission to create a fleet. A fleet is a group of streaming instances from which applications are launched and streamed to users",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImageBuilder",
                "description": "Grants permission to create an image builder. An image builder is a virtual machine that is used to create an image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image-builder*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImageBuilderStreamingURL",
                "description": "Grants permission to create a URL to start an image builder streaming session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image-builder*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStack",
                "description": "Grants permission to create a stack to start streaming applications to users. A stack consists of an associated fleet, user access policies, and storage configurations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStreamingURL",
                "description": "Grants permission to create a temporary URL to start an AppStream 2.0 streaming session for the specified user. A streaming URL enables application streaming to be tested without user setup",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUsageReportSubscription",
                "description": "Grants permission to create a usage report subscription. Usage reports are generated daily",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Grants permission to create a new user in the user pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDirectoryConfig",
                "description": "Grants permission to delete the specified Directory Config object from AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFleet",
                "description": "Grants permission to delete the specified fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImage",
                "description": "Grants permission to delete the specified image. An image cannot be deleted when it is in use",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImageBuilder",
                "description": "Grants permission to delete the specified image builder and release capacity",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image-builder*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImagePermissions",
                "description": "Grants permission to delete permissions for the specified private image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStack",
                "description": "Grants permission to delete the specified stack. After the stack is deleted, the application streaming environment provided by the stack is no longer available to users. Also, any reservations made for application streaming sessions for the stack are released",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUsageReportSubscription",
                "description": "Grants permission to disable usage report generation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Grants permission to delete a user from the user pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectoryConfigs",
                "description": "Grants permission to retrieve a list that describes one or more specified Directory Config objects for AppStream 2.0, if the names for these objects are provided. Otherwise, all Directory Config objects in the account are described. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleets",
                "description": "Grants permission to retrieve a list that describes one or more specified fleets, if the fleet names are provided. Otherwise, all fleets in the account are described",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImageBuilders",
                "description": "Grants permission to retrieve a list that describes one or more specified image builders, if the image builder names are provided. Otherwise, all image builders in the account are described",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "image-builder",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImagePermissions",
                "description": "Grants permission to retrieve a list that describes the permissions for shared AWS account IDs on a private image that you own",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImages",
                "description": "Grants permission to retrieve a list that describes one or more specified images, if the image names or image ARNs are provided. Otherwise, all images in the account are described",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSessions",
                "description": "Grants permission to retrieve a list that describes the streaming sessions for the specified stack and fleet. If a user ID is provided for the stack and fleet, only the streaming sessions for that user are described",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStacks",
                "description": "Grants permission to retrieve a list that describes one or more specified stacks, if the stack names are provided. Otherwise, all stacks in the account are described",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUsageReportSubscriptions",
                "description": "Grants permission to retrieve a list that describes one or more usage report subscriptions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserStackAssociations",
                "description": "Grants permission to retrieve a list that describes the UserStackAssociation objects",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUsers",
                "description": "Grants permission to retrieve a list that describes users in the user pool",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableUser",
                "description": "Grants permission to disable the specified user in the user pool. This action does not delete the user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateFleet",
                "description": "Grants permission to disassociate the specified fleet from the specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableUser",
                "description": "Grants permission to enable a user in the user pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExpireSession",
                "description": "Grants permission to immediately stop the specified streaming session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImageBuilders",
                "description": "Grants permission to retrieve a list that describes one or more specified image builders, if the image builder names are provided. Otherwise, all image builders in the account are described",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetParametersForThemeAssetUpload",
                "description": "Grants permission to upload theme assets",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociatedFleets",
                "description": "Grants permission to retrieve the name of the fleet that is associated with the specified stack",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociatedStacks",
                "description": "Grants permission to retrieve the name of the stack with which the specified fleet is associated",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to retrieve a list of all tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartFleet",
                "description": "Grants permission to start the specified fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartImageBuilder",
                "description": "Grants permission to start the specified image builder",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image-builder*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopFleet",
                "description": "Grants permission to stop the specified fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopImageBuilder",
                "description": "Grants permission to stop the specified image builder",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image-builder*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Stream",
                "description": "Grants permission to federated users to sign in by using their existing credentials and stream applications from the specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "appstream:userId"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add or overwrite one or more tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "fleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image-builder",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to disassociate one or more tags from the specified AppStream 2.0 resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "fleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image-builder",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDirectoryConfig",
                "description": "Grants permission to update the specified Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFleet",
                "description": "Grants permission to update the specified fleet. All attributes except the fleet name can be updated when the fleet is in the STOPPED state",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateImagePermissions",
                "description": "Grants permission to add or update permissions for the specified private image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStack",
                "description": "Grants permission to update the specified fields for the specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "fleet",
                "arn": "arn:${Partition}:appstream:${Region}:${Account}:fleet/${FleetName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "image",
                "arn": "arn:${Partition}:appstream:${Region}:${Account}:image/${ImageName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "image-builder",
                "arn": "arn:${Partition}:appstream:${Region}:${Account}:image-builder/${ImageBuilderName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "stack",
                "arn": "arn:${Partition}:appstream:${Region}:${Account}:stack/${StackName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "appstream:userId",
                "description": "Filters access by the ID of the AppStream 2.0 user",
                "type": "String"
            },
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS AppSync",
        "prefix": "appsync",
        "privileges": [
            {
                "privilege": "CreateApiKey",
                "description": "Creates a unique key that you can distribute to clients who are executing your API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataSource",
                "description": "Creates a DataSource object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFunction",
                "description": "Create a new Function object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGraphqlApi",
                "description": "Creates a GraphqlApi object, which is the top level AppSync resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResolver",
                "description": "Creates a Resolver object. A resolver converts incoming requests into a format that a data source can understand, and converts the data source's responses into GraphQL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateType",
                "description": "Creates a Type object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApiKey",
                "description": "Deletes an API key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataSource",
                "description": "Deletes a DataSource object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFunction",
                "description": "Deletes a Function object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGraphqlApi",
                "description": "Deletes a GraphqlApi object. This will also clean up every AppSync resource below that API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "graphqlapi*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResolver",
                "description": "Deletes a Resolver object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteType",
                "description": "Deletes a Type object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataSource",
                "description": "Retrieves a DataSource object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunction",
                "description": "Retrieves a Function object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGraphqlApi",
                "description": "Retrieves a GraphqlApi object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "graphqlapi*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIntrospectionSchema",
                "description": "Retrieves the introspection schema for a GraphQL API.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResolver",
                "description": "Retrieves a Resolver object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSchemaCreationStatus",
                "description": "Retrieves the current status of a schema creation operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetType",
                "description": "Retrieves a Type object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GraphQL",
                "description": "Sends a GraphQL query to a GraphQL API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "field*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "graphqlapi*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApiKeys",
                "description": "Lists the API keys for a given API.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDataSources",
                "description": "Lists the data sources for a given API.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFunctions",
                "description": "Lists the functions for a given API.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGraphqlApis",
                "description": "Lists your GraphQL APIs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResolvers",
                "description": "Lists the resolvers for a given API and type.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResolversByFunction",
                "description": "List the resolvers that are associated with a specific function.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List the tags for a resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "graphqlapi",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTypes",
                "description": "Lists the types for a given API.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSchemaCreation",
                "description": "Adds a new schema to your GraphQL API. This operation is asynchronous - GetSchemaCreationStatus can show when it has completed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tag a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "graphqlapi",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untag a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "graphqlapi",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApiKey",
                "description": "Updates an API key for a given API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDataSource",
                "description": "Updates a DataSource object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFunction",
                "description": "Updates an existing Function object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGraphqlApi",
                "description": "Updates a GraphqlApi object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "graphqlapi*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResolver",
                "description": "Updates a Resolver object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateType",
                "description": "Updates a Type object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "datasource",
                "arn": "arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/datasources/${DatasourceName}",
                "condition_keys": []
            },
            {
                "resource": "graphqlapi",
                "arn": "arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "field",
                "arn": "arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/types/${TypeName}/fields/${FieldName}",
                "condition_keys": []
            },
            {
                "resource": "type",
                "arn": "arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/types/${TypeName}",
                "condition_keys": []
            },
            {
                "resource": "function",
                "arn": "arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/functions/${FunctionId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Application Discovery Arsenal",
        "prefix": "arsenal",
        "privileges": [
            {
                "privilege": "RegisterOnPremisesAgent",
                "description": "Grants permission to register AWS provided data collectors to the Application Discovery Service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Artifact",
        "prefix": "artifact",
        "privileges": [
            {
                "privilege": "AcceptAgreement",
                "description": "Grants permission to accept an AWS agreement that has not yet been accepted by the customer account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "agreement*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DownloadAgreement",
                "description": "Grants permission to download an AWS agreement that has not yet been accepted or a customer agreement that has been accepted by the customer account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "agreement",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "customer-agreement",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Get",
                "description": "Grants permission to download an AWS compliance report package.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "report-package*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateAgreement",
                "description": "Grants permission to terminate a customer agreement that was previously accepted by the customer account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "customer-agreement*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "report-package",
                "arn": "arn:${Partition}:artifact:::report-package/*",
                "condition_keys": []
            },
            {
                "resource": "customer-agreement",
                "arn": "arn:${Partition}:artifact::${Account}:customer-agreement/*",
                "condition_keys": []
            },
            {
                "resource": "agreement",
                "arn": "arn:${Partition}:artifact:::agreement/*",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Athena",
        "prefix": "athena",
        "privileges": [
            {
                "privilege": "BatchGetNamedQuery",
                "description": "Grants permissions to get information about one or more named queries.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetQueryExecution",
                "description": "Grants permissions to get information about one or more query executions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelQueryExecution",
                "description": "Deprecated. Applies only to AWS services and principals that use Athena JDBC driver earlier than 1.1.0. Use StopQueryExecution otherwise.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNamedQuery",
                "description": "Grants permissions to create a named query.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWorkGroup",
                "description": "Grants permissions to create a workgroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNamedQuery",
                "description": "Grants permissions to delete a named query specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWorkGroup",
                "description": "Grants permissions to delete a workgroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCatalogs",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to databases and tables.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExecutionEngine",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to the specified database and table.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExecutionEngines",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to databases and tables.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNamedQuery",
                "description": "Grants permissions to get information about the specified named query.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNamespace",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to the specified database and table.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNamespaces",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to databases and tables.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryExecution",
                "description": "Grants permissions to get information about the specified query execution.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryExecutions",
                "description": "Deprecated. Applies only to AWS services and principals that use Athena JDBC driver earlier than 1.1.0. Use ListQueryExecutions otherwise.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryResults",
                "description": "Grants permissions to get the query results.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryResultsStream",
                "description": "Grants permissions to get the query results stream.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTable",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to the specified table.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTables",
                "description": "Applies only to AWS services managed policy and principals that use an Athena JDBC driver version 1.1.0. Grants permissions to enable access to tables.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkGroup",
                "description": "Grants permissions to get a workgroup.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNamedQueries",
                "description": "Grants permissions to return a list of named queries in Amazon Athena for the specified AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQueryExecutions",
                "description": "Grants permissions to return a list of query executions for the specified AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permissions to return a list of tags for a workgroup.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkGroups",
                "description": "Grants permissions to return a list of workgroups for the specified AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunQuery",
                "description": "Deprecated. Applies only to AWS services and principals that use Athena JDBC driver earlier than 1.1.0. Use StartQueryExecution otherwise.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartQueryExecution",
                "description": "Grants permissions to start a query execution using an SQL query provided as a string.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopQueryExecution",
                "description": "Grants permissions to stop the specified query execution.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permissions to add a tag to a workgroup.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permissions to remove a tag from a workgroup.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWorkGroup",
                "description": "Grants permissions to update a workgroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "workgroup",
                "arn": "arn:${Partition}:athena:${Region}:${Account}:workgroup/${WorkGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon EC2 Auto Scaling",
        "prefix": "autoscaling",
        "privileges": [
            {
                "privilege": "AttachInstances",
                "description": "Attaches one or more EC2 instances to the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachLoadBalancerTargetGroups",
                "description": "Attaches one or more target groups to the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:TargetGroupARNs"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachLoadBalancers",
                "description": "Attaches one or more load balancers to the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:LoadBalancerNames"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteScheduledAction",
                "description": "Deletes the specified scheduled actions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchPutScheduledUpdateGroupAction",
                "description": "Creates or updates multiple scheduled scaling actions for an Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteLifecycleAction",
                "description": "Completes the lifecycle action for the specified token or instance with the specified result.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAutoScalingGroup",
                "description": "Creates an Auto Scaling group with the specified name and attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:InstanceTypes",
                            "autoscaling:LaunchConfigurationName",
                            "autoscaling:LaunchTemplateVersionSpecified",
                            "autoscaling:LoadBalancerNames",
                            "autoscaling:MaxSize",
                            "autoscaling:MinSize",
                            "autoscaling:TargetGroupARNs",
                            "autoscaling:VPCZoneIdentifiers",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLaunchConfiguration",
                "description": "Creates a launch configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "launchConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:ImageId",
                            "autoscaling:InstanceType",
                            "autoscaling:SpotPrice"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOrUpdateTags",
                "description": "Creates or updates tags for the specified Auto Scaling group.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAutoScalingGroup",
                "description": "Deletes the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLaunchConfiguration",
                "description": "Deletes the specified launch configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "launchConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLifecycleHook",
                "description": "Deletes the specified lifecycle hook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNotificationConfiguration",
                "description": "Deletes the specified notification.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicy",
                "description": "Deletes the specified Auto Scaling policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScheduledAction",
                "description": "Deletes the specified scheduled action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Deletes the specified tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountLimits",
                "description": "Describes the current Auto Scaling resource limits for your AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAdjustmentTypes",
                "description": "Describes the policy adjustment types for use with PutScalingPolicy.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAutoScalingGroups",
                "description": "Describes one or more Auto Scaling groups. If a list of names is not provided, the call describes all Auto Scaling groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAutoScalingInstances",
                "description": "Describes one or more Auto Scaling instances. If a list is not provided, the call describes all instances.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAutoScalingNotificationTypes",
                "description": "Describes the notification types that are supported by Auto Scaling.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLaunchConfigurations",
                "description": "Describes one or more launch configurations. If you omit the list of names, then the call describes all launch configurations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLifecycleHookTypes",
                "description": "Describes the available types of lifecycle hooks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLifecycleHooks",
                "description": "Describes the lifecycle hooks for the specified Auto Scaling group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancerTargetGroups",
                "description": "Describes the target groups for the specified Auto Scaling group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancers",
                "description": "Describes the load balancers for the specified Auto Scaling group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMetricCollectionTypes",
                "description": "Describes the available CloudWatch metrics for Auto Scaling.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNotificationConfigurations",
                "description": "Describes the notification actions associated with the specified Auto Scaling group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePolicies",
                "description": "Describes the policies for the specified Auto Scaling group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingActivities",
                "description": "Describes one or more scaling activities for the specified Auto Scaling group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingProcessTypes",
                "description": "Describes the scaling process types for use with ResumeProcesses and SuspendProcesses.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScheduledActions",
                "description": "Describes the actions scheduled for your Auto Scaling group that haven't run.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Describes the specified tags.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTerminationPolicyTypes",
                "description": "Describes the termination policies supported by Auto Scaling.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachInstances",
                "description": "Removes one or more instances from the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachLoadBalancerTargetGroups",
                "description": "Detaches one or more target groups from the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:TargetGroupARNs"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachLoadBalancers",
                "description": "Removes one or more load balancers from the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:LoadBalancerNames"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableMetricsCollection",
                "description": "Disables monitoring of the specified metrics for the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableMetricsCollection",
                "description": "Enables monitoring of the specified metrics for the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnterStandby",
                "description": "Moves the specified instances into Standby mode.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecutePolicy",
                "description": "Executes the specified policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExitStandby",
                "description": "Moves the specified instances out of Standby mode.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLifecycleHook",
                "description": "Creates or updates a lifecycle hook for the specified Auto Scaling Group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutNotificationConfiguration",
                "description": "Configures an Auto Scaling group to send notifications when specified events take place.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutScalingPolicy",
                "description": "Creates or updates a policy for an Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutScheduledUpdateGroupAction",
                "description": "Creates or updates a scheduled scaling action for an Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:MaxSize",
                            "autoscaling:MinSize"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RecordLifecycleActionHeartbeat",
                "description": "Records a heartbeat for the lifecycle action associated with the specified token or instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResumeProcesses",
                "description": "Resumes the specified suspended Auto Scaling processes, or all suspended process, for the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDesiredCapacity",
                "description": "Sets the size of the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetInstanceHealth",
                "description": "Sets the health status of the specified instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetInstanceProtection",
                "description": "Updates the instance protection settings of the specified instances.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SuspendProcesses",
                "description": "Suspends the specified Auto Scaling processes, or all processes, for the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateInstanceInAutoScalingGroup",
                "description": "Terminates the specified instance and optionally adjusts the desired group size.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAutoScalingGroup",
                "description": "Updates the configuration for the specified Auto Scaling group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "autoScalingGroup*",
                        "condition_keys": [
                            "autoscaling:ResourceTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "autoscaling:InstanceTypes",
                            "autoscaling:LaunchConfigurationName",
                            "autoscaling:LaunchTemplateVersionSpecified",
                            "autoscaling:MaxSize",
                            "autoscaling:MinSize",
                            "autoscaling:VPCZoneIdentifiers"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "autoScalingGroup",
                "arn": "arn:${Partition}:autoscaling:${Region}:${Account}:autoScalingGroup:${GroupId}:autoScalingGroupName/${GroupFriendlyName}",
                "condition_keys": [
                    "autoscaling:ResourceTag/${TagKey}",
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "launchConfiguration",
                "arn": "arn:${Partition}:autoscaling:${Region}:${Account}:launchConfiguration:${Id}:launchConfigurationName/${LaunchConfigurationName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "autoscaling:ImageId",
                "description": "The AMI used to create the instance.",
                "type": "String"
            },
            {
                "condition": "autoscaling:InstanceType",
                "description": "The type of instance, in terms of the hardware resources available.",
                "type": "String"
            },
            {
                "condition": "autoscaling:InstanceTypes",
                "description": "The types of instances, in terms of the hardware resources available.",
                "type": "String"
            },
            {
                "condition": "autoscaling:LaunchConfigurationName",
                "description": "The name of a launch configuration.",
                "type": "String"
            },
            {
                "condition": "autoscaling:LaunchTemplateVersionSpecified",
                "description": "Filters access by whether users can specify any version of a launch template or only the Latest or Default version",
                "type": "Bool"
            },
            {
                "condition": "autoscaling:LoadBalancerNames",
                "description": "The name of the load balancer.",
                "type": "String"
            },
            {
                "condition": "autoscaling:MaxSize",
                "description": "The maximum scaling size.",
                "type": "Numeric"
            },
            {
                "condition": "autoscaling:MinSize",
                "description": "The minimum scaling size.",
                "type": "Numeric"
            },
            {
                "condition": "autoscaling:ResourceTag/${TagKey}",
                "description": "The value of a tag attached to a resource.",
                "type": "String"
            },
            {
                "condition": "autoscaling:SpotPrice",
                "description": "The spot price associated with an instance.",
                "type": "Numeric"
            },
            {
                "condition": "autoscaling:TargetGroupARNs",
                "description": "The ARN of a target group.",
                "type": "ARN"
            },
            {
                "condition": "autoscaling:VPCZoneIdentifiers",
                "description": "The identifier of a VPC zone.",
                "type": "String"
            },
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "The value of a tag associated with the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Auto Scaling",
        "prefix": "autoscaling-plans",
        "privileges": [
            {
                "privilege": "CreateScalingPlan",
                "description": "Creates a scaling plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScalingPlan",
                "description": "Deletes the specified scaling plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingPlanResources",
                "description": "Describes the scalable resources in the specified scaling plan.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingPlans",
                "description": "Describes the specified scaling plans or all of your scaling plans.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetScalingPlanResourceForecastData",
                "description": "Retrieves the forecast data for a scalable resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateScalingPlan",
                "description": "Updates a scaling plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "AcceptAgreementApprovalRequest",
                "description": "Allows users to approve an incoming subscription request (for providers who provide products that require subscription verification).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelAgreementRequest",
                "description": "Allows users to cancel pending subscription requests for products that require subscription verification.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAgreementApprovalRequest",
                "description": "Allows users to view the details of their incoming subscription requests (for providers who provide products that require subscription verification).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAgreementRequest",
                "description": "Allows users to view the details of their subscription requests for data products that require subscription verification.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAgreementApprovalRequests",
                "description": "Allows users to list their incoming subscription requests (for providers who provide products that require subscription verification).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAgreementRequests",
                "description": "Allows users to list their subscription requests for products that require subscription verification.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectAgreementApprovalRequest",
                "description": "Allows users to decline an incoming subscription requests (for providers who provide products that require subscription verification).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Subscribe",
                "description": "Allows users to subscribe to AWS Marketplace products. Includes the ability to send a subscription request for products that require subscription verification. Includes the ability to enable auto-renewal for an existing subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Unsubscribe",
                "description": "Allows users to remove subscriptions to AWS Marketplace products. Includes the ability to disable auto-renewal for an existing subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAgreementApprovalRequest",
                "description": "Allows users to make changes to an incoming subscription request, including the ability to delete the prospective subscriber's information (for providers who provide products that require subscription verification).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewSubscriptions",
                "description": "Allows users to see their account's subscriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace Catalog",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "CancelChangeSet",
                "description": "Cancels a running change set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteTask",
                "description": "Complete an existing task and submit the content to the associated change.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChangeSet",
                "description": "Returns the details of an existing change set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEntity",
                "description": "Returns the details of an existing entity.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTask",
                "description": "Returns the details of an existing task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChangeSets",
                "description": "Lists existing change sets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEntities",
                "description": "Lists existing entities.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTasks",
                "description": "Lists existing tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartChangeSet",
                "description": "Requests a new change set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "catalog:ChangeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTask",
                "description": "Update the content of an existing task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Entity",
                "arn": "arn:${Partition}:aws-marketplace:${Region}:${Account}:${Catalog}/${EntityType}/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "ChangeSet",
                "arn": "arn:${Partition}:aws-marketplace:${Region}:${Account}:${Catalog}/ChangeSet/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "catalog:ChangeType",
                "description": "Enables you to verify change type in the StartChangeSet request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Private Marketplace",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "AssociateProductsWithPrivateMarketplace",
                "description": "Adds new approved products to the Private Marketplace. Also allows to approve a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePrivateMarketplace",
                "description": "Creates a Private Marketplace for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePrivateMarketplaceProfile",
                "description": "Creates a Private Marketplace Profile that customizes the white label experience on the AWS Marketplace website for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePrivateMarketplaceRequests",
                "description": "Creates a new request for a product or products to be associated with the Private Marketplace. This action can be performed by any account in an in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrivateMarketplaceProducts",
                "description": "Describes the status of requested products in the Private Marketplace for administrative purposes. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrivateMarketplaceProfile",
                "description": "Describes details about the Private Marketplace Profile for administrative purposes. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrivateMarketplaceRequests",
                "description": "Describes requests and associated products in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrivateMarketplaceSettings",
                "description": "Describes the Private Marketplace settings. This includes setting for enabling requests from end users and preferences for notifications. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrivateMarketplaceStatus",
                "description": "Describes the status of the Private Marketplace for administrative purposes. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateProductsFromPrivateMarketplace",
                "description": "Removes approved products from the Private Marketplace. Also allows to decline a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPrivateMarketplaceProducts",
                "description": "Queryable list for the products and status of products in the Private Marketplace for administrative purposes. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPrivateMarketplaceRequests",
                "description": "Queryable list for requests and associated products in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartPrivateMarketplace",
                "description": "Starts the Private Marketplace, enabling the customized AWS Marketplace experience, and enabling restrictions on the procurement of products based on what is available in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopPrivateMarketplace",
                "description": "Stops the Private Marketplace, disabling the customized AWS Marketplace experience and removing the Private Marketplace procurement restrictions on products. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePrivateMarketplaceProfile",
                "description": "Updates the Private Marketplace Profile that customizes the white label experience on the AWS Marketplace website for the individual account, or for the entire AWS Organization if one exists. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePrivateMarketplaceSettings",
                "description": "Updates the Private Marketplace settings. This includes setting for enabling requests from end users and preferences for notifications. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace Metering Service",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "BatchMeterUsage",
                "description": "Called from a SaaS application listed on the AWS Marketplace to post metering records for a set of customers.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MeterUsage",
                "description": "Emits metering records.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterUsage",
                "description": "Allows you to verify that the customer running your paid software is subscribed to your product on AWS Marketplace, enabling you to guard against unauthorized use. Meters software use per ECS task, per hour, with usage prorated to the second.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResolveCustomer",
                "description": "Resolves a registration token to obtain a CustomerIdentifier and product code.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace Procurement Systems Integration",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "DescribeProcurementSystemConfiguration",
                "description": "Describes the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutProcurementSystemConfiguration",
                "description": "Creates or updates the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace Image Building Service",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "DescribeBuilds",
                "description": "Describes Image Builds identified by a build Id",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBuilds",
                "description": "Lists Image Builds.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartBuild",
                "description": "Starts an Image Build",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace Entitlement Service",
        "prefix": "aws-marketplace",
        "privileges": [
            {
                "privilege": "GetEntitlements",
                "description": "Retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Marketplace Management Portal",
        "prefix": "aws-marketplace-management",
        "privileges": [
            {
                "privilege": "uploadFiles",
                "description": "Allows a user to access the File Upload page inside the AWS Marketplace Management Portal.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "viewMarketing",
                "description": "Allows a user to access the Marketing page inside the AWS Marketplace Management Portal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "viewReports",
                "description": "Allows a user to access the Reports page inside the AWS Marketplace Management Portal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "viewSettings",
                "description": "Allows a user to access the Settings page inside the AWS Marketplace Management Portal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "viewSupport",
                "description": "Allows a user to access the Customer Support Eligibility page inside the AWS Marketplace Management Portal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Billing",
        "prefix": "aws-portal",
        "privileges": [
            {
                "privilege": "ModifyAccount",
                "description": "Allow or deny IAM users permission to modify Account Settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyBilling",
                "description": "Allow or deny IAM users permission to modify billing settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyPaymentMethods",
                "description": "Allow or deny IAM users permission to modify payment methods.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewAccount",
                "description": "Allow or deny IAM users permission to view account settings.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewBilling",
                "description": "Allow or deny IAM users permission to view billing pages in the console.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewPaymentMethods",
                "description": "Allow or deny IAM users permission to view payment methods.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewUsage",
                "description": "Allow or deny IAM users permission to view AWS usage reports.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Connector Service",
        "prefix": "awsconnector",
        "privileges": [
            {
                "privilege": "GetConnectorHealth",
                "description": "Retrieves all health metrics that were published from the Server Migration Connector.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterConnector",
                "description": "Registers AWS Connector with AWS Connector Service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateConnectorId",
                "description": "Validates Server Migration Connector Id that was registered with AWS Connector Service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Backup",
        "prefix": "backup",
        "privileges": [
            {
                "privilege": "CopyIntoBackupVault",
                "description": "Copy into a backup vault",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBackupPlan",
                "description": "Creates a new backup plan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBackupSelection",
                "description": "Creates a new resource assignment in a backup plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateBackupVault",
                "description": "Creates a new backup vault.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackupPlan",
                "description": "Deletes a backup plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackupSelection",
                "description": "Deletes a resource assignment from a backup plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackupVault",
                "description": "Deletes a backup vault.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackupVaultAccessPolicy",
                "description": "Deletes backup vault access policy.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackupVaultNotifications",
                "description": "Remove notifications from backup vault.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRecoveryPoint",
                "description": "Deletes a recovery point from a backup vault.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "recoveryPoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBackupJob",
                "description": "Describes a backup job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBackupVault",
                "description": "Creates a new backup vault with the specified name.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCopyJob",
                "description": "Describes a copy job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProtectedResource",
                "description": "Describes a protected resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRecoveryPoint",
                "description": "Describes a recovery point.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "recoveryPoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRestoreJob",
                "description": "Describes a restore job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportBackupPlanTemplate",
                "description": "Exports a backup plan as a JSON.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackupPlan",
                "description": "Gets a backup plan.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackupPlanFromJSON",
                "description": "Transforms a JSON to a backup plan.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackupPlanFromTemplate",
                "description": "Transforms a template to a backup plan.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackupSelection",
                "description": "Gets a backup plan resource assignment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackupVaultAccessPolicy",
                "description": "Gets backup vault access policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBackupVaultNotifications",
                "description": "Gets backup vault notifications.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecoveryPointRestoreMetadata",
                "description": "Gets recovery point restore metadata.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "recoveryPoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSupportedResourceTypes",
                "description": "Gets supported resource types.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackupJobs",
                "description": "Lists backup jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackupPlanTemplates",
                "description": "Lists backup plan templates provided by AWS Backup.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackupPlanVersions",
                "description": "Lists backup plan versions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackupPlans",
                "description": "Lists backup plans.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackupSelections",
                "description": "Lists resource assignments for a specific backup plan.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackupVaults",
                "description": "Lists backup vaults.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCopyJobs",
                "description": "List copy jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProtectedResources",
                "description": "Lists protected resources by AWS Backup.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRecoveryPointsByBackupVault",
                "description": "Lists recovery points inside a backup vault.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRecoveryPointsByResource",
                "description": "Lists recovery points for a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRestoreJobs",
                "description": "Lists restore jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Lists tags for a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBackupVaultAccessPolicy",
                "description": "Adds an access policy to the backup vault.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBackupVaultNotifications",
                "description": "Adds an SNS topic to the backup vault.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartBackupJob",
                "description": "Starts a new backup job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupVault*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "StartCopyJob",
                "description": "Copy a backup from a source region to a destination region.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "recoveryPoint*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartRestoreJob",
                "description": "Starts a new restore job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "recoveryPoint*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "StopBackupJob",
                "description": "Stops a backup job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untags a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBackupPlan",
                "description": "Updates a backup plan.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backupPlan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRecoveryPointLifecycle",
                "description": "Updates the lifecycle of the recovery point.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "recoveryPoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "backupVault",
                "arn": "arn:${Partition}:backup:${Region}:${Account}:backup-vault:${BackupVaultName}",
                "condition_keys": []
            },
            {
                "resource": "backupPlan",
                "arn": "arn:${Partition}:backup:${Region}:${Account}:backup-plan:${BackupPlanId}",
                "condition_keys": []
            },
            {
                "resource": "recoveryPoint",
                "arn": "arn:${Partition}:${Vendor}:${Region}:*:${ResourceType}:${RecoveryPointId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Backup storage",
        "prefix": "backup-storage",
        "privileges": [
            {
                "privilege": "MountCapsule",
                "description": "Associates a KMS key to a backup vault",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Batch",
        "prefix": "batch",
        "privileges": [
            {
                "privilege": "CancelJob",
                "description": "Cancels jobs in an AWS Batch job queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateComputeEnvironment",
                "description": "Creates an AWS Batch compute environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJobQueue",
                "description": "Creates an AWS Batch job queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteComputeEnvironment",
                "description": "Deletes an AWS Batch compute environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJobQueue",
                "description": "Deletes the specified job queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterJobDefinition",
                "description": "Deregisters an AWS Batch job definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComputeEnvironments",
                "description": "Describes one or more of your compute environments.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJobDefinitions",
                "description": "Describes a list of job definitions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJobQueues",
                "description": "Describes one or more of your job queues.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJobs",
                "description": "Describes a list of AWS Batch jobs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Returns a list of task jobs for a specified job queue.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterJobDefinition",
                "description": "Registers an AWS Batch job definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "batch:User",
                            "batch:Privileged",
                            "batch:Image"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubmitJob",
                "description": "Submits an AWS Batch job from a job definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job-queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateJob",
                "description": "Terminates jobs in a job queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateComputeEnvironment",
                "description": "Updates an AWS Batch compute environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJobQueue",
                "description": "Updates a job queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "job-queue",
                "arn": "arn:${Partition}:batch:${Region}:${Account}:job-queue/${JobQueueName}",
                "condition_keys": []
            },
            {
                "resource": "job-definition",
                "arn": "arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}:${Revision}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "batch:Image",
                "description": "The image used to start a container.",
                "type": "String"
            },
            {
                "condition": "batch:Privileged",
                "description": "When this parameter is true, the container is given elevated privileges on the host container instance (similar to the root user).",
                "type": "Boolean"
            },
            {
                "condition": "batch:User",
                "description": "The user name or numeric uid to use inside the container.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Budget Service",
        "prefix": "budgets",
        "privileges": [
            {
                "privilege": "ModifyBudget",
                "description": "Modify budgets and budget details",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "budget*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewBudget",
                "description": "View budgets and budget details",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "budget*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "budget",
                "arn": "arn:${Partition}:budgets::${Account}:budget/${BudgetName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Managed Apache Cassandra Service",
        "prefix": "cassandra",
        "privileges": [
            {
                "privilege": "Alter",
                "description": "Grants permission to alter a keyspace or table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "keyspace",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Create",
                "description": "Grants permission to create a keyspace or table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "keyspace",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Drop",
                "description": "Grants permission to drop a keyspace or table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "keyspace",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Modify",
                "description": "Grants permission to INSERT, UPDATE or DELETE data in a table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Select",
                "description": "Grants permission to SELECT data from a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag a keyspace or table",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "keyspace",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag a keyspace or table",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "keyspace",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "keyspace",
                "arn": "arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${KeyspaceName}/",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "table",
                "arn": "arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${KeyspaceName}/table/${tableName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Cost Explorer Service",
        "prefix": "ce",
        "privileges": [
            {
                "privilege": "CreateCostCategoryDefinition",
                "description": "Grants permission to create a new Cost Category with the requested name and rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCostCategoryDefinition",
                "description": "Grants permission to delete a Cost Category.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCostCategoryDefinition",
                "description": "Grants permission to retrieve descriptions such as the name, ARN, rules, definition, and effective dates of a Cost Category.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCostAndUsage",
                "description": "Grants permission to retrieve the cost and usage metrics for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCostAndUsageWithResources",
                "description": "Grants permission to retrieve the cost and usage metrics with resources for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCostForecast",
                "description": "Grants permission to retrieve a cost forecast for a forecast time period.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDimensionValues",
                "description": "Grants permission to retrieve all available filter values for a filter for a period of time.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReservationCoverage",
                "description": "Grants permission to retrieve the reservation coverage for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReservationPurchaseRecommendation",
                "description": "Grants permission to retrieve the reservation recommendations for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReservationUtilization",
                "description": "Grants permission to retrieve the reservation utilization for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRightsizingRecommendation",
                "description": "Grants permission to retrieve the rightsizing recommendations for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSavingsPlansCoverage",
                "description": "Grants permission to retrieve the Savings Plans coverage for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSavingsPlansPurchaseRecommendation",
                "description": "Grants permission to retrieve the Savings Plans recommendations for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSavingsPlansUtilization",
                "description": "Grants permission to retrieve the Savings Plans utilization for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSavingsPlansUtilizationDetails",
                "description": "Grants permission to retrieve the Savings Plans utilization details for your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTags",
                "description": "Grants permission to query tags for a specified time period.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUsageForecast",
                "description": "Grants permission to retrieve a usage forecast for a forecast time period.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCostCategoryDefinitions",
                "description": "Grants permission to retrieve names, ARN, and effective dates for all Cost Categories.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCostCategoryDefinition",
                "description": "Grants permission to update an existing Cost Category.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Chatbot",
        "prefix": "chatbot",
        "privileges": [
            {
                "privilege": "CreateChimeWebhookConfiguration",
                "description": "Creates an AWS Chatbot Chime Webhook Configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSlackChannelConfiguration",
                "description": "Creates an AWS Chatbot Slack Channel Configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteChimeWebhookConfiguration",
                "description": "Deletes an AWS Chatbot Chime Webhook Configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSlackChannelConfiguration",
                "description": "Deletes an AWS Chatbot Slack Channel Configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChimeWebhookConfigurations",
                "description": "Lists all AWS Chatbot Chime Webhook Configurations in an AWS Account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSlackChannelConfigurations",
                "description": "Lists all AWS Chatbot Slack Channel Configurations in an AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSlackChannels",
                "description": "Lists all public Slack channels in the Slack workspace connected to the AWS Account onboarded with AWS Chatbot service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSlackWorkspaces",
                "description": "Lists all authorized Slack workspaces connected to the AWS Account onboarded with AWS Chatbot service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSlackOauthParameters",
                "description": "Generate OAuth parameters to request Slack OAuth code to be used by the AWS Chatbot service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RedeemSlackOauthCode",
                "description": "Redeem previously generated parameters with Slack API, to acquire OAuth tokens to be used by the AWS Chatbot service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateChimeWebhookConfiguration",
                "description": "Updates an AWS Chatbot Chime Webhook Configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSlackChannelConfiguration",
                "description": "Updates an AWS Chatbot Slack Channel Configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "ChatbotConfiguration",
                "arn": "arn:${Partition}:chatbot::${account}:${resourceType}/${resourceName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Chime",
        "prefix": "chime",
        "privileges": [
            {
                "privilege": "AcceptDelegate",
                "description": "Grants permission to accept the delegate invitation to share management of an Amazon Chime account with another AWS Account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ActivateUsers",
                "description": "Grants permission to activate users in an Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddDomain",
                "description": "Grants permission to add a domain to your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddOrUpdateGroups",
                "description": "Grants permission to add new or update existing Active Directory or Okta user groups associated with your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociatePhoneNumberWithUser",
                "description": "Grants permission to associate a phone number with an Amazon Chime user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociatePhoneNumbersWithVoiceConnector",
                "description": "Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociatePhoneNumbersWithVoiceConnectorGroup",
                "description": "Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector Group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateSigninDelegateGroupsWithAccount",
                "description": "Grants permission to associate the specified sign-in delegate groups with the specified Amazon Chime account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeDirectory",
                "description": "Grants permission to authorize an Active Directory for your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchCreateAttendee",
                "description": "Grants permission to create new attendees for an active Amazon Chime SDK meeting",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchCreateRoomMembership",
                "description": "Grants permission to batch add room members",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeletePhoneNumber",
                "description": "Grants permission to move up to 50 phone numbers to the deletion queue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchSuspendUser",
                "description": "Grants permission to suspend up to 50 users from a Team or EnterpriseLWA Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchUnsuspendUser",
                "description": "Grants permission to remove the suspension from up to 50 previously suspended users for the specified Amazon Chime EnterpriseLWA account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchUpdatePhoneNumber",
                "description": "Grants permission to update phone number details within the UpdatePhoneNumberRequestItem object for up to 50 phone numbers",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchUpdateUser",
                "description": "Grants permission to update user details within the UpdateUserRequestItem object for up to 20 users for the specified Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConnectDirectory",
                "description": "Grants permission to connect an Active Directory to your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ds:ConnectDirectory"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateAccount",
                "description": "Grants permission to create an Amazon Chime account under the administrator's AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApiKey",
                "description": "Grants permission to create a new SCIM access key for your Amazon Chime account and Okta configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAttendee",
                "description": "Grants permission to create a new attendee for an active Amazon Chime SDK meeting",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBot",
                "description": "Grants permission to create a bot for an Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBotMembership",
                "description": "Grants permission to add a bot to a chat room in your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCDRBucket",
                "description": "Grants permission to create a new Call Detail Record S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:CreateBucket",
                            "s3:ListAllMyBuckets"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateMeeting",
                "description": "Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with no initial attendees",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePhoneNumberOrder",
                "description": "Grants permission to create a phone number order with the Carriers",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProxySession",
                "description": "Grants permission to create a proxy session for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoom",
                "description": "Grants permission to create a room",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoomMembership",
                "description": "Grants permission to add a room member",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Grants permission to create a user under the specified Amazon Chime account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVoiceConnector",
                "description": "Grants permission to create a Amazon Chime Voice Connector under the administrator's AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVoiceConnectorGroup",
                "description": "Grants permission to create a Amazon Chime Voice Connector Group under the administrator's AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccount",
                "description": "Grants permission to delete the specified Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccountOpenIdConfig",
                "description": "Grants permission to delete the OpenIdConfig attributes from your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApiKey",
                "description": "Grants permission to delete the specified SCIM access key associated with your Amazon Chime account and Okta configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAttendee",
                "description": "Grants permission to delete the specified attendee from an Amazon Chime SDK meeting",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCDRBucket",
                "description": "Grants permission to delete a Call Detail Record S3 bucket from your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:DeleteBucket"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteDelegate",
                "description": "Grants permission to delete delegated AWS account management from your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomain",
                "description": "Grants permission to delete a domain from your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventsConfiguration",
                "description": "Grants permission to delete an events configuration for a bot to receive outgoing events",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroups",
                "description": "Grants permission to delete Active Directory or Okta user groups from your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMeeting",
                "description": "Grants permission to delete the specified Amazon Chime SDK meeting",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePhoneNumber",
                "description": "Grants permission to move a phone number to the deletion queue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProxySession",
                "description": "Grants permission to delete a proxy session for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoom",
                "description": "Grants permission to delete a room",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoomMembership",
                "description": "Grants permission to remove a room member",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnector",
                "description": "Grants permission to delete the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnectorGroup",
                "description": "Grants permission to delete the specified Amazon Chime Voice Connector Group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnectorOrigination",
                "description": "Grants permission to delete the origination settings for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnectorProxy",
                "description": "Grants permission to delete proxy configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnectorStreamingConfiguration",
                "description": "Grants permission to delete streaming configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnectorTermination",
                "description": "Grants permission to delete the termination settings for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceConnectorTerminationCredentials",
                "description": "Grants permission to delete SIP termination credentials for the specified Amazon Chime Voice Connector",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociatePhoneNumberFromUser",
                "description": "Grants permission to disassociate the primary provisioned number from the specified Amazon Chime user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociatePhoneNumbersFromVoiceConnector",
                "description": "Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociatePhoneNumbersFromVoiceConnectorGroup",
                "description": "Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector Group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateSigninDelegateGroupsFromAccount",
                "description": "Grants permission to disassociate the specified sign-in delegate groups from the specified Amazon Chime account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisconnectDirectory",
                "description": "Grants permission to disconnect the Active Directory from your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccount",
                "description": "Grants permission to get details for the specified Amazon Chime account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountResource",
                "description": "Grants permission to get details for the account resource associated with your Amazon Chime account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountSettings",
                "description": "Grants permission to get account settings for the specified Amazon Chime account ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountWithOpenIdConfig",
                "description": "Grants permission to get the account details and OpenIdConfig attributes for your Amazon Chime account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAttendee",
                "description": "Grants permission to get attendee details for a specified meeting ID and attendee ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBot",
                "description": "Grants permission to retrieve details for the specified bot",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCDRBucket",
                "description": "Grants permission to get details of a Call Detail Record S3 bucket associated with your Amazon Chime account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetBucketAcl",
                            "s3:GetBucketLocation",
                            "s3:GetBucketLogging",
                            "s3:GetBucketVersioning",
                            "s3:GetBucketWebsite"
                        ]
                    }
                ]
            },
            {
                "privilege": "GetDomain",
                "description": "Grants permission to get domain details for a domain associated with your Amazon Chime account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEventsConfiguration",
                "description": "Grants permission to retrieve details for an events configuration for a bot to receive outgoing events",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGlobalSettings",
                "description": "Grants permission to get global settings related to Amazon Chime for the AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMeeting",
                "description": "Grants permission to get the meeting record for a specified meeting ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMeetingDetail",
                "description": "Grants permission to get attendee, connection, and other details for a meeting",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPhoneNumber",
                "description": "Grants permission to get details for the specified phone number",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPhoneNumberOrder",
                "description": "Grants permission to get details for the specified phone number order",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPhoneNumberSettings",
                "description": "Grants permission to get phone number settings related to Amazon Chime for the AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProxySession",
                "description": "Grants permission to get details of the specified proxy session for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRoom",
                "description": "Grants permission to retrieve a room",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTelephonyLimits",
                "description": "Grants permission to get telephony limits for the AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUser",
                "description": "Grants permission to get details for the specified user ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserActivityReportData",
                "description": "Grants permission to get a summary of user activity on the user details page",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserByEmail",
                "description": "Grants permission to get user details for an Amazon Chime user based on the email address in an Amazon Chime Enterprise or Team account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserSettings",
                "description": "Grants permission to get user settings related to the specified Amazon Chime user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnector",
                "description": "Grants permission to get details for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorGroup",
                "description": "Grants permission to get details for the specified Amazon Chime Voice Connector Group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorLoggingConfiguration",
                "description": "Grants permission to get details of the logging configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorOrigination",
                "description": "Grants permission to get details of the origination settings for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorProxy",
                "description": "Grants permission to get details of the proxy configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorStreamingConfiguration",
                "description": "Grants permission to get details of the streaming configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorTermination",
                "description": "Grants permission to get details of the termination settings for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceConnectorTerminationHealth",
                "description": "Grants permission to get details of the termination health for the specified Amazon Chime Voice Connector",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InviteDelegate",
                "description": "Grants permission to send an invitation to accept a request for AWS account delegation for an Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InviteUsers",
                "description": "Grants permission to invite as many as 50 users to the specified Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InviteUsersFromProvider",
                "description": "Grants permission to invite users from a third party provider to your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccountUsageReportData",
                "description": "Grants permission to list Amazon Chime account usage reporting data",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccounts",
                "description": "Grants permission to list the Amazon Chime accounts under the administrator's AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApiKeys",
                "description": "Grants permission to list the SCIM access keys defined for your Amazon Chime account and Okta configuration",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttendeeTags",
                "description": "Grants permission to list the tags applied to an Amazon Chime SDK attendee resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttendees",
                "description": "Grants permission to list up to 100 attendees for a specified Amazon Chime SDK meeting",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBots",
                "description": "Grants permission to list the bots associated with the administrator's Amazon Chime Enterprise account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCDRBucket",
                "description": "Grants permission to list Call Detail Record S3 buckets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:ListAllMyBuckets",
                            "s3:ListBucket"
                        ]
                    }
                ]
            },
            {
                "privilege": "ListCallingRegions",
                "description": "Grants permission to list the calling regions available for the administrator's AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDelegates",
                "description": "Grants permission to list account delegate information associated with your Amazon Chime account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDirectories",
                "description": "Grants permission to list active Active Directories hosted in the Directory Service of your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomains",
                "description": "Grants permission to list domains associated with your Amazon Chime account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Grants permission to list Active Directory or Okta user groups associated with your Amazon Chime Enterprise account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeetingEvents",
                "description": "Grants permission to list all events that occurred for a specified meeting",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeetingTags",
                "description": "Grants permission to list the tags applied to an Amazon Chime SDK meeting resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeetings",
                "description": "Grants permission to list up to 100 active Amazon Chime SDK meetings",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeetingsReportData",
                "description": "Grants permission to list meetings ended during the specified date range",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPhoneNumberOrders",
                "description": "Grants permission to list the phone number orders under the administrator's AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPhoneNumbers",
                "description": "Grants permission to list the phone numbers under the administrator's AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProxySessions",
                "description": "Grants permission to list proxy sessions for the specified Amazon Chime Voice Connector",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoomMemberships",
                "description": "Grants permission to list all room members",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRooms",
                "description": "Grants permission to list rooms",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags applied to an Amazon Chime SDK meeting resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Grants permission to list the users that belong to the specified Amazon Chime account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVoiceConnectorGroups",
                "description": "Grants permission to list the Amazon Chime Voice Connector Groups under the administrator's AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVoiceConnectorTerminationCredentials",
                "description": "Grants permission to list the SIP termination credentials for the specified Amazon Chime Voice Connector",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVoiceConnectors",
                "description": "Grants permission to list the Amazon Chime Voice Connectors under the administrator's AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LogoutUser",
                "description": "Grants permission to log out the specified user from all of the devices they are currently logged into",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEventsConfiguration",
                "description": "Grants permission to update details for an events configuration for a bot to receive outgoing events",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutVoiceConnectorLoggingConfiguration",
                "description": "Grants permission to add logging configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "logs:CreateLogDelivery",
                            "logs:CreateLogGroup",
                            "logs:DeleteLogDelivery",
                            "logs:DescribeLogGroups",
                            "logs:GetLogDelivery",
                            "logs:ListLogDeliveries"
                        ]
                    }
                ]
            },
            {
                "privilege": "PutVoiceConnectorOrigination",
                "description": "Grants permission to update the origination settings for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutVoiceConnectorProxy",
                "description": "Grants permission to add proxy configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutVoiceConnectorStreamingConfiguration",
                "description": "Grants permission to add streaming configuration for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutVoiceConnectorTermination",
                "description": "Grants permission to update the termination settings for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutVoiceConnectorTerminationCredentials",
                "description": "Grants permission to add SIP termination credentials for the specified Amazon Chime Voice Connector",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegenerateSecurityToken",
                "description": "Grants permission to regenerate the security token for the specified bot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RenameAccount",
                "description": "Grants permission to modify the account name for your Amazon Chime Enterprise or Team account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RenewDelegate",
                "description": "Grants permission to renew the delegation request associated with an Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetAccountResource",
                "description": "Grants permission to reset the account resource in your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetPersonalPIN",
                "description": "Grants permission to reset the personal meeting PIN for the specified user on an Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestorePhoneNumber",
                "description": "Grants permission to restore the specified phone number from the deltion queue back to the phone number inventory",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetrieveDataExports",
                "description": "Grants permission to download the file containing links to all user attachments returned as part of the \"Request attachments\" action",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchAvailablePhoneNumbers",
                "description": "Grants permission to search phone numbers that can be ordered from the carrier",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDataExport",
                "description": "Grants permission to submit the \"Request attachments\" request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubmitSupportRequest",
                "description": "Grants permission to submit a customer service support request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SuspendUsers",
                "description": "Grants permission to suspend users from an Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagAttendee",
                "description": "Grants permission to apply the specified tags to the specified Amazon Chime SDK attendee",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagMeeting",
                "description": "Grants permission to apply the specified tags to the specified Amazon Chime SDK meeting.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to apply the specified tags to the specified Amazon Chime SDK meeting resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnauthorizeDirectory",
                "description": "Grants permission to unauthorize an Active Directory from your Amazon Chime Enterprise account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagAttendee",
                "description": "Grants permission to untag the specified tags from the specified Amazon Chime SDK attendee.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagMeeting",
                "description": "Grants permission to untag the specified tags from the specified Amazon Chime SDK meeting.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag the specified tags from the specified Amazon Chime SDK meeting resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccount",
                "description": "Grants permission to update account details for the specified Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccountOpenIdConfig",
                "description": "Grants permission to update the OpenIdConfig attributes for your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccountResource",
                "description": "Grants permission to update the account resource in your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccountSettings",
                "description": "Grants permission to update the settings for the specified Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBot",
                "description": "Grants permission to update the status of the specified bot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCDRSettings",
                "description": "Grants permission to update your Call Detail Record S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:CreateBucket",
                            "s3:DeleteBucket",
                            "s3:ListAllMyBuckets"
                        ]
                    }
                ]
            },
            {
                "privilege": "UpdateGlobalSettings",
                "description": "Grants permission to update the global settings related to Amazon Chime for the AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePhoneNumber",
                "description": "Grants permission to update phone number details for the specified phone number",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePhoneNumberSettings",
                "description": "Grants permission to update phone number settings related to Amazon Chime for the AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProxySession",
                "description": "Grants permission to update a proxy session for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoom",
                "description": "Grants permission to update a room",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoomMembership",
                "description": "Grants permission to update room membership role",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSupportedLicenses",
                "description": "Grants permission to update the supported license tiers available for users in your Amazon Chime account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Grants permission to update user details for a specified user ID",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserLicenses",
                "description": "Grants permission to update the licenses for your Amazon Chime users",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserSettings",
                "description": "Grants permission to update user settings related to the specified Amazon Chime user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVoiceConnector",
                "description": "Grants permission to update Amazon Chime Voice Connector details for the specified Amazon Chime Voice Connector",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVoiceConnectorGroup",
                "description": "Grants permission to update Amazon Chime Voice Connector Group details for the specified Amazon Chime Voice Connector Group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateAccountResource",
                "description": "Grants permission to validate the account resource in your Amazon Chime account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "meeting",
                "arn": "arn:${Partition}:chime::${AccountId}:meeting/${MeetingId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Cloud9",
        "prefix": "cloud9",
        "privileges": [
            {
                "privilege": "CreateEnvironmentEC2",
                "description": "Grants permission to create an AWS Cloud9 development environment, launches an Amazon Elastic Compute Cloud (Amazon EC2) instance, and then hosts the environment on the instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloud9:EnvironmentName",
                            "cloud9:InstanceType",
                            "cloud9:SubnetId",
                            "cloud9:UserArn"
                        ],
                        "dependent_actions": [
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs",
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateEnvironmentMembership",
                "description": "Grants permission to add an environment member to an AWS Cloud9 development environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloud9:UserArn",
                            "cloud9:EnvironmentId",
                            "cloud9:Permissions"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEnvironment",
                "description": "Grants permission to delete an AWS Cloud9 development environment. If the environment is hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance, also terminates the instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteEnvironmentMembership",
                "description": "Grants permission to delete an environment member from an AWS Cloud9 development environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironmentMemberships",
                "description": "Grants permission to get information about environment members for an AWS Cloud9 development environment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloud9:UserArn",
                            "cloud9:EnvironmentId"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironmentStatus",
                "description": "Grants permission to get status information for an AWS Cloud9 development environment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironments",
                "description": "Grants permission to get information about AWS Cloud9 development environments.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserSettings",
                "description": "Grants permission to get IDE-specific settings of an AWS Cloud9 user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEnvironments",
                "description": "Grants permission to get a list of AWS Cloud9 development environment identifiers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists tags for a cloud9 environment",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds tags to a cloud9 environment",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from a cloud9 environment",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEnvironment",
                "description": "Grants permission to change the settings of an existing AWS Cloud9 development environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEnvironmentMembership",
                "description": "Grants permission to change the settings of an existing environment member for an AWS Cloud9 development environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloud9:UserArn",
                            "cloud9:EnvironmentId",
                            "cloud9:Permissions"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserSettings",
                "description": "Grants permission to update IDE-specific settings of an AWS Cloud9 user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "environment",
                "arn": "arn:${Partition}:cloud9:${Region}:${Account}:environment:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "cloud9:EnvironmentId",
                "description": "Filters access by the AWS Cloud9 environment ID",
                "type": "String"
            },
            {
                "condition": "cloud9:EnvironmentName",
                "description": "Filters access by the AWS Cloud9 environment name",
                "type": "String"
            },
            {
                "condition": "cloud9:InstanceType",
                "description": "Filters access by the instance type of the AWS Cloud9 environment's Amazon EC2 instance",
                "type": "String"
            },
            {
                "condition": "cloud9:Permissions",
                "description": "Filters access by the type of AWS Cloud9 permissions",
                "type": "String"
            },
            {
                "condition": "cloud9:SubnetId",
                "description": "Filters access by the subnet ID that the AWS Cloud9 environment will be created in",
                "type": "String"
            },
            {
                "condition": "cloud9:UserArn",
                "description": "Filters access by the user ARN specified",
                "type": "ARN"
            }
        ]
    },
    {
        "service_name": "Amazon Cloud Directory",
        "prefix": "clouddirectory",
        "privileges": [
            {
                "privilege": "AddFacetToObject",
                "description": "Adds a new Facet to an object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApplySchema",
                "description": "Copies input published schema into Directory with same name and version as that of published schema.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachObject",
                "description": "Attaches an existing object to another existing object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachPolicy",
                "description": "Attaches a policy object to any other object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachToIndex",
                "description": "Attaches the specified object to the specified index.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachTypedLink",
                "description": "Attaches a typed link b/w a source & target object reference.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchRead",
                "description": "Performs all the read operations in a batch. Each individual operation inside BatchRead needs to be granted permissions explicitly.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchWrite",
                "description": "Performs all the write operations in a batch. Each individual operation inside BatchWrite needs to be granted permissions explicitly.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDirectory",
                "description": "Creates a Directory by copying the published schema into the directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFacet",
                "description": "Creates a new Facet in a schema.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIndex",
                "description": "Creates an index object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateObject",
                "description": "Creates an object in a Directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSchema",
                "description": "Creates a new schema in a development state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTypedLinkFacet",
                "description": "Creates a new Typed Link facet in a schema.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDirectory",
                "description": "Deletes a directory. Only disabled directories can be deleted.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFacet",
                "description": "Deletes a given Facet. All attributes and Rules associated with the facet will be deleted.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteObject",
                "description": "Deletes an object and its associated attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSchema",
                "description": "Deletes a given schema.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTypedLinkFacet",
                "description": "Deletes a given TypedLink Facet. All attributes and Rules associated with the facet will be deleted.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachFromIndex",
                "description": "Detaches the specified object from the specified index.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachObject",
                "description": "Detaches a given object from the parent object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachPolicy",
                "description": "Detaches a policy from an object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachTypedLink",
                "description": "Detaches a given typed link b/w given source and target object reference.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableDirectory",
                "description": "Disables the specified directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableDirectory",
                "description": "Enables the specified directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDirectory",
                "description": "Retrieves metadata about a directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFacet",
                "description": "Gets details of the Facet, such as Facet Name, Attributes, Rules, or ObjectType.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLinkAttributes",
                "description": "Retrieves attributes that are associated with a typed link.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectAttributes",
                "description": "Retrieves attributes within a facet that are associated with an object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectInformation",
                "description": "Retrieves metadata about an object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSchemaAsJson",
                "description": "Retrieves a JSON representation of the schema.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTypedLinkFacetInformation",
                "description": "Returns identity attributes order information associated with a given typed link facet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAppliedSchemaArns",
                "description": "Lists schemas applied to a directory.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttachedIndices",
                "description": "Lists indices attached to an object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevelopmentSchemaArns",
                "description": "Retrieves the ARNs of schemas in the development state.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDirectories",
                "description": "Lists directories created within an account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFacetAttributes",
                "description": "Retrieves attributes attached to the facet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFacetNames",
                "description": "Retrieves the names of facets that exist in a schema.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIncomingTypedLinks",
                "description": "Returns a paginated list of all incoming TypedLinks for a given object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIndex",
                "description": "Lists objects attached to the specified index.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListObjectAttributes",
                "description": "Lists all attributes associated with an object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListObjectChildren",
                "description": "Returns a paginated list of child objects associated with a given object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListObjectParentPaths",
                "description": "Retrieves all available parent paths for any object type such as node, leaf node, policy node, and index node objects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListObjectParents",
                "description": "Lists parent objects associated with a given object in pagination fashion.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListObjectPolicies",
                "description": "Returns policies attached to an object in pagination fashion.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOutgoingTypedLinks",
                "description": "Returns a paginated list of all outgoing TypedLinks for a given object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicyAttachments",
                "description": "Returns all of the ObjectIdentifiers to which a given policy is attached.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPublishedSchemaArns",
                "description": "Retrieves published schema ARNs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Returns tags for a resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTypedLinkFacetAttributes",
                "description": "Returns a paginated list of attributes associated with typed link facet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTypedLinkFacetNames",
                "description": "Returns a paginated list of typed link facet names that exist in a schema.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LookupPolicy",
                "description": "Lists all policies from the root of the Directory to the object specified.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PublishSchema",
                "description": "Publishes a development schema with a version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSchemaFromJson",
                "description": "Allows a schema to be updated using JSON upload. Only available for development schemas.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveFacetFromObject",
                "description": "Removes the specified facet from the specified object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds tags to a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFacet",
                "description": "Adds/Updates/Deletes existing Attributes, Rules, or ObjectType of a Facet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "appliedSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLinkAttributes",
                "description": "Updates a given typed link\u2019s attributes. Attributes to be updated must not contribute to the typed link\u2019s identity, as defined by its IdentityAttributeOrder.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateObjectAttributes",
                "description": "Updates a given object's attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSchema",
                "description": "Updates the schema name with a new name.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTypedLinkFacet",
                "description": "Adds/Updates/Deletes existing Attributes, Rules, identity attribute order of a TypedLink Facet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "developmentSchema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "appliedSchema",
                "arn": "arn:${Partition}:clouddirectory:${Region}:${Account}:directory/${DirectoryId}/schema/${SchemaName}/${Version}",
                "condition_keys": []
            },
            {
                "resource": "developmentSchema",
                "arn": "arn:${Partition}:clouddirectory:${Region}:${Account}:schema/development/${SchemaName}",
                "condition_keys": []
            },
            {
                "resource": "directory",
                "arn": "arn:${Partition}:clouddirectory:${Region}:${Account}:directory/${DirectoryId}",
                "condition_keys": []
            },
            {
                "resource": "publishedSchema",
                "arn": "arn:${Partition}:clouddirectory:${Region}:${Account}:schema/published/${SchemaName}/${Version}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS CloudFormation",
        "prefix": "cloudformation",
        "privileges": [
            {
                "privilege": "CancelUpdateStack",
                "description": "Cancels an update on the specified stack.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ContinueUpdateRollback",
                "description": "For a specified stack that is in the UPDATE_ROLLBACK_FAILED state, continues rolling it back to the UPDATE_ROLLBACK_COMPLETE state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:RoleArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateChangeSet",
                "description": "Creates a list of changes for a stack.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:ChangeSetName",
                            "cloudformation:ResourceTypes",
                            "cloudformation:ImportResourceTypes",
                            "cloudformation:RoleArn",
                            "cloudformation:StackPolicyUrl",
                            "cloudformation:TemplateUrl",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStack",
                "description": "Creates a stack as specified in the template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:ResourceTypes",
                            "cloudformation:RoleArn",
                            "cloudformation:StackPolicyUrl",
                            "cloudformation:TemplateUrl",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStackInstances",
                "description": "Creates stack instances for the specified accounts, within the specified regions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStackSet",
                "description": "Creates a stackset as specified in the template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:RoleArn",
                            "cloudformation:TemplateUrl",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUploadBucket",
                "description": "",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteChangeSet",
                "description": "Deletes the specified change set. Deleting change sets ensures that no one executes the wrong change set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:ChangeSetName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStack",
                "description": "Deletes a specified stack.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:RoleArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStackInstances",
                "description": "Deletes stack instances for the specified accounts, in the specified regions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStackSet",
                "description": "Deletes a specified stackset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountLimits",
                "description": "Retrieves your account's AWS CloudFormation limits.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChangeSet",
                "description": "Returns the description for the specified change set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:ChangeSetName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackDriftDetectionStatus",
                "description": "Returns information about a stack drift detection operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackEvents",
                "description": "Returns all stack related events for a specified stack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackInstance",
                "description": "Returns the stack instance that's associated with the specified stack set, AWS account, and region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackResource",
                "description": "Returns a description of the specified resource in the specified stack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackResourceDrifts",
                "description": "Returns drift information for the resources that have been checked for drift in the specified stack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackResources",
                "description": "Returns AWS resource descriptions for running and deleted stacks.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackSet",
                "description": "Returns the description of the specified stack set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackSetOperation",
                "description": "Returns the description of the specified stack set operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStacks",
                "description": "Returns the description for the specified stack.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectStackDrift",
                "description": "Detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectStackResourceDrift",
                "description": "Returns information about whether a resource's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectStackSetDrift",
                "description": "Enables users to detect drift on a stack set and the stack instances that belong to that stack set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EstimateTemplateCost",
                "description": "Returns the estimated monthly cost of a template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecuteChangeSet",
                "description": "Updates a stack using the input information that was provided when the specified change set was created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:ChangeSetName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStackPolicy",
                "description": "Returns the stack policy for a specified stack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTemplate",
                "description": "Returns the template body for a specified stack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTemplateSummary",
                "description": "Returns information about a new or existing template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stackset",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChangeSets",
                "description": "Returns the ID and status of each active change set for a stack. For example, AWS CloudFormation lists change sets that are in the CREATE_IN_PROGRESS or CREATE_PENDING state.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListExports",
                "description": "Lists all exported output values in the account and region in which you call this action.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListImports",
                "description": "Lists all stacks that are importing an exported output value.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStackInstances",
                "description": "Returns summary information about stack instances that are associated with the specified stack set.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStackResources",
                "description": "Returns descriptions of all resources of the specified stack.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStackSetOperationResults",
                "description": "Returns summary information about the results of a stack set operation.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStackSetOperations",
                "description": "Returns summary information about operations performed on a stack set.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStackSets",
                "description": "Returns summary information about stack sets that are associated with the user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStacks",
                "description": "Returns the summary information for stacks whose status matches the specified StackStatusFilter.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetStackPolicy",
                "description": "Sets a stack policy for a specified stack.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:StackPolicyUrl"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SignalResource",
                "description": "Sends a signal to the specified resource with a success or failure status.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopStackSetOperation",
                "description": "Stops an in-progress operation on a stack set and its associated stack instances.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tagging cloudformation resources.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stackset",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untagging cloudformation resources.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stackset",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStack",
                "description": "Updates a stack as specified in the template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:ResourceTypes",
                            "cloudformation:RoleArn",
                            "cloudformation:StackPolicyUrl",
                            "cloudformation:TemplateUrl",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStackInstances",
                "description": "Updates the parameter values for stack instances for the specified accounts, within the specified regions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStackSet",
                "description": "Updates a stackset as specified in the template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stackset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudformation:RoleArn",
                            "cloudformation:TemplateUrl",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTerminationProtection",
                "description": "Updates termination protection for the specified stack.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateTemplate",
                "description": "Validates a specified template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "stack",
                "arn": "arn:${Partition}:cloudformation:${Region}:${Account}:stack/${StackName}/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "stackset",
                "arn": "arn:${Partition}:cloudformation:${Region}:${Account}:stackset/${StackSetName}:${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "changeset",
                "arn": "arn:${Partition}:cloudformation:${Region}:${Account}:changeSet/${ChangeSetName}:${Id}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            },
            {
                "condition": "cloudformation:ChangeSetName",
                "description": "An AWS CloudFormation change set name. Use to control which change sets IAM users can execute or delete.",
                "type": "String"
            },
            {
                "condition": "cloudformation:ImportResourceTypes",
                "description": "The template resource types, such as <code>AWS::EC2::Instance</code>. Use to control which resource types IAM users can work with when they want to import a resource into a stack.",
                "type": "String"
            },
            {
                "condition": "cloudformation:ResourceTypes",
                "description": "The template resource types, such as <code>AWS::EC2::Instance</code>. Use to control which resource types IAM users can work with when they create or update a stack.",
                "type": "String"
            },
            {
                "condition": "cloudformation:RoleArn",
                "description": "The ARN of an IAM service role. Use to control which service role IAM users can use to work with stacks or change sets.",
                "type": "ARN"
            },
            {
                "condition": "cloudformation:StackPolicyUrl",
                "description": "An Amazon S3 stack policy URL. Use to control which stack policies IAM users can associate with a stack during a create or update stack action.",
                "type": "String"
            },
            {
                "condition": "cloudformation:TemplateUrl",
                "description": "An Amazon S3 template URL. Use to control which templates IAM users can use when they create or update stacks.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon CloudFront",
        "prefix": "cloudfront",
        "privileges": [
            {
                "privilege": "CreateCloudFrontOriginAccessIdentity",
                "description": "This action creates a new CloudFront origin access identity (POST /2019-03-26/origin-access-identity/cloudfront).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "origin-access-identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDistribution",
                "description": "This action creates a new web distribution (POST /2019-03-26/distribution).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDistributionWithTags",
                "description": "This action creates a new web distribution with tags (POST /2019-03-26/distribution?WithTags).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFieldLevelEncryptionConfig",
                "description": "This action creates a new field-level encryption configuration. (POST /2019-03-26/field-level-encryption).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFieldLevelEncryptionProfile",
                "description": "This action creates a field-level encryption profile. (POST /2019-03-26/field-level-encryption-profile).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInvalidation",
                "description": "This action creates a new invalidation batch request (POST /2019-03-26/distribution/<DISTRIBUTION_ID>/invalidation).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePublicKey",
                "description": "This action adds a new public key to CloudFront. (POST /2019-03-26/public-key).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStreamingDistribution",
                "description": "This action creates a new RTMP distribution (POST /2019-03-26/streaming-distribution).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streaming-distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStreamingDistributionWithTags",
                "description": "This action creates a new RTMP distribution with tags (POST /2019-03-26/streaming-distribution?WithTags).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streaming-distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCloudFrontOriginAccessIdentity",
                "description": "This action deletes a CloudFront origin access identity (DELETE /2019-03-26/origin-access-identity/cloudfront/<OAI_ID>).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "origin-access-identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDistribution",
                "description": "This action deletes a web distribution (DELETE /2019-03-26/distribution/<DISTRIBUTION_ID>).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFieldLevelEncryptionConfig",
                "description": "This action deletes a field-level encryption configuration. (DELETE /2019-03-26/field-level-encryption/Id/<Id>).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFieldLevelEncryptionProfile",
                "description": "This action deletes a field-level encryption profile. (DELETE /2019-03-26/field-level-encryption-profile/<Id>).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePublicKey",
                "description": "This action deletes a public key from CloudFront. (DELETE /2019-03-26/public-key/<Id>).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStreamingDistribution",
                "description": "This action deletes an RTMP distribution (DELETE /2019-03-26/streaming-distribution/<DISTRIBUTION_ID>).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streaming-distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCloudFrontOriginAccessIdentity",
                "description": "Get the information about a CloudFront origin access identity (GET /2019-03-26/origin-access-identity/cloudfront/<OAI_ID>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "origin-access-identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCloudFrontOriginAccessIdentityConfig",
                "description": "Get the configuration information about a Cloudfront origin access identity (GET /2019-03-26/origin-access-identity/cloudfront/<OAI_ID>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "origin-access-identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDistribution",
                "description": "Get the information about a web distribution (GET /2019-03-26/distribution/<DISTRIBUTION_ID>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDistributionConfig",
                "description": "Get the configuration information about a distribution (GET /2019-03-26/distribution/<DISTRIBUTION_ID>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFieldLevelEncryption",
                "description": "Get the field-level encryption configuration information. (GET /2019-03-26/field-level-encryption/<Id>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFieldLevelEncryptionConfig",
                "description": "Get the field-level encryption configuration information (GET /2019-03-26/field-level-encryption/<Id>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFieldLevelEncryptionProfile",
                "description": "Get the field-level encryption configuration information (GET /2019-03-26/field-level-encryption/<Id>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFieldLevelEncryptionProfileConfig",
                "description": "Get the field-level encryption profile configuration information (GET /2019-03-26/field-level-encryption-profile/<Id>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInvalidation",
                "description": "Get the information about an invalidation (GET /2019-03-26/distribution/<DISTRIBUTION_ID>/invalidation/<INVALIDATION_ID>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPublicKey",
                "description": "Get the public key information (GET /2019-03-26/public-key/<Id>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPublicKeyConfig",
                "description": "Get the public key configuration information (GET /2019-03-26/public-key/<Id>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStreamingDistribution",
                "description": "Get the information about an RTMP distribution (GET /2019-03-26/streaming-distribution/<DISTRIBUTION_ID>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "streaming-distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStreamingDistributionConfig",
                "description": "Get the configuration information about a streaming distribution (GET /2019-03-26/streaming-distribution/<DISTRIBUTION_ID>/config).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "streaming-distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCloudFrontOriginAccessIdentities",
                "description": "List your CloudFront origin access identities (GET /2019-03-26/origin-access-identity/cloudfront?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDistributions",
                "description": "List the distributions associated with your AWS account (GET /2019-03-26/distribution?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDistributionsByLambdaFunction",
                "description": "List the distributions associated a Lambda function.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDistributionsByWebACLId",
                "description": "List the distributions associated with your AWS account with given AWS WAF web ACL (GET /2019-03-26/distributionsByWebACLId/<WEB_ACL_ID>?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFieldLevelEncryptionConfigs",
                "description": "List all field-level encryption configurations that have been created in CloudFront for this account (GET /2019-03-26/field-level-encryption?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFieldLevelEncryptionProfiles",
                "description": "List all field-level encryption profiles that have been created in CloudFront for this account. (GET /2019-03-26/field-level-encryption-profile?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInvalidations",
                "description": "List your invalidation batches (GET /2019-03-26/distribution/<DISTRIBUTION_ID>/invalidation?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPublicKeys",
                "description": "List all public keys that have been added to CloudFront for this account. (GET /2019-03-26/public-key?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreamingDistributions",
                "description": "List your RTMP distributions (GET /2019-03-26/streaming-distribution?Marker=<MARKER>&MaxItems=<MAX_ITEMS>).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags for a CloudFront resource (GET /2019-03-26/tagging?Resource=<RESOURCE>).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "distribution",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "streaming-distribution",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to a CloudFront resource (POST /2019-03-26/tagging?Operation=Tag?Resource=<RESOURCE>).",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "distribution",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "streaming-distribution",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove tags from a CloudFront resource (POST /2019-03-26/tagging?Operation=Untag?Resource=<RESOURCE>).",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "distribution",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "streaming-distribution",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCloudFrontOriginAccessIdentity",
                "description": "This action sets the configuration for a CloudFront origin access identity (PUT /2019-03-26/origin-access-identity/cloudfront/<OAI_ID>/config).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "origin-access-identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDistribution",
                "description": "This action updates the configuration for a web distribution (PUT /2019-03-26/distribution/<DISTRIBUTION_ID>/config).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFieldLevelEncryptionConfig",
                "description": "This action updates a field-level encryption configuration. (PUT /2019-03-26/field-level-encryption/<Id>/config).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFieldLevelEncryptionProfile",
                "description": "This action updates a field-level encryption profile. (PUT /2019-03-26/field-level-encryption-profile/<Id>/config).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePublicKey",
                "description": "This action updates public key information. (PUT /2019-03-26/public-key/<Id>/config).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStreamingDistribution",
                "description": "This action updates the configuration for an RTMP distribution (PUT /2019-03-26/streaming-distribution/<DISTRIBUTION_ID>/config).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streaming-distribution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "distribution",
                "arn": "arn:${Partition}:cloudfront::${Account}:distribution/${DistributionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "streaming-distribution",
                "arn": "arn:${Partition}:cloudfront::${Account}:streaming-distribution/${DistributionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "origin-access-identity",
                "arn": "arn:${Partition}:cloudfront::${Account}:origin-access-identity/${Id}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CloudHSM",
        "prefix": "cloudhsm",
        "privileges": [
            {
                "privilege": "AddTagsToResource",
                "description": "Adds or overwrites one or more tags for the specified AWS CloudHSM resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyBackupToRegion",
                "description": "Creates a copy of a backup in the specified region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCluster",
                "description": "Creates a new AWS CloudHSM cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHapg",
                "description": "Creates a high-availability partition group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHsm",
                "description": "Creates a new hardware security module (HSM) in the specified AWS CloudHSM cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLunaClient",
                "description": "Creates an HSM client",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackup",
                "description": "Deletes the specified CloudHSM backup",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCluster",
                "description": "Deletes the specified AWS CloudHSM cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHapg",
                "description": "Deletes a high-availability partition group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHsm",
                "description": "Deletes the specified HSM",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLunaClient",
                "description": "Deletes a client",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBackups",
                "description": "Gets information about backups of AWS CloudHSM clusters",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusters",
                "description": "Gets information about AWS CloudHSM clusters",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHapg",
                "description": "Retrieves information about a high-availability partition group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHsm",
                "description": "Retrieves information about an HSM. You can identify the HSM by its ARN or its serial number",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLunaClient",
                "description": "Retrieves information about an HSM client",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfig",
                "description": "Gets the configuration files necessary to connect to all high availability partition groups the client is associated with",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitializeCluster",
                "description": "Claims an AWS CloudHSM cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableZones",
                "description": "Lists the Availability Zones that have available AWS CloudHSM capacity",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHapgs",
                "description": "Lists the high-availability partition groups for the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHsms",
                "description": "Retrieves the identifiers of all of the HSMs provisioned for the current customer",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLunaClients",
                "description": "Lists all of the clients",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Gets a list of tags for the specified AWS CloudHSM cluster",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Returns a list of all tags for the specified AWS CloudHSM resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyHapg",
                "description": "Modifies an existing high-availability partition group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyHsm",
                "description": "Modifies an HSM",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyLunaClient",
                "description": "Modifies the certificate used by the client",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "Removes one or more tags from the specified AWS CloudHSM resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreBackup",
                "description": "Restores the specified CloudHSM backup",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds or overwrites one or more tags for the specified AWS CloudHSM cluster",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the specified tag or tags from the specified AWS CloudHSM cluster",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "backup",
                "arn": "arn:${Partition}:cloudhsm:${Region}:${Account}:backup/${CloudHsmBackupInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:cloudhsm:${Region}:${Account}:cluster/${CloudHsmClusterInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon CloudSearch",
        "prefix": "cloudsearch",
        "privileges": [
            {
                "privilege": "AddTags",
                "description": "Attaches resource tags to an Amazon CloudSearch domain.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BuildSuggesters",
                "description": "Indexes the search suggestions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDomain",
                "description": "Creates a new search domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DefineAnalysisScheme",
                "description": "Configures an analysis scheme that can be applied to a text or text-array field to define language-specific text processing options.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DefineExpression",
                "description": "Configures an Expression for the search domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DefineIndexField",
                "description": "Configures an IndexField for the search domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DefineSuggester",
                "description": "Configures a suggester for a domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAnalysisScheme",
                "description": "Deletes an analysis scheme.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomain",
                "description": "Permanently deletes a search domain and all of its data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteExpression",
                "description": "Removes an Expression from the search domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIndexField",
                "description": "Removes an IndexField from the search domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSuggester",
                "description": "Deletes a suggester.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAnalysisSchemes",
                "description": "Gets the analysis schemes configured for a domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAvailabilityOptions",
                "description": "Gets the availability options configured for a domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDomainEndpointOptions",
                "description": "Gets the domain endpoint options configured for a domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDomains",
                "description": "Gets information about the search domains owned by this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExpressions",
                "description": "Gets the expressions configured for the search domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIndexFields",
                "description": "Gets information about the index fields configured for the search domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingParameters",
                "description": "Gets the scaling parameters configured for a domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServiceAccessPolicies",
                "description": "Gets information about the access policies that control access to the domain's document and search endpoints.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSuggesters",
                "description": "Gets the suggesters configured for a domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IndexDocuments",
                "description": "Tells the search domain to start indexing its documents using the latest indexing options.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomainNames",
                "description": "Lists all search domains owned by an account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Displays all of the resource tags for an Amazon CloudSearch domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Removes the specified resource tags from an Amazon ES domain.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAvailabilityOptions",
                "description": "Configures the availability options for a domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainEndpointOptions",
                "description": "Configures the domain endpoint options for a domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateScalingParameters",
                "description": "Configures scaling parameters for a domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServiceAccessPolicies",
                "description": "Configures the access rules that control access to the domain's document and search endpoints.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "document",
                "description": "Allows access to the document service operations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "search",
                "description": "Allows access to the search operations.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "suggest",
                "description": "Allows access to the suggest operations.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "domain",
                "arn": "arn:${Partition}:cloudsearch:${Region}:${Account}:domain/${DomainName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS CloudTrail",
        "prefix": "cloudtrail",
        "privileges": [
            {
                "privilege": "AddTags",
                "description": "Grants permission to add one or more tags to a trail, up to a limit of 10",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrail",
                "description": "Grants permission to create a trail that specifies the settings for delivery of log data to an Amazon S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:PutObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteTrail",
                "description": "Grants permission to delete a trail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrails",
                "description": "Grants permission to list settings for the trails associated with the current region for your account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEventSelectors",
                "description": "Grants permission to list settings for event selectors configured for a trail",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInsightSelectors",
                "description": "Grants permission to list CloudTrail Insights selectors that are configured for a trail",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrail",
                "description": "Grants permission to list settings for the trail",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrailStatus",
                "description": "Grants permission to retrieve a JSON-formatted list of information about the specified trail",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPublicKeys",
                "description": "Grants permission to list the public keys whose private keys were used to sign trail digest files within a specified time range",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Grants permission to list the tags for trails in the current region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrails",
                "description": "Grants permission to list trails associated with the current region for your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LookupEvents",
                "description": "Grants permission to look up API activity events captured by CloudTrail that create, update, or delete resources in your account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEventSelectors",
                "description": "Grants permission to create and update event selectors for a trail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutInsightSelectors",
                "description": "Grants permission to create and update CloudTrail Insights selectors for a trail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Grants permission to remove tags from a trail",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartLogging",
                "description": "Grants permission to start the recording of AWS API calls and log file delivery for a trail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopLogging",
                "description": "Grants permission to stop the recording of AWS API calls and log file delivery for a trail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrail",
                "description": "Grants permission to update the settings that specify delivery of log files",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trail*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "trail",
                "arn": "arn:${Partition}:cloudtrail:${Region}:${Account}:trail/${TrailName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon CloudWatch",
        "prefix": "cloudwatch",
        "privileges": [
            {
                "privilege": "DeleteAlarms",
                "description": "Deletes all specified alarms. In the event of an error, no alarms are deleted",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAnomalyDetector",
                "description": "Deletes the specified anomaly detection model from your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDashboards",
                "description": "Deletes all CloudWatch dashboards that you specify",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInsightRules",
                "description": "Grants permission to delete a collection of insight rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "insight-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAlarmHistory",
                "description": "Retrieves history for the specified alarm",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAlarms",
                "description": "Retrieves alarms with the specified names",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAlarmsForMetric",
                "description": "Retrieves all alarms for a single metric",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAnomalyDetectors",
                "description": "Lists the anomaly detection models that you have created in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInsightRules",
                "description": "Grants permission to describe all insight rules, currently owned by the user's account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableAlarmActions",
                "description": "Disables actions for the specified alarms",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableInsightRules",
                "description": "Grants permission to disable a collection of insight rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "insight-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableAlarmActions",
                "description": "Enables actions for the specified alarms",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableInsightRules",
                "description": "Grants permission to enable a collection of insight rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "insight-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDashboard",
                "description": "Displays the details of the CloudWatch dashboard you specify",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInsightRuleReport",
                "description": "Grants permission to return the top-N report of unique contributors over a time range for a given insight rule.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "insight-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMetricData",
                "description": "Required to retrieve batch amounts of CloudWatch metric data and perform metric math on retrieved data",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMetricStatistics",
                "description": "Gets statistics for the specified metric",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMetricWidgetImage",
                "description": "Required to retrieve snapshots of metric widgets",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDashboards",
                "description": "Returns a list of all CloudWatch dashboards in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMetrics",
                "description": "Returns a list of valid metrics stored for the AWS account owner",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This action lists tags for an Amazon CloudWatch resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "alarm",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "insight-rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAnomalyDetector",
                "description": "Creates or updates an anomaly detection model for a CloudWatch metric.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDashboard",
                "description": "Creates a CloudWatch dashboard, or updates an existing dashboard if it already exists",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutInsightRule",
                "description": "Grants permission to create a new insight rule or replace an existing insight rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "insight-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMetricAlarm",
                "description": "Creates or updates an alarm and associates it with the specified Amazon CloudWatch metric",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMetricData",
                "description": "Publishes metric data points to Amazon CloudWatch",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cloudwatch:namespace"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetAlarmState",
                "description": "Temporarily sets the state of an alarm for testing purposes",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alarm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an Amazon CloudWatch resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "alarm",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "insight-rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from an Amazon CloudWatch resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "alarm",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "insight-rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "alarm",
                "arn": "arn:${Partition}:cloudwatch:${Region}:${Account}:alarm:${AlarmName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dashboard",
                "arn": "arn:${Partition}:cloudwatch::${Account}:dashboard/${DashboardName}",
                "condition_keys": []
            },
            {
                "resource": "insight-rule",
                "arn": "arn:${Partition}:cloudwatch:${Region}:${Account}:insight-rule/${InsightRuleName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            },
            {
                "condition": "cloudwatch:namespace",
                "description": "Filters actions based on the presence of optional namespace values",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CodeBuild",
        "prefix": "codebuild",
        "privileges": [
            {
                "privilege": "BatchDeleteBuilds",
                "description": "Deletes one or more builds.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetBuilds",
                "description": "Gets information about one or more builds.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetProjects",
                "description": "Gets information about one or more build projects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetReportGroups",
                "description": "Returns an array of ReportGroup objects that are specified by the input reportGroupArns parameter.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetReports",
                "description": "Returns an array of the Report objects specified by the input reportArns parameter.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchPutTestCases",
                "description": "Adds or updates information about a report.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Creates a build project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReport",
                "description": "Creates a report. A report is created when tests specified in the buildspec file for a report groups run during the build of a project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReportGroup",
                "description": "Creates a report group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWebhook",
                "description": "For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables AWS CodeBuild to start rebuilding the source code every time a code change is pushed to the repository.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOAuthToken",
                "description": "Deletes an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Deletes a build project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReport",
                "description": "Deletes a report.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReportGroup",
                "description": "Deletes a report group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourcePolicy",
                "description": "Deletes a resource policy for the associated project or report group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "report-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSourceCredentials",
                "description": "Deletes a set of GitHub, GitHub Enterprise, or Bitbucket source credentials.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWebhook",
                "description": "For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops AWS CodeBuild from rebuilding the source code every time a code change is pushed to the repository.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTestCases",
                "description": "Returns an array of TestCase objects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourcePolicy",
                "description": "Returns a resource policy for the specified project or report group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "report-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportSourceCredentials",
                "description": "Imports the source repository credentials for an AWS CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InvalidateProjectCache",
                "description": "Resets the cache for a project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBuilds",
                "description": "Gets a list of build IDs, with each build ID representing a single build.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBuildsForProject",
                "description": "Gets a list of build IDs for the specified build project, with each build ID representing a single build.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConnectedOAuthAccounts",
                "description": "Lists connected third-party OAuth providers. Only used in the AWS CodeBuild console.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCuratedEnvironmentImages",
                "description": "Gets information about Docker images that are managed by AWS CodeBuild.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "Gets a list of build project names, with each build project name representing a single build project.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReportGroups",
                "description": "Returns a list of report group ARNs. Each report group ARN represents one report group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReports",
                "description": "Returns a list of report ARNs. Each report ARN representing one report.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReportsForReportGroup",
                "description": "Returns a list of report ARNs that belong to the specified report group. Each report ARN represents one report.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRepositories",
                "description": "Lists source code repositories from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSharedProjects",
                "description": "Returns a list of project ARNs that have been shared with the requester. Each project ARN represents one project.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSharedReportGroups",
                "description": "Returns a list of report group ARNs that have been shared with the requester. Each report group ARN represents one report group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSourceCredentials",
                "description": "Returns a list of SourceCredentialsInfo objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PersistOAuthToken",
                "description": "Saves an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutResourcePolicy",
                "description": "Creates a resource policy for the associated project or report group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "report-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartBuild",
                "description": "Starts running a build.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopBuild",
                "description": "Attempts to stop running a build.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Changes the settings of an existing build project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateReport",
                "description": "Updates information about a report.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateReportGroup",
                "description": "Changes the settings of an existing report group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "report-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWebhook",
                "description": "Updates the webhook associated with an AWS CodeBuild build project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "build",
                "arn": "arn:${Partition}:codebuild:${Region}:${Account}:build/${BuildId}",
                "condition_keys": []
            },
            {
                "resource": "project",
                "arn": "arn:${Partition}:codebuild:${Region}:${Account}:project/${ProjectName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "report-group",
                "arn": "arn:${Partition}:codebuild:${Region}:${Account}:report-group/${ReportGroupName}",
                "condition_keys": []
            },
            {
                "resource": "report",
                "arn": "arn:${Partition}:codebuild:${Region}:${Account}:report/${ReportGroupName}:${ReportId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CodeCommit",
        "prefix": "codecommit",
        "privileges": [
            {
                "privilege": "AssociateApprovalRuleTemplateWithRepository",
                "description": "Grants permission to associate an approval rule template with a repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchAssociateApprovalRuleTemplateWithRepositories",
                "description": "Grants permission to associate an approval rule template with multiple repositories in a single operation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDescribeMergeConflicts",
                "description": "Grants permission to get information about multiple merge conflicts when attempting to merge two commits using either the three-way merge or the squash merge option",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDisassociateApprovalRuleTemplateFromRepositories",
                "description": "Grants permission to remove the association between an approval rule template and multiple repositories in a single operation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetCommits",
                "description": "Grants permission to get return information about one or more commits in an AWS CodeCommit repository.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetPullRequests",
                "description": "Grants permission to return information about one or more pull requests in an AWS CodeCommit repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetRepositories",
                "description": "Grants permission to get information about multiple repositories",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelUploadArchive",
                "description": "Grants permission to cancel the uploading of an archive to a pipeline in AWS CodePipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApprovalRuleTemplate",
                "description": "Grants permission to create an approval rule template that will automatically create approval rules in pull requests that match the conditions defined in the template; does not grant permission to create approval rules for individual pull requests",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBranch",
                "description": "Grants permission to create a branch in an AWS CodeCommit repository with this API; does not control Git create branch actions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCommit",
                "description": "Grants permission to add, copy, move or update single or multiple files in a branch in an AWS CodeCommit repository, and generate a commit for the changes in the specified branch.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePullRequest",
                "description": "Grants permission to create a pull request in the specified repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePullRequestApprovalRule",
                "description": "Grants permission to create an approval rule specific to an individual pull request; does not grant permission to create approval rule templates",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRepository",
                "description": "Grants permission to create an AWS CodeCommit repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUnreferencedMergeCommit",
                "description": "Grants permission to create an unreferenced commit that contains the result of merging two commits using either the three-way or the squash merge option; does not control Git merge actions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApprovalRuleTemplate",
                "description": "Grants permission to delete an approval rule template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBranch",
                "description": "Grants permission to delete a branch in an AWS CodeCommit repository with this API; does not control Git delete branch actions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCommentContent",
                "description": "Grants permission to delete the content of a comment made on a change, file, or commit in a repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFile",
                "description": "Grants permission to delete a specified file from a specified branch",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePullRequestApprovalRule",
                "description": "Grants permission to delete approval rule created for a pull request if the rule was not created by an approval rule template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRepository",
                "description": "Grants permission to delete an AWS CodeCommit repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMergeConflicts",
                "description": "Grants permission to get information about specific merge conflicts when attempting to merge two commits using either the three-way or the squash merge option",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePullRequestEvents",
                "description": "Grants permission to return information about one or more pull request events",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateApprovalRuleTemplateFromRepository",
                "description": "Grants permission to remove the association between an approval rule template and a repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EvaluatePullRequestApprovalRules",
                "description": "Grants permission to evaluate whether a pull request is mergable based on its current approval state and approval rule requirements",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApprovalRuleTemplate",
                "description": "Grants permission to return information about an approval rule template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBlob",
                "description": "Grants permission to view the encoded content of an individual file in an AWS CodeCommit repository from the AWS CodeCommit console",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBranch",
                "description": "Grants permission to get details about a branch in an AWS CodeCommit repository with this API; does not control Git branch actions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComment",
                "description": "Grants permission to get the content of a comment made on a change, file, or commit in a repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCommentsForComparedCommit",
                "description": "Grants permission to get information about comments made on the comparison between two commits",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCommentsForPullRequest",
                "description": "Grants permission to get comments made on a pull request",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCommit",
                "description": "Grants permission to return information about a commit, including commit message and committer information, with this API; does not control Git log actions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCommitHistory",
                "description": "Grants permission to get information about the history of commits in a repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCommitsFromMergeBase",
                "description": "Grants permission to get information about the difference between commits in the context of a potential merge",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDifferences",
                "description": "Grants permission to view information about the differences between valid commit specifiers such as a branch, tag, HEAD, commit ID, or other fully qualified reference",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFile",
                "description": "Grants permission to return the base-64 encoded contents of a specified file and its metadata",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFolder",
                "description": "Grants permission to return the contents of a specified folder in a repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMergeCommit",
                "description": "Grants permission to get information about a merge commit created by one of the merge options for pull requests that creates merge commits. Not all merge options create merge commits. This permission does not control Git merge actions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMergeConflicts",
                "description": "Grants permission to get information about merge conflicts between the before and after commit IDs for a pull request in a repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMergeOptions",
                "description": "Grants permission to get information about merge options for pull requests that can be used to merge two commits; does not control Git merge actions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectIdentifier",
                "description": "Grants permission to resolve blobs, trees, and commits to their identifier",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPullRequest",
                "description": "Grants permission to get information about a pull request in a specified repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPullRequestApprovalStates",
                "description": "Grants permission to retrieve the current approvals on an inputted pull request",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPullRequestOverrideState",
                "description": "Grants permission to retrieve the current override state of a given pull request",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReferences",
                "description": "Grants permission to get details about references in an AWS CodeCommit repository; does not control Git reference actions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRepository",
                "description": "Grants permission to get information about an AWS CodeCommit repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRepositoryTriggers",
                "description": "Grants permission to get information about triggers configured for a repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTree",
                "description": "Grants permission to view the contents of a specified tree in an AWS CodeCommit repository from the AWS CodeCommit console",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUploadArchiveStatus",
                "description": "Grants permission to get status information about an archive upload to a pipeline in AWS CodePipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GitPull",
                "description": "Grants permission to pull information from an AWS CodeCommit repository to a local repo",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GitPush",
                "description": "Grants permission to push information from a local repo to an AWS CodeCommit repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApprovalRuleTemplates",
                "description": "Grants permission to list all approval rule templates in an AWS Region for the AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociatedApprovalRuleTemplatesForRepository",
                "description": "Grants permission to list approval rule templates that are associated with a repository",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBranches",
                "description": "Grants permission to list branches for an AWS CodeCommit repository with this API; does not control Git branch actions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPullRequests",
                "description": "Grants permission to list pull requests for a specified repository",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRepositories",
                "description": "Grants permission to list information about AWS CodeCommit repositories in the current Region for your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRepositoriesForApprovalRuleTemplate",
                "description": "Grants permission to list repositories that are associated with an approval rule template",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the resource attached to a CodeCommit resource ARN",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "repository",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergeBranchesByFastForward",
                "description": "Grants permission to merge two commits into the specified destination branch using the fast-forward merge option",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergeBranchesBySquash",
                "description": "Grants permission to merge two commits into the specified destination branch using the squash merge option",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergeBranchesByThreeWay",
                "description": "Grants permission to merge two commits into the specified destination branch using the three-way merge option",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergePullRequestByFastForward",
                "description": "Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the fast-forward merge option",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergePullRequestBySquash",
                "description": "Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the squash merge option",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergePullRequestByThreeWay",
                "description": "Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the three-way merge option",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OverridePullRequestApprovalRules",
                "description": "Grants permission to override all approval rules for a pull request, including approval rules created by a template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PostCommentForComparedCommit",
                "description": "Grants permission to post a comment on the comparison between two commits",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PostCommentForPullRequest",
                "description": "Grants permission to post a comment on a pull request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PostCommentReply",
                "description": "Grants permission to post a comment in reply to a comment on a comparison between commits or a pull request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutFile",
                "description": "Grants permission to add or update a file in a branch in an AWS CodeCommit repository, and generate a commit for the addition in the specified branch",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "codecommit:References"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRepositoryTriggers",
                "description": "Grants permission to create, update, or delete triggers for a repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to attach resource tags to a CodeCommit resource ARN",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "repository",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestRepositoryTriggers",
                "description": "Grants permission to test the functionality of repository triggers by sending information to the trigger target",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to disassociate resource tags from a CodeCommit resource ARN",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "repository",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApprovalRuleTemplateContent",
                "description": "Grants permission to update the content of approval rule templates; does not grant permission to update content of approval rules created specifically for pull requests",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApprovalRuleTemplateDescription",
                "description": "Grants permission to update the description of approval rule templates",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApprovalRuleTemplateName",
                "description": "Grants permission to update the name of approval rule templates",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateComment",
                "description": "Grants permission to update the contents of a comment if the identity matches the identity used to create the comment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDefaultBranch",
                "description": "Grants permission to change the default branch in an AWS CodeCommit repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePullRequestApprovalRuleContent",
                "description": "Grants permission to update the content for approval rules created for a specific pull requests; does not grant permission to update approval rule content for rules created with an approval rule template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePullRequestApprovalState",
                "description": "Grants permission to update the approval state for pull requests",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePullRequestDescription",
                "description": "Grants permission to update the description of a pull request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePullRequestStatus",
                "description": "Grants permission to update the status of a pull request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePullRequestTitle",
                "description": "Grants permission to update the title of a pull request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRepositoryDescription",
                "description": "Grants permission to change the description of an AWS CodeCommit repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRepositoryName",
                "description": "Grants permission to change the name of an AWS CodeCommit repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadArchive",
                "description": "Grants permission to the service role for AWS CodePipeline to upload repository changes into a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "repository",
                "arn": "arn:${Partition}:codecommit:${Region}:${Account}:${RepositoryName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "codecommit:References",
                "description": "Filters access by Git reference to specified AWS CodeCommit actions",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CodeDeploy",
        "prefix": "codedeploy",
        "privileges": [
            {
                "privilege": "AddTagsToOnPremisesInstances",
                "description": "Add tags to one or more on-premises instances.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetApplicationRevisions",
                "description": "Gets information about one or more application revisions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetApplications",
                "description": "Get information about multiple applications associated with the IAM user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetDeploymentGroups",
                "description": "Get information about one or more deployment groups.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetDeploymentInstances",
                "description": "Gets information about one or more instance that are part of a deployment group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetDeploymentTargets",
                "description": "Returns an array of one or more targets associated with a deployment. This method works with all compute types and should be used instead of the deprecated BatchGetDeploymentInstances. The maximum number of targets that can be returned is 25.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetDeployments",
                "description": "Get information about multiple deployments associated with the IAM user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetOnPremisesInstances",
                "description": "Get information about one or more on-premises instances.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ContinueDeployment",
                "description": "Starts the process of rerouting traffic from instances in the original environment to instances in thereplacement environment without waiting for a specified wait time to elapse.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplication",
                "description": "Create an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeployment",
                "description": "Create a deployment for an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeploymentConfig",
                "description": "Create a custom deployment configuration associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentconfig*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeploymentGroup",
                "description": "Create a deployment group for an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Delete an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDeploymentConfig",
                "description": "Delete a custom deployment configuration associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentconfig*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDeploymentGroup",
                "description": "Delete a deployment group for an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGitHubAccountToken",
                "description": "Deletes a GitHub account connection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterOnPremisesInstance",
                "description": "Deregister an on-premises instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplication",
                "description": "Get information about a single application associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplicationRevision",
                "description": "Get information about a single application revision for an application associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeployment",
                "description": "Get information about a single deployment to a deployment group for an application associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentConfig",
                "description": "Get information about a single deployment configuration associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentconfig*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentGroup",
                "description": "Get information about a single deployment group for an application associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentInstance",
                "description": "Get information about a single instance in a deployment associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentTarget",
                "description": "Returns information about a deployment target.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOnPremisesInstance",
                "description": "Get information about a single on-premises instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplicationRevisions",
                "description": "Get information about all application revisions for an application associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "Get information about all applications associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeploymentConfigs",
                "description": "Get information about all deployment configurations associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeploymentGroups",
                "description": "Get information about all deployment groups for an application associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeploymentInstances",
                "description": "Get information about all instances in a deployment associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeploymentTargets",
                "description": "Returns an array of target IDs that are associated a deployment.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeployments",
                "description": "Get information about all deployments to a deployment group associated with the IAM user, or to get all deployments associated with the IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGitHubAccountTokenNames",
                "description": "Lists the names of stored connections to GitHub accounts.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOnPremisesInstances",
                "description": "Get a list of one or more on-premises instance names.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Returns a list of tags for the resource identified by a specified ARN. Tags are used to organize and categorize your CodeDeploy resources.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentgroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLifecycleEventHookExecutionStatus",
                "description": "Notify a lifecycle event hook execution status for associated deployment with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterApplicationRevision",
                "description": "Register information about an application revision for an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterOnPremisesInstance",
                "description": "Register an on-premises instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromOnPremisesInstances",
                "description": "Remove tags from one or more on-premises instances.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SkipWaitTimeForInstanceTermination",
                "description": "In a blue/green deployment, overrides any specified wait time and starts terminating instances immediately after the traffic routing is complete.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDeployment",
                "description": "Description for StopDeployment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Associates the list of tags in the input Tags parameter with the resource identified by the ResourceArn input parameter.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentgroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Disassociates a resource from a list of tags. The resource is identified by the ResourceArn input parameter. The tags are identfied by the list of keys in the TagKeys input parameter.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentgroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Description for UpdateApplication",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDeploymentGroup",
                "description": "Change information about a single deployment group for an application associated with the IAM user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "application",
                "arn": "arn:${Partition}:codedeploy:${Region}:${Account}:application:${ApplicationName}",
                "condition_keys": []
            },
            {
                "resource": "deploymentconfig",
                "arn": "arn:${Partition}:codedeploy:${Region}:${Account}:deploymentconfig:${DeploymentConfigurationName}",
                "condition_keys": []
            },
            {
                "resource": "deploymentgroup",
                "arn": "arn:${Partition}:codedeploy:${Region}:${Account}:deploymentgroup:${ApplicationName}/${DeploymentGroupName}",
                "condition_keys": []
            },
            {
                "resource": "instance",
                "arn": "arn:${Partition}:codedeploy:${Region}:${Account}:instance:${InstanceName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon CodeGuru",
        "prefix": "codeguru",
        "privileges": [
            {
                "privilege": "GetCodeGuruFreeTrialSummary",
                "description": "Gets free trial summary for the CodeGuru service which includes expiration date.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon CodeGuru Profiler",
        "prefix": "codeguru-profiler",
        "privileges": [
            {
                "privilege": "ConfigureAgent",
                "description": "Grants permission for an agent to register with the orchestration service and retrieve profiling configuration information",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProfilingGroup",
                "description": "Grants permission to create a profiling group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProfilingGroup",
                "description": "Grants permission to delete a profiling group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProfilingGroup",
                "description": "Grants permission to describe a profiling group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFindingsReport",
                "description": "Grants permission to get a recommendations report",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFindingsReportAccountSummary",
                "description": "Grants permission to get a summary of recent recommendations for each profiling group in the account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicy",
                "description": "Grants permission to get the resource policy associated with the specified Profiling Group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProfile",
                "description": "Grants permission to get aggregated profiles for a specific profiling group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFindingsReports",
                "description": "Grants permissions to list the available recommendations reports for a specific profiling group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProfileTimes",
                "description": "Grants permissions to list the start times of the available aggregated profiles for a specific profiling group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProfilingGroups",
                "description": "Grants permissions to list profiling groups in the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PostAgentProfile",
                "description": "Grants permissions to submit a profile collected by an agent belonging to a specific profiling group for aggregation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPermission",
                "description": "Grants permissions to update the list of principals allowed for an action group in the resource policy associated with the specified Profiling Group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemovePermission",
                "description": "Grants permission to remove the permission of specified Action Group from the resource policy associated with the specified Profiling Group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProfilingGroup",
                "description": "Grants permissions to update a specific profiling group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ProfilingGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "ProfilingGroup",
                "arn": "arn:${Partition}:codeguru-profiler:${Region}:${Account}:profilingGroup/${profilingGroupName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon CodeGuru Reviewer",
        "prefix": "codeguru-reviewer",
        "privileges": [
            {
                "privilege": "AssociateRepository",
                "description": "Grants permission to associates a repository with Amazon CodeGuru Reviewer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository",
                        "condition_keys": [],
                        "dependent_actions": [
                            "codecommit:ListRepositories",
                            "codecommit:TagResource",
                            "events:PutRule",
                            "events:PutTargets",
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateConnectionToken",
                "description": "Grants permission to perform webbased oauth handshake for 3rd party providers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRepositoryAssociation",
                "description": "Grants permission to describe a repository association.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateRepository",
                "description": "Grants permission to disassociate a repository with Amazon CodeGuru Reviewer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "association*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "codecommit:UntagResource",
                            "events:DeleteRule",
                            "events:RemoveTargets"
                        ]
                    }
                ]
            },
            {
                "privilege": "GetMetricsData",
                "description": "Grants permission to view pull request metrics in console.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRepositoryAssociations",
                "description": "Grants permission to list summary of repository associations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThirdPartyRepositories",
                "description": "Grants permission to list 3rd party providers repositories in console.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "association",
                "arn": "arn:${Partition}:codeguru-reviewer::${Account}:association:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "repository",
                "arn": "arn:${Partition}:codecommit:${Region}:${Account}:${RepositoryName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CodePipeline",
        "prefix": "codepipeline",
        "privileges": [
            {
                "privilege": "AcknowledgeJob",
                "description": "Grants permission to view information about a specified job and whether that job has been received by the job worker",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AcknowledgeThirdPartyJob",
                "description": "Grants permission to confirm that a job worker has received the specified job (partner actions only)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCustomActionType",
                "description": "Grants permission to create a custom action that you can use in the pipelines associated with your AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "actiontype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePipeline",
                "description": "Grants permission to create a uniquely named pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCustomActionType",
                "description": "Grants permission to delete a custom action",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "actiontype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePipeline",
                "description": "Grants permission to delete a specified pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWebhook",
                "description": "Grants permission to delete a specified webhook",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webhook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterWebhookWithThirdParty",
                "description": "Grants permission to remove the registration of a webhook with the third party specified in its configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webhook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableStageTransition",
                "description": "Grants permission to prevent revisions from transitioning to the next stage in a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stage*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableStageTransition",
                "description": "Grants permission to allow revisions to transition to the next stage in a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stage*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobDetails",
                "description": "Grants permission to view information about a job (custom actions only)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPipeline",
                "description": "Grants permission to retrieve information about a pipeline structure",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPipelineExecution",
                "description": "Grants permission to view information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPipelineState",
                "description": "Grants permission to view information about the current state of the stages and actions of a pipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetThirdPartyJobDetails",
                "description": "Grants permission to view the details of a job for a third-party action (partner actions only)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActionExecutions",
                "description": "Grants permission to list the action executions that have occurred in a pipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActionTypes",
                "description": "Grants permission to list a summary of all the action types available for pipelines in your account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "actiontype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPipelineExecutions",
                "description": "Grants permission to list a summary of the most recent executions for a pipeline",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPipelines",
                "description": "Grants permission to list a summary of all the pipelines associated with your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags for a CodePipeline resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "actiontype",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webhook",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebhooks",
                "description": "Grants permission to list all of the webhooks associated with your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "webhook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PollForJobs",
                "description": "Grants permission to view information about any jobs for CodePipeline to act on",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "actiontype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PollForThirdPartyJobs",
                "description": "Grants permission to determine whether there are any third-party jobs for a job worker to act on (partner actions only)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutActionRevision",
                "description": "Grants permission to edit actions in a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "action*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutApprovalResult",
                "description": "Grants permission to provide a response (Approved or Rejected) to a manual approval request in CodePipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "action*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutJobFailureResult",
                "description": "Grants permission to represent the failure of a job as returned to the pipeline by a job worker (custom actions only)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutJobSuccessResult",
                "description": "Grants permission to represent the success of a job as returned to the pipeline by a job worker (custom actions only)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutThirdPartyJobFailureResult",
                "description": "Grants permission to represent the failure of a third-party job as returned to the pipeline by a job worker (partner actions only)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutThirdPartyJobSuccessResult",
                "description": "Grants permission to represent the success of a third-party job as returned to the pipeline by a job worker (partner actions only)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutWebhook",
                "description": "Grants permission to create or update a webhook",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webhook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterWebhookWithThirdParty",
                "description": "Grants permission to register a webhook with the third party specified in its configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webhook*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetryStageExecution",
                "description": "Grants permission to resume the pipeline execution by retrying the last failed actions in a stage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stage*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartPipelineExecution",
                "description": "Grants permission to run the most recent revision through the pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopPipelineExecution",
                "description": "Grants permission to stop an in-progress pipeline execution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag a CodePipeline resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "actiontype",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webhook",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove a tag from a CodePipeline resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "actiontype",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webhook",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePipeline",
                "description": "Grants permission to update a pipeline with changes to the structure of the pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "action",
                "arn": "arn:${Partition}:codepipeline:${Region}:${Account}:${PipelineName}/${StageName}/${ActionName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "actiontype",
                "arn": "arn:${Partition}:codepipeline:${Region}:${Account}:actiontype:${Owner}/${Category}/${Provider}/${Version}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "pipeline",
                "arn": "arn:${Partition}:codepipeline:${Region}:${Account}:${PipelineName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "stage",
                "arn": "arn:${Partition}:codepipeline:${Region}:${Account}:${PipelineName}/${StageName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "webhook",
                "arn": "arn:${Partition}:codepipeline:${Region}:${Account}:webhook:${WebhookName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CodeStar",
        "prefix": "codestar",
        "privileges": [
            {
                "privilege": "AssociateTeamMember",
                "description": "Adds a user to the team for an AWS CodeStar project.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Creates a project with minimal structure, customer policies, and no resources.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserProfile",
                "description": "Creates a profile for a user that includes user preferences, display name, and email.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteExtendedAccess",
                "description": "Grants access to extended delete APIs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Deletes a project, including project resources. Does not delete users associated with the project, but does delete the IAM roles that allowed access to the project.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserProfile",
                "description": "Deletes a user profile in AWS CodeStar, including all personal preference data associated with that profile, such as display name and email address. It does not delete the history of that user, for example the history of commits made by that user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProject",
                "description": "Describes a project and its resources.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserProfile",
                "description": "Describes a user in AWS CodeStar and the user attributes across all projects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateTeamMember",
                "description": "Removes a user from a project. Removing a user from a project also removes the IAM policies from that user that allowed access to the project and its resources.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExtendedAccess",
                "description": "Grants access to extended read APIs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "Lists all projects in CodeStar associated with your AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResources",
                "description": "Lists all resources associated with a project in CodeStar.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForProject",
                "description": "Lists the tags associated with a project in CodeStar.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTeamMembers",
                "description": "Lists all team members associated with a project.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserProfiles",
                "description": "Lists user profiles in AWS CodeStar.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutExtendedAccess",
                "description": "Grants access to extended write APIs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagProject",
                "description": "Adds tags to a project in CodeStar.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagProject",
                "description": "Removes tags from a project in CodeStar.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Updates a project in CodeStar.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTeamMember",
                "description": "Updates team member attributes within a CodeStar project.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserProfile",
                "description": "Updates a profile for a user that includes user preferences, display name, and email.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "project",
                "arn": "arn:${Partition}:codestar:${Region}:${Account}:project/${ProjectId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "user",
                "arn": "arn:${Partition}:iam::${Account}:user/${aws:username}",
                "condition_keys": [
                    "iam:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            },
            {
                "condition": "iam:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS CodeStar Notifications",
        "prefix": "codestar-notifications",
        "privileges": [
            {
                "privilege": "CreateNotificationRule",
                "description": "Grants permission to create a notification rule for a resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "codestar-notifications:NotificationsForResource"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNotificationRule",
                "description": "Grants permission to delete a notification rule for a resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "codestar-notifications:NotificationsForResource"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTarget",
                "description": "Grants permission to delete a target for a notification rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNotificationRule",
                "description": "Grants permission to get information about a notification rule",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "codestar-notifications:NotificationsForResource"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEventTypes",
                "description": "Grants permission to list notifications event types",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNotificationRules",
                "description": "Grants permission to list notification rules in an AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags attached to a notification rule resource ARN",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTargets",
                "description": "Grants permission to list the notification rule targets for an AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Subscribe",
                "description": "Grants permission to create an association between a notification rule and an Amazon SNS topic",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "codestar-notifications:NotificationsForResource"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to attach resource tags to a notification rule resource ARN",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Unsubscribe",
                "description": "Grants permission to remove an association between a notification rule and an Amazon SNS topic",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "codestar-notifications:NotificationsForResource"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to disassociate resource tags from a notification rule resource ARN",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNotificationRule",
                "description": "Grants permission to change a notification rule for a resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notificationrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "codestar-notifications:NotificationsForResource"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "notificationrule",
                "arn": "arn:${Partition}:codestar-notifications:${Region}:${Account}:notificationrule/${NotificationRuleId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "codestar-notifications:NotificationsForResource",
                "description": "Filters access based on the ARN of the resource for which notifications are configured",
                "type": "ARN"
            }
        ]
    },
    {
        "service_name": "Amazon Cognito Identity",
        "prefix": "cognito-identity",
        "privileges": [
            {
                "privilege": "CreateIdentityPool",
                "description": "Creates a new identity pool.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIdentities",
                "description": "Deletes identities from an identity pool. You can specify a list of 1-60 identities that you want to delete.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIdentityPool",
                "description": "Deletes a user pool. Once a pool is deleted, users will not be able to authenticate with the pool.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentity",
                "description": "Returns metadata related to the given identity, including when the identity was created and any associated linked logins.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentityPool",
                "description": "Gets details about a particular identity pool, including the pool name, ID description, creation date, and current number of users.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCredentialsForIdentity",
                "description": "Returns credentials for the provided identity ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetId",
                "description": "Generates (or retrieves) a Cognito ID. Supplying multiple logins will create an implicit linked account.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityPoolRoles",
                "description": "Gets the roles for an identity pool.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOpenIdToken",
                "description": "Gets an OpenID token, using a known Cognito ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOpenIdTokenForDeveloperIdentity",
                "description": "Registers (or retrieves) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIdentities",
                "description": "Lists the identities in a pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIdentityPools",
                "description": "Lists all of the Cognito identity pools registered for your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the tags that are assigned to an Amazon Cognito identity pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "identitypool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LookupDeveloperIdentity",
                "description": "Retrieves the IdentityID associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifiers associated with an IdentityId for an existing identity.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergeDeveloperIdentities",
                "description": "Merges two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityPoolRoles",
                "description": "Sets the roles for an identity pool. These roles are used when making calls to GetCredentialsForIdentity action.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Assigns a set of tags to an Amazon Cognito identity pool.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "identitypool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnlinkDeveloperIdentity",
                "description": "Unlinks a DeveloperUserIdentifier from an existing identity.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnlinkIdentity",
                "description": "Unlinks a federated identity from an existing account.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the specified tags from an Amazon Cognito identity pool.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "identitypool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIdentityPool",
                "description": "Updates a user pool.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "identitypool",
                "arn": "arn:${Partition}:cognito-identity:${Region}:${Account}:identitypool/${IdentityPoolId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by a key that is present in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Cognito User Pools",
        "prefix": "cognito-idp",
        "privileges": [
            {
                "privilege": "AddCustomAttributes",
                "description": "Adds additional user attributes to the user pool schema.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminAddUserToGroup",
                "description": "Adds the specified user to the specified group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminConfirmSignUp",
                "description": "Confirms user registration as an admin without using a confirmation code. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminCreateUser",
                "description": "Creates a new user in the specified user pool and sends a welcome message via email or phone (SMS).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminDeleteUser",
                "description": "Deletes a user as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminDeleteUserAttributes",
                "description": "Deletes the user attributes in a user pool as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminDisableProviderForUser",
                "description": "Disables the user from signing in with the specified external (SAML or social) identity provider.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminDisableUser",
                "description": "Disables the specified user as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminEnableUser",
                "description": "Enables the specified user as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminForgetDevice",
                "description": "Forgets the device, as an administrator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminGetDevice",
                "description": "Gets the device, as an administrator.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminGetUser",
                "description": "Gets the specified user by user name in a user pool as an administrator. Works on any user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminInitiateAuth",
                "description": "Authenticates a user in a user pool as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminLinkProviderForUser",
                "description": "Links an existing user account in a user pool (DestinationUser) to an identity from an external identity provider (SourceUser) based on a specified attribute name and value from the external identity provider.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminListDevices",
                "description": "Lists devices, as an administrator.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminListGroupsForUser",
                "description": "Lists the groups that the user belongs to.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminListUserAuthEvents",
                "description": "Lists the authentication events for the user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminRemoveUserFromGroup",
                "description": "Removes the specified user from the specified group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminResetUserPassword",
                "description": "Resets the specified user's password in a user pool as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminRespondToAuthChallenge",
                "description": "Responds to an authentication challenge, as an administrator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminSetUserMFAPreference",
                "description": "Sets MFA preference for the user in the userpool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminSetUserPassword",
                "description": "Sets the specified user's password in a user pool as an administrator. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminSetUserSettings",
                "description": "Sets all the user settings for a specified user name. Works on any user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminUpdateAuthEventFeedback",
                "description": "Updates the feedback for the user authentication event",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminUpdateDeviceStatus",
                "description": "Updates the device status as an administrator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminUpdateUserAttributes",
                "description": "Updates the specified user's attributes, including developer attributes, as an administrator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdminUserGlobalSignOut",
                "description": "Signs out users from all devices, as an administrator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateSoftwareToken",
                "description": "Returns a unique generated shared secret key code for the user account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ChangePassword",
                "description": "Changes the password for a specified user in a user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmDevice",
                "description": "Confirms tracking of the device. This API call is the call that begins device tracking.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmForgotPassword",
                "description": "Allows a user to enter a confirmation code to reset a forgotten password.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmSignUp",
                "description": "Confirms registration of a user and handles the existing alias from a previous user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Creates a new group in the specified user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIdentityProvider",
                "description": "Creates an identity provider for a user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResourceServer",
                "description": "Creates a new OAuth2.0 resource server and defines custom scopes in it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserImportJob",
                "description": "Creates the user import job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserPool",
                "description": "Creates a new Amazon Cognito user pool and sets the password policy for the pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserPoolClient",
                "description": "Creates the user pool client.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserPoolDomain",
                "description": "Creates a new domain for a user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Deletes a group. Currently only groups with no members can be deleted.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIdentityProvider",
                "description": "Deletes an identity provider for a user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourceServer",
                "description": "Deletes a resource server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Allows a user to delete one's self.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserAttributes",
                "description": "Deletes the attributes for a user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserPool",
                "description": "Deletes the specified Amazon Cognito user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserPoolClient",
                "description": "Allows the developer to delete the user pool client.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserPoolDomain",
                "description": "Deletes a domain for a user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentityProvider",
                "description": "Gets information about a specific identity provider.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResourceServer",
                "description": "Describes a resource server.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRiskConfiguration",
                "description": "Describes the risk configuration setting for the userpool / userpool client",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserImportJob",
                "description": "Describes the user import job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserPool",
                "description": "Returns the configuration information and metadata of the specified user pool.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserPoolClient",
                "description": "Client method for returning the configuration information and metadata of the specified user pool client.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserPoolDomain",
                "description": "Gets information about a domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ForgetDevice",
                "description": "Forgets the specified device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ForgotPassword",
                "description": "Calling this API causes a message to be sent to the end user with a confirmation code that is required to change the user's password.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCSVHeader",
                "description": "Gets the header information for the .csv file to be used as input for the user import job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevice",
                "description": "Gets the device.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroup",
                "description": "Gets a group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityProviderByIdentifier",
                "description": "Gets the specified identity provider.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSigningCertificate",
                "description": "Returns the signing certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUICustomization",
                "description": "Gets the UI Customization information for a particular app client's app UI, if there is something set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUser",
                "description": "Gets the user attributes and metadata for a user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserAttributeVerificationCode",
                "description": "Gets the user attribute verification code for the specified attribute name.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserPoolMfaConfig",
                "description": "Gets the MFA configuration for the userpool",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GlobalSignOut",
                "description": "Signs out users from all devices.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateAuth",
                "description": "Initiates the authentication flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevices",
                "description": "Lists the devices.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Lists the groups associated with a user pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIdentityProviders",
                "description": "Lists information about all identity providers for a user pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceServers",
                "description": "Lists the resource servers for a user pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the tags that are assigned to an Amazon Cognito user pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserImportJobs",
                "description": "Lists the user import jobs..",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserPoolClients",
                "description": "Lists the clients that have been created for the specified user pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserPools",
                "description": "Lists the user pools associated with an AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Lists the users in the Amazon Cognito user pool.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsersInGroup",
                "description": "Lists the users in the specified group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResendConfirmationCode",
                "description": "Resends the confirmation (for confirmation of registration) to a specific user in the user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RespondToAuthChallenge",
                "description": "Responds to the authentication challenge.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetRiskConfiguration",
                "description": "sets the risk configuration setting for the userpool / userpool client",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetUICustomization",
                "description": "Sets the UI customization information for a user pool's built-in app UI.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetUserMFAPreference",
                "description": "Sets MFA preference for the user in the userpool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetUserPoolMfaConfig",
                "description": "Sets the MFA configuration for the userpool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetUserSettings",
                "description": "Sets the user settings like multi-factor authentication (MFA).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SignUp",
                "description": "Registers the user in the specified user pool and creates a user name, password, and user attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartUserImportJob",
                "description": "Starts the user import.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopUserImportJob",
                "description": "Stops the user import job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Assigns a set of tags to an Amazon Cognito user pool.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "userpool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the specified tags from an Amazon Cognito user pool.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "userpool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAuthEventFeedback",
                "description": "Updates the feedback for the user authentication event",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDeviceStatus",
                "description": "Updates the device status.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Updates the specified group with the specified attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIdentityProvider",
                "description": "Updates identity provider information for a user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResourceServer",
                "description": "Updates the name and scopes of resource server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserAttributes",
                "description": "Allows a user to update a specific attribute (one at a time).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserPool",
                "description": "Updates the specified user pool with the specified attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserPoolClient",
                "description": "Allows the developer to update the specified user pool client and password policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserPoolDomain",
                "description": "Updates the Secure Sockets Layer (SSL) certificate for the custom domain for your user pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "userpool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifySoftwareToken",
                "description": "Registers a user's entered TOTP code and mark the user's software token MFA status as verified if successful.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyUserAttribute",
                "description": "Verifies a user attribute using a one time verification code.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "userpool",
                "arn": "arn:${Partition}:cognito-idp:${Region}:${Account}:userpool/${UserPoolId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by a key that is present in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Cognito Sync",
        "prefix": "cognito-sync",
        "privileges": [
            {
                "privilege": "BulkPublish",
                "description": "Initiates a bulk publish of all existing datasets for an Identity Pool to the configured stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataset",
                "description": "Deletes the specific dataset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataset",
                "description": "Gets meta data about a dataset by identity and dataset name.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentityPoolUsage",
                "description": "Gets usage details (for example, data storage) about a particular identity pool.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentityUsage",
                "description": "Gets usage information for an identity, including number of datasets and data usage.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBulkPublishDetails",
                "description": "Get the status of the last BulkPublish operation for an identity pool.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCognitoEvents",
                "description": "Gets the events and the corresponding Lambda functions associated with an identity pool.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityPoolConfiguration",
                "description": "Gets the configuration settings of an identity pool.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasets",
                "description": "Lists datasets for an identity.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIdentityPoolUsage",
                "description": "Gets a list of identity pools registered with Cognito.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRecords",
                "description": "Gets paginated records, optionally changed after a particular sync count for a dataset and identity.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "QueryRecords",
                "description": "A permission that grants the ability to query records.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDevice",
                "description": "Registers a device to receive push sync notifications.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetCognitoEvents",
                "description": "Sets the AWS Lambda function for a given event type for an identity pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDatasetConfiguration",
                "description": "A permission that grants ability to configure datasets.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityPoolConfiguration",
                "description": "Sets the necessary configuration for push sync.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identitypool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubscribeToDataset",
                "description": "Subscribes to receive notifications when a dataset is modified by another device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnsubscribeFromDataset",
                "description": "Unsubscribes from receiving notifications when a dataset is modified by another device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRecords",
                "description": "Posts updates to records and adds and deletes records for a dataset and user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "dataset",
                "arn": "arn:${Partition}:cognito-sync:${Region}:${Account}:identitypool/${IdentityPoolId}/identity/${IdentityId}/dataset/${DatasetName}",
                "condition_keys": []
            },
            {
                "resource": "identity",
                "arn": "arn:${Partition}:cognito-sync:${Region}:${Account}:identitypool/${IdentityPoolId}/identity/${IdentityId}",
                "condition_keys": []
            },
            {
                "resource": "identitypool",
                "arn": "arn:${Partition}:cognito-sync:${Region}:${Account}:identitypool/${IdentityPoolId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Comprehend",
        "prefix": "comprehend",
        "privileges": [
            {
                "privilege": "BatchDetectDominantLanguage",
                "description": "Detects the language or languages present in the list of text documents.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDetectEntities",
                "description": "Detects the named entities (\"People\", \"Places\", \"Locations\", etc) within the given list of text documents.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDetectKeyPhrases",
                "description": "Detects the phrases in the list of text documents that are most indicative of the content.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDetectSentiment",
                "description": "Detects the sentiment of a text in the list of documents (Positive, Negative, Neutral, or Mixed).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDetectSyntax",
                "description": "Detects syntactic information (like Part of Speech, Tokens) in a list of text documents.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ClassifyDocument",
                "description": "Creates a new document classification request to analyze a single document in real-time, using a previously created and trained custom model and an endpoint.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document-classifier-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDocumentClassifier",
                "description": "Creates a new document classifier that you can use to categorize documents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEndpoint",
                "description": "Creates a model-specific endpoint for synchronous inference for a previously trained custom model",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document-classifier",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEntityRecognizer",
                "description": "Creates an entity recognizer using submitted files.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDocumentClassifier",
                "description": "Deletes a previously created document classifier.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document-classifier*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpoint",
                "description": "Deletes a model-specific endpoint for a previously-trained custom model. All endpoints must be deleted in order for the model to be deleted.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document-classifier-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEntityRecognizer",
                "description": "Deletes a submitted entity recognizer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "entity-recognizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDocumentClassificationJob",
                "description": "Gets the properties associated with a document classification job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDocumentClassifier",
                "description": "Gets the properties associated with a document classifier.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document-classifier*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDominantLanguageDetectionJob",
                "description": "Gets the properties associated with a dominant language detection job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpoint",
                "description": "Gets the properties associated with a specific endpoint. Use this operation to get the status of an endpoint.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document-classifier-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEntitiesDetectionJob",
                "description": "Gets the properties associated with an entities detection job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEntityRecognizer",
                "description": "Provides details about an entity recognizer including status, S3 buckets containing training data, recognizer metadata, metrics, and so on.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "entity-recognizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeKeyPhrasesDetectionJob",
                "description": "Gets the properties associated with a key phrases detection job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSentimentDetectionJob",
                "description": "Gets the properties associated with a sentiment detection job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTopicsDetectionJob",
                "description": "Gets the properties associated with a topic detection job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectDominantLanguage",
                "description": "Detects the language or languages present in the text.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectEntities",
                "description": "Detects the named entities (\"People\", \"Places\", \"Locations\", etc) within the given text document.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectKeyPhrases",
                "description": "Detects the phrases in the text that are most indicative of the content.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectSentiment",
                "description": "Detects the sentiment of a text in a document (Positive, Negative, Neutral, or Mixed).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectSyntax",
                "description": "Detects syntactic information (like Part of Speech, Tokens) in a text document.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDocumentClassificationJobs",
                "description": "Gets a list of the document classification jobs that you have submitted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDocumentClassifiers",
                "description": "Gets a list of the document classifiers that you have created.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDominantLanguageDetectionJobs",
                "description": "Gets a list of the dominant language detection jobs that you have submitted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEndpoints",
                "description": "Gets a list of all existing endpoints that you've created.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEntitiesDetectionJobs",
                "description": "Gets a list of the entity detection jobs that you have submitted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEntityRecognizers",
                "description": "Gets a list of the properties of all entity recognizers that you created, including recognizers currently in training.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListKeyPhrasesDetectionJobs",
                "description": "Get a list of key phrase detection jobs that you have submitted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSentimentDetectionJobs",
                "description": "Gets a list of sentiment detection jobs that you have submitted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists tags for a resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "document-classifier",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "document-classifier-endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "entity-recognizer",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTopicsDetectionJobs",
                "description": "Gets a list of the topic detection jobs that you have submitted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDocumentClassificationJob",
                "description": "Starts an asynchronous document classification job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document-classifier*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDominantLanguageDetectionJob",
                "description": "Starts an asynchronous dominant language detection job for a collection of documents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartEntitiesDetectionJob",
                "description": "Starts an asynchronous entity detection job for a collection of documents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartKeyPhrasesDetectionJob",
                "description": "Starts an asynchronous key phrase detection job for a collection of documents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSentimentDetectionJob",
                "description": "Starts an asynchronous sentiment detection job for a collection of documents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTopicsDetectionJob",
                "description": "Starts an asynchronous job to detect the most common topics in the collection of documents and the phrases associated with each topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDominantLanguageDetectionJob",
                "description": "Stops a dominant language detection job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopEntitiesDetectionJob",
                "description": "Stops an entity detection job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopKeyPhrasesDetectionJob",
                "description": "Stops a key phrase detection job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopSentimentDetectionJob",
                "description": "Stops a sentiment detection job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTrainingDocumentClassifier",
                "description": "Stop a previously created document classifier training job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document-classifier*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTrainingEntityRecognizer",
                "description": "Stop a previously created entity recognizer training job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "entity-recognizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags a resource with given key value pairs",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "document-classifier",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "document-classifier-endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "entity-recognizer",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untags a resource with given key",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "document-classifier",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "document-classifier-endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "entity-recognizer",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEndpoint",
                "description": "Updates information about the specified endpoint.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document-classifier-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "document-classifier",
                "arn": "arn:${Partition}:comprehend:${Region}:${Account}:document-classifier/${DocumentClassifierName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "entity-recognizer",
                "arn": "arn:${Partition}:comprehend:${Region}:${Account}:entity-recognizer/${EntityRecognizerName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "document-classifier-endpoint",
                "arn": "arn:${Partition}:comprehend:${Region}:${Account}:document-classifier-endpoint/${DocumentClassifierEndpointName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the mandatory tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on the tag value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Comprehend Medical",
        "prefix": "comprehendmedical",
        "privileges": [
            {
                "privilege": "DetectEntities",
                "description": "Inspects the specified text for the specified type of entities and returns information about them.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectPHI",
                "description": "Inspects the specified text for PHI entities and returns information about them.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Compute Optimizer",
        "prefix": "compute-optimizer",
        "privileges": [
            {
                "privilege": "GetAutoScalingGroupRecommendations",
                "description": "Grants permission to get recommendations for the provided autoscaling groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEC2InstanceRecommendations",
                "description": "Grants permission to get recommendations for the provided EC2 instances.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEC2RecommendationProjectedMetrics",
                "description": "Grants permission to get the recommendation projected metrics of the specified instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEnrollmentStatus",
                "description": "Grants permission to get the enrollment status for the specified account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecommendationSummaries",
                "description": "Grants permission to get the recommendation summaries for the specified account(s).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEnrollmentStatus",
                "description": "Grants permission to update the enrollment status.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Config",
        "prefix": "config",
        "privileges": [
            {
                "privilege": "BatchGetAggregateResourceConfig",
                "description": "Returns the current configuration items for resources that are present in your AWS Config aggregator",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetResourceConfig",
                "description": "Returns the current configuration for one or more requested resources",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAggregationAuthorization",
                "description": "Deletes the authorization granted to the specified configuration aggregator account in a specified region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "AggregationAuthorization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigRule",
                "description": "Deletes the specified AWS Config rule and all of its evaluation results",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationAggregator",
                "description": "Deletes the specified configuration aggregator and the aggregated data associated with the aggregator",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationRecorder",
                "description": "Deletes the configuration recorder",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConformancePack",
                "description": "Deletes the specified conformance pack and all the AWS Config rules and all evaluation results within that conformance pack.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDeliveryChannel",
                "description": "Deletes the delivery channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEvaluationResults",
                "description": "Deletes the evaluation results for the specified Config rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOrganizationConfigRule",
                "description": "Deletes the specified organization config rule and all of its evaluation results from all member accounts in that organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOrganizationConformancePack",
                "description": "Deletes the specified organization conformance pack and all of its evaluation results from all member accounts in that organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePendingAggregationRequest",
                "description": "Deletes pending authorization requests for a specified aggregator account in a specified region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRemediationConfiguration",
                "description": "Deletes the remediation configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RemediationConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRemediationExceptions",
                "description": "Deletes one or more remediation exceptions for specific resource keys for a specific AWS Config Rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRetentionConfiguration",
                "description": "Deletes the retention configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeliverConfigSnapshot",
                "description": "Schedules delivery of a configuration snapshot to the Amazon S3 bucket in the specified delivery channel",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAggregateComplianceByConfigRules",
                "description": "Returns a list of compliant and noncompliant rules with the number of resources for compliant and noncompliant rules",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAggregationAuthorizations",
                "description": "Returns a list of authorizations granted to various aggregator accounts and regions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComplianceByConfigRule",
                "description": "Indicates whether the specified AWS Config rules are compliant",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComplianceByResource",
                "description": "Indicates whether the specified AWS resources are compliant",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigRuleEvaluationStatus",
                "description": "Returns status information for each of your AWS managed Config rules",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigRules",
                "description": "Returns details about your AWS Config rules",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationAggregatorSourcesStatus",
                "description": "Returns status information for sources within an aggregator",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationAggregators",
                "description": "Returns the details of one or more configuration aggregators",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationRecorderStatus",
                "description": "Returns the current status of the specified configuration recorder",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationRecorders",
                "description": "Returns the name of one or more specified configuration recorders",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConformancePackCompliance",
                "description": "Returns compliance information for each rule in that conformance pack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConformancePackStatus",
                "description": "Provides one or more conformance packs deployment status.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConformancePacks",
                "description": "Returns a list of one or more conformance packs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDeliveryChannelStatus",
                "description": "Returns the current status of the specified delivery channel",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDeliveryChannels",
                "description": "Returns details about the specified delivery channel",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganizationConfigRuleStatuses",
                "description": "Provides organization config rule deployment status for an organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganizationConfigRules",
                "description": "Returns a list of organization config rules.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganizationConformancePackStatuses",
                "description": "Provides organization conformance pack deployment status for an organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganizationConformancePacks",
                "description": "Returns a list of organization conformance packs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePendingAggregationRequests",
                "description": "Returns a list of all pending aggregation requests",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRemediationConfigurations",
                "description": "Returns the details of one or more remediation configurations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "RemediationConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRemediationExceptions",
                "description": "Returns the details of one or more remediation exceptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRemediationExecutionStatus",
                "description": "Provides a detailed view of a Remediation Execution for a set of resources including state, timestamps and any error messages for steps that have failed",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "RemediationConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRetentionConfigurations",
                "description": "Returns the details of one or more retention configurations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAggregateComplianceDetailsByConfigRule",
                "description": "Returns the evaluation results for the specified AWS Config rule for a specific resource in a rule",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAggregateConfigRuleComplianceSummary",
                "description": "Returns the number of compliant and noncompliant rules for one or more accounts and regions in an aggregator",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAggregateDiscoveredResourceCounts",
                "description": "Returns the resource counts across accounts and regions that are present in your AWS Config aggregator",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAggregateResourceConfig",
                "description": "Returns configuration item that is aggregated for your specific resource in a specific source account and region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComplianceDetailsByConfigRule",
                "description": "Returns the evaluation results for the specified AWS Config rule",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComplianceDetailsByResource",
                "description": "Returns the evaluation results for the specified AWS resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComplianceSummaryByConfigRule",
                "description": "Returns the number of AWS Config rules that are compliant and noncompliant, up to a maximum of 25 for each",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComplianceSummaryByResourceType",
                "description": "Returns the number of resources that are compliant and the number that are noncompliant",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConformancePackComplianceDetails",
                "description": "Returns compliance details of a conformance pack for all AWS resources that are monitered by conformance pack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConformancePackComplianceSummary",
                "description": "Provides compliance summary for one or more conformance packs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDiscoveredResourceCounts",
                "description": "Returns the resource types, the number of each resource type, and the total number of resources that AWS Config is recording in this region for your AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOrganizationConfigRuleDetailedStatus",
                "description": "Returns detailed status for each member account within an organization for a given organization config rule.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOrganizationConformancePackDetailedStatus",
                "description": "Returns detailed status for each member account within an organization for a given organization conformance pack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceConfigHistory",
                "description": "Returns a list of configuration items for the specified resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAggregateDiscoveredResources",
                "description": "Accepts a resource type and returns a list of resource identifiers that are aggregated for a specific resource type across accounts and regions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDiscoveredResources",
                "description": "Accepts a resource type and returns a list of resource identifiers for the resources of that type",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List the tags for AWS Config resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "AggregationAuthorization",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConfigRule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConfigurationAggregator",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAggregationAuthorization",
                "description": "Authorizes the aggregator account and region to collect data from the source account and region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "AggregationAuthorization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigRule",
                "description": "Adds or updates an AWS Config rule for evaluating whether your AWS resources comply with your desired configurations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurationAggregator",
                "description": "Creates and updates the configuration aggregator with the selected source accounts and regions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ConfigurationAggregator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurationRecorder",
                "description": "Creates a new configuration recorder to record the selected resource configurations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConformancePack",
                "description": "Creates or updates a conformance pack.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDeliveryChannel",
                "description": "Creates a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEvaluations",
                "description": "Used by an AWS Lambda function to deliver evaluation results to AWS Config",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutOrganizationConfigRule",
                "description": "Adds or updates organization config rule for your entire organization evaluating whether your AWS resources comply with your desired configurations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutOrganizationConformancePack",
                "description": "Adds or updates organization conformance pack for your entire organization evaluating whether your AWS resources comply with your desired configurations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRemediationConfigurations",
                "description": "Adds or updates the remediation configuration with a specific AWS Config rule with the selected target or action",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RemediationConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRemediationExceptions",
                "description": "Adds or updates remediation exceptions for specific resources for a specific AWS Config rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRetentionConfiguration",
                "description": "Creates and updates the retention configuration with details about retention period (number of days) that AWS Config stores your historical information",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SelectResourceConfig",
                "description": "Accepts a structured query language (SQL) SELECT command, performs the corresponding search, and returns resource configurations matching the properties",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartConfigRulesEvaluation",
                "description": "Evaluates your resources against the specified Config rules",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ConfigRule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartConfigurationRecorder",
                "description": "Starts recording configurations of the AWS resources you have selected to record in your AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartRemediationExecution",
                "description": "Runs an on-demand remediation for the specified AWS Config rules against the last known remediation configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RemediationConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopConfigurationRecorder",
                "description": "Stops recording configurations of the AWS resources you have selected to record in your AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Associates the specified tags to a resource with the specified resourceArn",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "AggregationAuthorization",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConfigRule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConfigurationAggregator",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConformancePack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Deletes specified tags from a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "AggregationAuthorization",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConfigRule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConfigurationAggregator",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ConformancePack",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "AggregationAuthorization",
                "arn": "arn:${Partition}:config:${Region}:${Account}:aggregation-authorization/${AggregatorAccount}/${AggregatorRegion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "ConfigurationAggregator",
                "arn": "arn:${Partition}:config:${Region}:${Account}:config-aggregator/${AggregatorId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "ConfigRule",
                "arn": "arn:${Partition}:config:${Region}:${Account}:config-rule/${ConfigRuleId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "ConformancePack",
                "arn": "arn:${Partition}:config:${Region}:${Account}:conformance-pack/${ConformancePackName}/${ConformancePackId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "OrganizationConfigRule",
                "arn": "arn:${Partition}:config:${Region}:${Account}:organization-config-rule/${OrganizationConfigRuleId}",
                "condition_keys": []
            },
            {
                "resource": "OrganizationConformancePack",
                "arn": "arn:${Partition}:config:${Region}:${Account}:organization-conformance-pack/${OrganizationConformancePackId}",
                "condition_keys": []
            },
            {
                "resource": "RemediationConfiguration",
                "arn": "arn:${Partition}:config:${Region}:${Account}:remediation-configuration/${RemediationConfigurationId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Connect",
        "prefix": "connect",
        "privileges": [
            {
                "privilege": "CreateInstance",
                "description": "Grants permissions to create a new Amazon Connect instance. The associated required actions grant permissions to configure instance settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ds:CreateAlias",
                            "ds:DeleteDirectory",
                            "ds:DescribeDirectories",
                            "firehose:DescribeDeliveryStream",
                            "firehose:ListDeliveryStreams",
                            "iam:CreateServiceLinkedRole",
                            "kinesis:DescribeStream",
                            "kinesis:ListStreams",
                            "kms:CreateGrant",
                            "kms:DescribeKey",
                            "kms:ListAliases",
                            "kms:RetireGrant",
                            "s3:CreateBucket",
                            "s3:ListAllMyBuckets"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Grants permission to create a user for the specified Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "routing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hierarchy-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Grants permissions to delete a user in an Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstance",
                "description": "Grants permissions to view details of an Amazon Connect instance. This is required to create an instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "firehose:DescribeDeliveryStream",
                            "firehose:ListDeliveryStreams",
                            "kinesis:DescribeStream",
                            "kinesis:ListStreams",
                            "kms:DescribeKey",
                            "kms:ListAliases",
                            "s3:ListAllMyBuckets"
                        ]
                    }
                ]
            },
            {
                "privilege": "DescribeUser",
                "description": "Grants permissions to describe a user in an Amazon Connect instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserHierarchyGroup",
                "description": "Grants permissions to describe a hierarchy group for an Amazon Connect instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hierarchy-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserHierarchyStructure",
                "description": "Grants permissions to describe the hierarchy structure for an Amazon Connect instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DestroyInstance",
                "description": "Grants permissions to delete an Amazon Connect instance. When you remove an instance, the link to an existing AWS directory is also removed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContactAttributes",
                "description": "Grants permissions to retrieve the contact attributes for the specified contact.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCurrentMetricData",
                "description": "Grants permissions to retrieve current metric data for the queues in an Amazon Connect instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFederationToken",
                "description": "Allows federation into an instance when using SAML-based authentication for identity management.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFederationTokens",
                "description": "Grants permissions to federate in to an Amazon Connect instance (Log in as administrator functionality in the AWS console).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "connect:DescribeInstance",
                            "connect:ListInstances",
                            "ds:DescribeDirectories"
                        ]
                    }
                ]
            },
            {
                "privilege": "GetMetricData",
                "description": "Grants permissions to retrieve historical metric data for queues in an Amazon Connect instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListContactFlows",
                "description": "Grants permissions to list contact flow resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHoursOfOperations",
                "description": "Grants permissions to list hours of operation resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstances",
                "description": "Grants permissions to view the Amazon Connect instances associated with an AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPhoneNumbers",
                "description": "Grants permissions to list phone number resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQueues",
                "description": "Grants permissions to list queue resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoutingProfiles",
                "description": "Grants permissions to list routing profile resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSecurityProfiles",
                "description": "Grants permissions to list security profile resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permissions to list tags for an Amazon Connect resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserHierarchyGroups",
                "description": "Grants permissions to list the hierarchy group resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Grants permissions to list user resources in an Amazon Connect instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstance",
                "description": "Grants permissions to modify configuration settings for an existing Amazon Connect instance. The associated required actions grant permission modify the settings for the instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "firehose:DescribeDeliveryStream",
                            "firehose:ListDeliveryStreams",
                            "kinesis:DescribeStream",
                            "kinesis:ListStreams",
                            "kms:CreateGrant",
                            "kms:DescribeKey",
                            "kms:ListAliases",
                            "kms:RetireGrant",
                            "s3:CreateBucket",
                            "s3:ListAllMyBuckets"
                        ]
                    }
                ]
            },
            {
                "privilege": "StartChatContact",
                "description": "Grants permissions to initiate a chat using the Amazon Connect API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "contact-flow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartOutboundVoiceContact",
                "description": "Grants permissions to initiate outbound calls using the Amazon Connect API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopContact",
                "description": "Grants permissions to stop contacts that were initiated using the Amazon Connect API. If you use this operation on an active contact the contact ends, even if the agent is active on a call with a customer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permissions to tag an Amazon Connect resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permissions to untag an Amazon Connect resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateContactAttributes",
                "description": "Grants permissions to create or update the contact attributes associated with the specified contact.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserHierarchy",
                "description": "Grants permissions to update a hierarchy group for a user in an Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hierarchy-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserIdentityInfo",
                "description": "Grants permissions to update identity information for a user in an Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserPhoneConfig",
                "description": "Grants permissions to update phone configuration settings for a user in an Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserRoutingProfile",
                "description": "Grants permissions to update a routing profile for a user in an Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "routing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserSecurityProfiles",
                "description": "Grants permissions to update security profiles for a user in an Amazon Connect instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "instance",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}",
                "condition_keys": []
            },
            {
                "resource": "contact",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/contact/${ContactId}",
                "condition_keys": []
            },
            {
                "resource": "user",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/agent/${UserId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "routing-profile",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/routing-profile/${RoutingProfileId}",
                "condition_keys": []
            },
            {
                "resource": "security-profile",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/security-profile/${SecurityProfileId}",
                "condition_keys": []
            },
            {
                "resource": "hierarchy-group",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/agent-group/${HierarchyGroupId}",
                "condition_keys": []
            },
            {
                "resource": "queue",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/queue/${QueueId}",
                "condition_keys": []
            },
            {
                "resource": "contact-flow",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/contact-flow/${ContactFlowId}",
                "condition_keys": []
            },
            {
                "resource": "hours-of-operation",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/operating-hours/${HoursOfOperationId}",
                "condition_keys": []
            },
            {
                "resource": "phone-number",
                "arn": "arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/phone-numbers/${PhoneNumberId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Cost and Usage Report",
        "prefix": "cur",
        "privileges": [
            {
                "privilege": "DeleteReportDefinition",
                "description": "Delete Cost and Usage Report Definition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cur*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReportDefinitions",
                "description": "Get Cost and Usage Report Definitions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReportDefinition",
                "description": "Modify Cost and Usage Report Definition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cur*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutReportDefinition",
                "description": "Write Cost and Usage Report Definition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cur*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cur",
                "arn": "arn:${Partition}:cur:${Region}:${Account}:definition/${ReportName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Data Exchange",
        "prefix": "dataexchange",
        "privileges": [
            {
                "privilege": "CancelJob",
                "description": "Grants permissions to cancel a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAsset",
                "description": "Grants permission to create an asset (for example, in a Job).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataSet",
                "description": "Grants permission to create a data set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Grants permissions to create a job to import or export assets.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRevision",
                "description": "Grants permission to create a revision.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAsset",
                "description": "Grants permissions to delete an asset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "assets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataSet",
                "description": "Grants permissions to delete a data set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "data-sets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRevision",
                "description": "Grants permissions to delete a revision.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "revisions*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAsset",
                "description": "Grants permissions to get information about an asset and to export it (for example, in a Job).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "assets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataSet",
                "description": "Grants permission to get information about a data set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "data-sets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJob",
                "description": "Grants permissions to get information about a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRevision",
                "description": "Grants permission to get information about a revision.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "revisions*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDataSetRevisions",
                "description": "Grants permissions to list the revisions of a data set.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "revisions*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDataSets",
                "description": "Grants permission to list data sets for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "data-sets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Grants permissions to list jobs for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRevisionAssets",
                "description": "Grants permissions to get list the assets of a revision.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "assets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags that you associated with the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "data-sets",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "revisions",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartJob",
                "description": "Grants permissions to start a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "jobs*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add one or more tags to a specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "data-sets",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "revisions",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove one or more tags from a specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "data-sets",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "revisions",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAsset",
                "description": "Grants permissions to get update information about an asset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "assets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDataSet",
                "description": "Grants permissions to update information about a data set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "data-sets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRevision",
                "description": "Grants permissions to update information about a revision.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "revisions*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "jobs",
                "arn": "arn:${Partition}:dataexchange:${Region}:${Account}:jobs/${JobId}",
                "condition_keys": [
                    "dataexchange:JobType"
                ]
            },
            {
                "resource": "data-sets",
                "arn": "arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}",
                "condition_keys": []
            },
            {
                "resource": "revisions",
                "arn": "arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}/revisions/${RevisionId}",
                "condition_keys": []
            },
            {
                "resource": "assets",
                "arn": "arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}/revisions/${RevisionId}/assets/${AssetId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the mandatory tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on the tag value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            },
            {
                "condition": "dataexchange:JobType",
                "description": "Indicates that the action can only be performed on the specified job type.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Data Pipeline",
        "prefix": "datapipeline",
        "privileges": [
            {
                "privilege": "ActivatePipeline",
                "description": "Validates the specified pipeline and starts processing pipeline tasks. If the pipeline does not pass validation, activation fails.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag",
                            "datapipeline:workerGroup"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTags",
                "description": "Adds or modifies tags for the specified pipeline.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePipeline",
                "description": "Creates a new, empty pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeactivatePipeline",
                "description": "Deactivates the specified running pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag",
                            "datapipeline:workerGroup"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePipeline",
                "description": "Deletes a pipeline, its pipeline definition, and its run history.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeObjects",
                "description": "Gets the object definitions for a set of objects associated with the pipeline.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePipelines",
                "description": "Retrieves metadata about one or more pipelines.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EvaluateExpression",
                "description": "Task runners call EvaluateExpression to evaluate a string in the context of the specified object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountLimits",
                "description": "Description for GetAccountLimits",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPipelineDefinition",
                "description": "Gets the definition of the specified pipeline.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag",
                            "datapipeline:workerGroup"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPipelines",
                "description": "Lists the pipeline identifiers for all active pipelines that you have permission to access.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PollForTask",
                "description": "Task runners call PollForTask to receive a task to perform from AWS Data Pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:workerGroup"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccountLimits",
                "description": "Description for PutAccountLimits",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPipelineDefinition",
                "description": "Adds tasks, schedules, and preconditions to the specified pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag",
                            "datapipeline:workerGroup"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "QueryObjects",
                "description": "Queries the specified pipeline for the names of objects that match the specified set of conditions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Removes existing tags from the specified pipeline.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReportTaskProgress",
                "description": "Task runners call ReportTaskProgress when assigned a task to acknowledge that it has the task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReportTaskRunnerHeartbeat",
                "description": "Task runners call ReportTaskRunnerHeartbeat every 15 minutes to indicate that they are operational.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetStatus",
                "description": "Requests that the status of the specified physical or logical pipeline objects be updated in the specified pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetTaskStatus",
                "description": "Task runners call SetTaskStatus to notify AWS Data Pipeline that a task is completed and provide information about the final status.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidatePipelineDefinition",
                "description": "Validates the specified pipeline definition to ensure that it is well formed and can be run without error.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "datapipeline:PipelineCreator",
                            "datapipeline:Tag",
                            "datapipeline:workerGroup"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": [
            {
                "condition": "datapipeline:PipelineCreator",
                "description": "The IAM user that created the pipeline.",
                "type": "ARN"
            },
            {
                "condition": "datapipeline:Tag",
                "description": "A customer-specified key/value pair that can be attached to a resource.",
                "type": "ARN"
            },
            {
                "condition": "datapipeline:workerGroup",
                "description": "The name of a worker group for which a Task Runner retrieves work.",
                "type": "ARN"
            }
        ]
    },
    {
        "service_name": "DataSync",
        "prefix": "datasync",
        "privileges": [
            {
                "privilege": "CancelTaskExecution",
                "description": "Cancels execution of a sync task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "taskexecution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAgent",
                "description": "Activates an agent that you have deployed on your host.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLocationEfs",
                "description": "Creates an endpoint for an Amazon EFS file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLocationNfs",
                "description": "Creates an endpoint for a NFS file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLocationS3",
                "description": "Creates an endpoint for an Amazon S3 bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLocationSmb",
                "description": "Creates an endpoint for an SMB file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTask",
                "description": "Creates a sync task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAgent",
                "description": "Deletes an agent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "agent*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLocation",
                "description": "Deletes the configuration of a location used by AWS DataSync.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "location*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTask",
                "description": "Deletes a sync task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAgent",
                "description": "Returns metadata such as name, network interfaces, and the status (that is, whether the agent is running or not) about a sync agent.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "agent*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocationEfs",
                "description": "Returns metadata, such as the path information about an Amazon EFS sync location.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "location*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocationNfs",
                "description": "Returns metadata, such as the path information, about a NFS sync location.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "location*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocationS3",
                "description": "Returns metadata, such as bucket name, about an Amazon S3 bucket sync location.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "location*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocationSmb",
                "description": "Returns metadata, such as the path information, about an SMB sync location.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "location*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTask",
                "description": "Returns metadata about a sync task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTaskExecution",
                "description": "Returns detailed metadata about a sync task that is being executed.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "taskexecution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAgents",
                "description": "Returns a list of agents owned by an AWS account in a region specified in the request.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLocations",
                "description": "Returns a lists of source and destination sync locations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This operation lists the tags that have been added to the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "agent",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "location",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTaskExecutions",
                "description": "Returns a list of executed sync tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTasks",
                "description": "Returns a list of all the sync tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTaskExecution",
                "description": "Starts a specific invocation of a sync task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Applies a key-value pair to an AWS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "agent",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "location",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This operation removes one or more tags from the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "agent",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "location",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAgent",
                "description": "Updates the name of an agent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "agent*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTask",
                "description": "Updates the metadata associated with a sync task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "agent",
                "arn": "arn:${Partition}:datasync:${Region}:${AccountId}:agent/${AgentId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "location",
                "arn": "arn:${Partition}:datasync:${Region}:${AccountId}:location/${LocationId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "task",
                "arn": "arn:${Partition}:datasync:${Region}:${AccountId}:task/${TaskId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "taskexecution",
                "arn": "arn:${Partition}:datasync:${Region}:${AccountId}:task/${TaskId}/execution/${ExecutionId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon DynamoDB Accelerator (DAX)",
        "prefix": "dax",
        "privileges": [
            {
                "privilege": "BatchGetItem",
                "description": "The BatchGetItem action returns the attributes of one or more items from one or more tables.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchWriteItem",
                "description": "The BatchWriteItem action operation puts or deletes multiple items in one or more tables.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConditionCheckItem",
                "description": "The ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCluster",
                "description": "The CreateCluster action creates a DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "dax:CreateParameterGroup",
                            "dax:CreateSubnetGroup",
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSecurityGroups",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs",
                            "iam:GetRole",
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateParameterGroup",
                "description": "The CreateParameterGroup action creates collection of parameters that you apply to all of the nodes in a DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSubnetGroup",
                "description": "The CreateSubnetGroup action creates a new subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DecreaseReplicationFactor",
                "description": "The DecreaseReplicationFactor action removes one or more nodes from a DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCluster",
                "description": "The DeleteCluster action deletes a previously provisioned DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteItem",
                "description": "The DeleteItem action deletes a single item in a table by primary key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dax:EnclosingOperation"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteParameterGroup",
                "description": "The DeleteParameterGroup action deletes the specified parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSubnetGroup",
                "description": "The DeleteSubnetGroup action deletes a subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusters",
                "description": "The DescribeClusters action returns information about all provisioned DAX clusters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDefaultParameters",
                "description": "The DescribeDefaultParameters action returns the default system parameter information for DAX.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "The DescribeEvents action returns events related to DAX clusters and parameter groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeParameterGroups",
                "description": "The DescribeParameterGroups action returns a list of parameter group descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeParameters",
                "description": "The DescribeParameters action returns the detailed parameter list for a particular parameter group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSubnetGroups",
                "description": "The DescribeSubnetGroups action returns a list of subnet group descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetItem",
                "description": "The GetItem action returns a set of attributes for the item with the given primary key.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dax:EnclosingOperation"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IncreaseReplicationFactor",
                "description": "The IncreaseReplicationFactor action adds one or more nodes to a DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "The ListTags action returns a list all of the tags for a DAX cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutItem",
                "description": "The PutItem action creates a new item, or replaces an old item with a new item.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dax:EnclosingOperation"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Query",
                "description": "The Query action finds items based on primary key values. You can query any table or secondary index that has a composite primary key (a partition key and a sort key).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootNode",
                "description": "The RebootNode action reboots a single node of a DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Scan",
                "description": "The Scan action returns one or more items and item attributes by accessing every item in a table or a secondary index.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "The TagResource action associates a set of tags with a DAX resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "The UntagResource action removes the association of tags from a DAX resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCluster",
                "description": "The UpdateCluster action modifies the settings for a DAX cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateItem",
                "description": "The UpdateItem action edits an existing item's attributes, or adds a new item to the table if it does not already exist.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dax:EnclosingOperation"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateParameterGroup",
                "description": "The UpdateParameterGroup action modifies the parameters of a parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSubnetGroup",
                "description": "The UpdateSubnetGroup action modifies an existing subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "application",
                "arn": "arn:${Partition}:dax:${Region}:${Account}:cache/${ClusterName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "dax:EnclosingOperation",
                "description": "Used to block Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Database Query Metadata Service",
        "prefix": "dbqms",
        "privileges": [
            {
                "privilege": "CreateFavoriteQuery",
                "description": "Creates a new favorite query",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateQueryHistory",
                "description": "Add a query to the history",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFavoriteQueries",
                "description": "Delete saved queries",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteQueryHistory",
                "description": "Delete a historical query",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFavoriteQueries",
                "description": "List saved queries and associated metadata",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeQueryHistory",
                "description": "List history of queries that were run",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryString",
                "description": "Retrieve favorite or history query string by id",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFavoriteQuery",
                "description": "Update saved query and description",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateQueryHistory",
                "description": "Update the query history",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS DeepComposer",
        "prefix": "deepcomposer",
        "privileges": [
            {
                "privilege": "AssociateCoupon",
                "description": "Associates a DeepComposer coupon (or DSN) with the account associated with the sender of the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAudio",
                "description": "Creates an audio file by converting the midi composition into a wav or mp3 file.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "composition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateComposition",
                "description": "Creates a multi-track midi composition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateModel",
                "description": "Starts creating/training a generative-model that is able to perform inference against the user-provided piano-melody to create a multi-track midi composition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteComposition",
                "description": "Deletes the composition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "composition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteModel",
                "description": "Deletes the model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComposition",
                "description": "Returns information about the composition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "composition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetModel",
                "description": "Returns information about the model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSampleModel",
                "description": "Returns information about the sample/pre-trained DeepComposer model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCompositions",
                "description": "Returns a list of all the compositions owned by the sender of the request.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListModels",
                "description": "Returns a list of all the models owned by the sender of the request.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSampleModels",
                "description": "Returns a list of all the sample/pre-trained models provided by the DeepComposer service.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrainingTopics",
                "description": "Returns a list of all the training options or topic for creating/training a model.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateComposition",
                "description": "Modifies the mutable properties associated with a composition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "composition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateModel",
                "description": "Modifies the mutable properties associated with a model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "model",
                "arn": "arn:${Partition}:deepcomposer:${Region}:${Account}:model/${ModelId}",
                "condition_keys": []
            },
            {
                "resource": "composition",
                "arn": "arn:${Partition}:deepcomposer:${Region}:${Account}:composition/${CompositionId}",
                "condition_keys": []
            },
            {
                "resource": "audio",
                "arn": "arn:${Partition}:deepcomposer:${Region}:${Account}:audio/${AudioId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS DeepLens",
        "prefix": "deeplens",
        "privileges": [
            {
                "privilege": "AssociateServiceRoleToAccount",
                "description": "Associates the user's account with IAM roles controlling various permissions needed by AWS DeepLens for proper functionality.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetDevice",
                "description": "Retrieves a list of AWS DeepLens devices.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetModel",
                "description": "Retrieves a list of AWS DeepLens Models.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetProject",
                "description": "Retrieves a list of AWS DeepLens Projects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeviceCertificates",
                "description": "Creates a certificate package that is used to successfully authenticate and Register an AWS DeepLens device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateModel",
                "description": "Creates a new AWS DeepLens Model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Creates a new AWS DeepLens Project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteModel",
                "description": "Deletes an AWS DeepLens Model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Deletes an AWS DeepLens Project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeployProject",
                "description": "Deploys an AWS DeepLens project to a registered AWS DeepLens device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterDevice",
                "description": "Begins a device de-registration workflow for a registered AWS DeepLens device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssociatedResources",
                "description": "Retrieves the account level resources associated with the user's account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentStatus",
                "description": "Retrieves the the deployment status of a particular AWS DeepLens device, along with any associated metadata.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevice",
                "description": "Retrieves information about an AWS DeepLens device.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetModel",
                "description": "Retrieves an AWS DeepLens Model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProject",
                "description": "Retrieves an AWS DeepLens Project.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportProjectFromTemplate",
                "description": "Creates a new AWS DeepLens project from a sample project template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeployments",
                "description": "Retrieves a list of AWS DeepLens Deployment identifiers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevices",
                "description": "Retrieves a list of AWS DeepLens device identifiers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListModels",
                "description": "Retrieves a list of AWS DeepLens Model identifiers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "Retrieves a list of AWS DeepLens Project identifiers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDevice",
                "description": "Begins a device registration workflow for an AWS DeepLens device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveProject",
                "description": "Removes a deployed AWS DeepLens project from an AWS DeepLens device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Updates an existing AWS DeepLens Project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "device",
                "arn": "arn:${Partition}:deeplens:${Region}:${Account}:device/${DeviceName}",
                "condition_keys": []
            },
            {
                "resource": "project",
                "arn": "arn:${Partition}:deeplens:${Region}:${Account}:project/${ProjectName}",
                "condition_keys": []
            },
            {
                "resource": "model",
                "arn": "arn:${Partition}:deeplens:${Region}:${Account}:model/${ModelName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS DeepRacer",
        "prefix": "deepracer",
        "privileges": [
            {
                "privilege": "CloneReinforcementLearningModel",
                "description": "Grants permission to clone existing DeepRacer models",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "track*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccountResources",
                "description": "Grants permission to create resources needed by DeepRacer on behalf of the user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLeaderboardSubmission",
                "description": "Grants permission to submit DeepRacer models to be evaluated for leaderboards",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "leaderboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReinforcementLearningModel",
                "description": "Grants permission to create reinforcement learning models for DeepRacer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "track*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccountResources",
                "description": "Grants permission to delete resources created by DeepRacer on behalf of the user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteModel",
                "description": "Grants permission to delete DeepRacer models",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountResources",
                "description": "Grants permission to retrieve the resources created by DeepRacer on behalf of the user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAlias",
                "description": "Grants permission to retrieve the user's alias for submitting DeepRacer models to leaderboards",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEvaluation",
                "description": "Grants permission to retrieve information about existing DeepRacer models' evaluation jobs",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "evaluation_job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLatestUserSubmission",
                "description": "Grants permission to retrieve information about how the latest submitted DeepRacer model for a user performed on a leaderboard",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "leaderboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLeaderboard",
                "description": "Grants permission to retrieve information about leaderboards",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "leaderboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetModel",
                "description": "Grants permission to retrieve information about existing DeepRacer models",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRankedUserSubmission",
                "description": "Grants permission to retrieve information about the performance of a user's DeepRacer model that got placed on a leaderboard",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "leaderboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrack",
                "description": "Grants permission to retrieve information about DeepRacer tracks",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "track*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrainingJob",
                "description": "Grants permission to retrieve information about existing DeepRacer models' training job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "training_job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEvaluations",
                "description": "Grants permission to list DeepRacer models' evaluation jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLeaderboardSubmissions",
                "description": "Grants permission to list all the submissions of DeepRacer models of a user on a leaderboard",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "leaderboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLeaderboards",
                "description": "Grants permission to list all the available leaderboards",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListModels",
                "description": "Grants permission to list all existing DeepRacer models",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTracks",
                "description": "Grants permission to list all DeepRacer tracks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrainingJobs",
                "description": "Grants permission to list DeepRacer models' training jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetAlias",
                "description": "Grants permission to set the user's alias for submitting DeepRacer models to leaderboards",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartEvaluation",
                "description": "Grants permission to evaluate DeepRacer models in a simulated environment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "track*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopEvaluation",
                "description": "Grants permission to stop DeepRacer model evaluations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "evaluation_job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTrainingReinforcementLearningModel",
                "description": "Grants permission to stop training DeepRacer models",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "reinforcement_learning_model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestRewardFunction",
                "description": "Grants permission to test reward functions for correctness",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "reinforcement_learning_model",
                "arn": "arn:${Partition}:deepracer:${Region}:${Account}:model/reinforcement_learning/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "training_job",
                "arn": "arn:${Partition}:deepracer:${Region}:${Account}:training_job/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "evaluation_job",
                "arn": "arn:${Partition}:deepracer:${Region}:${Account}:evaluation_job/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "leaderboard_evaluation_job",
                "arn": "arn:${Partition}:deepracer:${Region}:${Account}:leaderboard_evaluation_job/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "track",
                "arn": "arn:${Partition}:deepracer:${Region}::track/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "leaderboard",
                "arn": "arn:${Partition}:deepracer:${Region}::leaderboard/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Detective",
        "prefix": "detective",
        "privileges": [
            {
                "privilege": "AcceptInvitation",
                "description": "Grants permission to accept an invitation to become a member of a behavior graph",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGraph",
                "description": "Grants permission to create a behavior graph and begin to aggregate security information",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMembers",
                "description": "Grants permission to request the membership of one or more accounts in a behavior graph managed by this account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGraph",
                "description": "Grants permission to delete a behavior graph and stop aggregating security information",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMembers",
                "description": "Grants permission to remove member accounts from a behavior graph managed by this account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateMembership",
                "description": "Grants permission to remove the association of this account with a behavior graph",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFreeTrialEligibility",
                "description": "Grants permission to retrieve a behavior graph's eligibility for a free trial period",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGraphIngestState",
                "description": "Grants permission to retrieve the data ingestion state of a behavior graph",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMembers",
                "description": "Grants permission to retrieve details on specified members of a behavior graph",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPricingInformation",
                "description": "Grants permission to retrieve information about Amazon Detective's pricing",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUsageInformation",
                "description": "Grants permission to list usage information of a behavior graph",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGraphs",
                "description": "Grants permission to list behavior graphs managed by this account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInvitations",
                "description": "Grants permission to retrieve details on the behavior graphs to which this account has been invited to join",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMembers",
                "description": "Grants permission to retrieve details on all members of a behavior graph",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectInvitation",
                "description": "Grants permission to reject an invitation to become a member of a behavior graph",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchGraph",
                "description": "Grants permission to search the data stored in a behavior graph",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Graph*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Graph",
                "arn": "arn:${Partition}:detective:${Region}:${Account}:graph:${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Device Farm",
        "prefix": "devicefarm",
        "privileges": [
            {
                "privilege": "CreateDevicePool",
                "description": "Grants permission to create a device pool within a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstanceProfile",
                "description": "Grants permission to create a device instance profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNetworkProfile",
                "description": "Grants permission to create a network profile within a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Grants permission to create a project for mobile testing",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRemoteAccessSession",
                "description": "Grants permission to start a remote access session to a device instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceinstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "upload",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTestGridProject",
                "description": "Grants permission to create a project for desktop testing",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTestGridUrl",
                "description": "Grants permission to generate a new pre-signed url used to access our test grid service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "testgrid-project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUpload",
                "description": "Grants permission to upload a new file or app within a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVPCEConfiguration",
                "description": "Grants permission to create an Amazon Virtual Private Cloud (VPC) endpoint configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDevicePool",
                "description": "Grants permission to delete a user-generated device pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "devicepool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInstanceProfile",
                "description": "Grants permission to delete a user-generated instance profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instanceprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNetworkProfile",
                "description": "Grants permission to delete a user-generated network profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "networkprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Grants permission to delete a mobile testing project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRemoteAccessSession",
                "description": "Grants permission to delete a completed remote access session and its results",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRun",
                "description": "Grants permission to delete a run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "run*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTestGridProject",
                "description": "Grants permission to delete a desktop testing project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "testgrid-project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUpload",
                "description": "Grants permission to delete a user-uploaded file",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "upload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVPCEConfiguration",
                "description": "Grants permission to delete an Amazon Virtual Private Cloud (VPC) endpoint configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpceconfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountSettings",
                "description": "Grants permission to retrieve the number of unmetered iOS and/or unmetered Android devices purchased by the account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevice",
                "description": "Grants permission to retrieve the information of a unique device type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeviceInstance",
                "description": "Grants permission to retireve the information of a device instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deviceinstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevicePool",
                "description": "Grants permission to retireve the information of a device pool",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "devicepool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevicePoolCompatibility",
                "description": "Grants permission to retrieve information about the compatibility of a test and/or app with a device pool",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "devicepool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "upload",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceProfile",
                "description": "Grants permission to retireve the information of an instance profile",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instanceprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJob",
                "description": "Grants permission to retireve the information of a job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNetworkProfile",
                "description": "Grants permission to retireve the information of a network profile",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "networkprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOfferingStatus",
                "description": "Grants permission to retrieve the current status and future status of all offerings purchased by an AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProject",
                "description": "Grants permission to retrieve information about a mobile testing project",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRemoteAccessSession",
                "description": "Grants permission to retireve the link to a currently running remote access session",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRun",
                "description": "Grants permission to retireve the information of a run",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "run*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSuite",
                "description": "Grants permission to retireve the information of a testing suite",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "suite*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTest",
                "description": "Grants permission to retireve the information of a test case",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "test*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTestGridProject",
                "description": "Grants permission to retrieve information about a desktop testing project",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "testgrid-project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTestGridSession",
                "description": "Grants permission to retireve the information of a test grid session",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "testgrid-project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-session",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUpload",
                "description": "Grants permission to retireve the information of an uploaded file",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "upload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVPCEConfiguration",
                "description": "Grants permission to retireve the information of an Amazon Virtual Private Cloud (VPC) endpoint configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vpceconfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InstallToRemoteAccessSession",
                "description": "Grants permission to install an application to a device in a remote access session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "upload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListArtifacts",
                "description": "Grants permission to list the artifacts in a project",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "run",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "suite",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "test",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeviceInstances",
                "description": "Grants permission to list the information of device instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevicePools",
                "description": "Grants permission to list the information of device pools",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevices",
                "description": "Grants permission to list the information of unique device types",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstanceProfiles",
                "description": "Grants permission to list the information of device instance profiles",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Grants permission to list the information of jobs within a run",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "run*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNetworkProfiles",
                "description": "Grants permission to list the information of network profiles within a project",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOfferingPromotions",
                "description": "Grants permission to list the offering promotions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOfferingTransactions",
                "description": "Grants permission to list all of the historical purchases, renewals, and system renewal transactions for an AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOfferings",
                "description": "Grants permission to list the products or offerings that the user can manage through the API",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "Grants permission to list the information of mobile testing projects for an AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRemoteAccessSessions",
                "description": "Grants permission to list the information of currently running remote access sessions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRuns",
                "description": "Grants permission to list the information of runs within a project",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSamples",
                "description": "Grants permission to list the information of samples within a project",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSuites",
                "description": "Grants permission to list the information of testing suites within a job",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags of a resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceinstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devicepool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instanceprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "networkprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "run",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "session",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-session",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpceconfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTestGridProjects",
                "description": "Grants permission to list the information of desktop testing projects for an AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTestGridSessionActions",
                "description": "Grants permission to list the session actions performed during a test grid session",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "testgrid-session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTestGridSessionArtifacts",
                "description": "Grants permission to list the artifacts generated by a test grid session",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "testgrid-session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTestGridSessions",
                "description": "Grants permission to list the sessions within a test grid project",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "testgrid-project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTests",
                "description": "Grants permission to list the information of tests within a testing suite",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "suite*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUniqueProblems",
                "description": "Grants permission to list the information of unique problems within a run",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "run*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUploads",
                "description": "Grants permission to list the information of uploads within a project",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVPCEConfigurations",
                "description": "Grants permission to list the information of Amazon Virtual Private Cloud (VPC) endpoint configurations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseOffering",
                "description": "Grants permission to purchase offerings for an AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RenewOffering",
                "description": "Grants permission to set the quantity of devices to renew for an offering",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ScheduleRun",
                "description": "Grants permission to schedule a run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devicepool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "upload",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopJob",
                "description": "Grants permission to terminate a running job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopRemoteAccessSession",
                "description": "Grants permission to terminate a running remote access session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopRun",
                "description": "Grants permission to terminate a running test run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "run*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceinstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devicepool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instanceprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "networkprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "run",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "session",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-session",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpceconfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceinstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devicepool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instanceprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "networkprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "run",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "session",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "testgrid-session",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpceconfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDeviceInstance",
                "description": "Grants permission to modify an existing device instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deviceinstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instanceprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDevicePool",
                "description": "Grants permission to modify an existing device pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "devicepool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInstanceProfile",
                "description": "Grants permission to modify an existing instance profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instanceprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNetworkProfile",
                "description": "Grants permission to modify an existing network profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "networkprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Grants permission to modify an existing mobile testing project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTestGridProject",
                "description": "Grants permission to modify an existing desktop testing project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "testgrid-project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUpload",
                "description": "Grants permission to modify an existing upload",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "upload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVPCEConfiguration",
                "description": "Grants permission to modify an existing Amazon Virtual Private Cloud (VPC) endpoint configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpceconfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "project",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:project:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "run",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:run:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "job",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:job:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "suite",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:suite:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "test",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:test:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "upload",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:upload:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "artifact",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:artifact:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "sample",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:sample:${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "networkprofile",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:networkprofile:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deviceinstance",
                "arn": "arn:${Partition}:devicefarm:${Region}::deviceinstance:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "session",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:session:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "devicepool",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:devicepool:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "device",
                "arn": "arn:${Partition}:devicefarm:${Region}::device:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "instanceprofile",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:instanceprofile:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "vpceconfiguration",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:vpceconfiguration:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "testgrid-project",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:testgrid-project:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "testgrid-session",
                "arn": "arn:${Partition}:devicefarm:${Region}:${Account}:testgrid-session:${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Direct Connect",
        "prefix": "directconnect",
        "privileges": [
            {
                "privilege": "AcceptDirectConnectGatewayAssociationProposal",
                "description": "Accepts a proposal request to attach a virtual private gateway to a Direct Connect gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocateConnectionOnInterconnect",
                "description": "Creates a hosted connection on an interconnect.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocateHostedConnection",
                "description": "Creates a new hosted connection between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocatePrivateVirtualInterface",
                "description": "Provisions a private virtual interface to be owned by a different customer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocatePublicVirtualInterface",
                "description": "Provisions a public virtual interface to be owned by a different customer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocateTransitVirtualInterface",
                "description": "Provisions a transit virtual interface to be owned by a different customer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateConnectionWithLag",
                "description": "Associates a connection with a LAG.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateHostedConnection",
                "description": "Associates a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateVirtualInterface",
                "description": "Associates a virtual interface with a specified link aggregation group (LAG) or connection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmConnection",
                "description": "Confirm the creation of a hosted connection on an interconnect.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmPrivateVirtualInterface",
                "description": "Accept ownership of a private virtual interface created by another customer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmPublicVirtualInterface",
                "description": "Accept ownership of a public virtual interface created by another customer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmTransitVirtualInterface",
                "description": "Accept ownership of a transit virtual interface created by another customer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBGPPeer",
                "description": "Creates a BGP peer on the specified virtual interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConnection",
                "description": "Creates a new connection between the customer network and a specific AWS Direct Connect location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDirectConnectGateway",
                "description": "Creates a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDirectConnectGatewayAssociation",
                "description": "Creates an association between a Direct Connect gateway and a virtual private gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDirectConnectGatewayAssociationProposal",
                "description": "Creates a proposal to associate the specified virtual private gateway with the specified Direct Connect gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInterconnect",
                "description": "Creates a new interconnect between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLag",
                "description": "Creates a link aggregation group (LAG) with the specified number of bundled physical connections between the customer network and a specific AWS Direct Connect location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePrivateVirtualInterface",
                "description": "Creates a new private virtual interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePublicVirtualInterface",
                "description": "Creates a new public virtual interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitVirtualInterface",
                "description": "Creates a new transit virtual interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBGPPeer",
                "description": "Deletes the specified BGP peer on the specified virtual interface with the specified customer address and ASN.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConnection",
                "description": "Deletes the connection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDirectConnectGateway",
                "description": "Deletes the specified Direct Connect gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDirectConnectGatewayAssociation",
                "description": "Deletes the association between the specified Direct Connect gateway and virtual private gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDirectConnectGatewayAssociationProposal",
                "description": "Deletes the association proposal request between the specified Direct Connect gateway and virtual private gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInterconnect",
                "description": "Deletes the specified interconnect.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLag",
                "description": "Deletes the specified link aggregation group (LAG).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxlag*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualInterface",
                "description": "Deletes a virtual interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConnectionLoa",
                "description": "Returns the LOA-CFA for a Connection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConnections",
                "description": "Displays all connections in this region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConnectionsOnInterconnect",
                "description": "Return a list of connections that have been provisioned on the given interconnect.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectConnectGatewayAssociationProposals",
                "description": "Describes one or more association proposals for connection between a virtual private gateway and a Direct Connect gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectConnectGatewayAssociations",
                "description": "Lists the associations between your Direct Connect gateways and virtual private gateways.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectConnectGatewayAttachments",
                "description": "Lists the attachments between your Direct Connect gateways and virtual interfaces.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectConnectGateways",
                "description": "Lists all your Direct Connect gateways or only the specified Direct Connect gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dx-gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHostedConnections",
                "description": "Lists the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInterconnectLoa",
                "description": "Returns the LOA-CFA for an Interconnect.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInterconnects",
                "description": "Returns a list of interconnects owned by the AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLags",
                "description": "Describes all your link aggregation groups (LAG) or the specified LAG.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoa",
                "description": "Gets the LOA-CFA for a connection, interconnect, or link aggregation group (LAG).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocations",
                "description": "Returns the list of AWS Direct Connect locations in the current AWS region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Describes the tags associated with the specified AWS Direct Connect resources.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxvif",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualGateways",
                "description": "Returns a list of virtual private gateways owned by the AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVirtualInterfaces",
                "description": "Displays all virtual interfaces for an AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxvif",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateConnectionFromLag",
                "description": "Disassociates a connection from a link aggregation group (LAG).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxcon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds the specified tags to the specified AWS Direct Connect resource. Each resource can have a maximum of 50 tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxvif",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes one or more tags from the specified AWS Direct Connect resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "dxcon",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxlag",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dxvif",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDirectConnectGatewayAssociation",
                "description": "Updates the specified attributes of the Direct Connect gateway association.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLag",
                "description": "Updates the attributes of the specified link aggregation group (LAG).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxlag*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVirtualInterfaceAttributes",
                "description": "Updates the specified attributes of the specified virtual private interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dxvif*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "dxcon",
                "arn": "arn:${Partition}:directconnect:${Region}:${Account}:dxcon/${ConnectionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dxlag",
                "arn": "arn:${Partition}:directconnect:${Region}:${Account}:dxlag/${LagId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dxvif",
                "arn": "arn:${Partition}:directconnect:${Region}:${Account}:dxvif/${VirtualInterfaceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dx-gateway",
                "arn": "arn:${Partition}:directconnect::${Account}:dx-gateway/${DirectConnectGatewayId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Application Discovery",
        "prefix": "discovery",
        "privileges": [
            {
                "privilege": "AssociateConfigurationItemsToApplication",
                "description": "Associates one or more configuration items with an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteImportData",
                "description": "Deletes one or more Migration Hub import tasks, each identified by their import ID. Each import task has a number of records, which can identify servers or applications.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplication",
                "description": "Creates an application with the given name and description.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Creates one or more tags for configuration items. Tags are metadata that help you categorize IT assets. This API accepts a list of multiple configuration items.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplications",
                "description": "Deletes a list of applications and their associations with configuration items.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Deletes the association between configuration items and one or more tags. This API accepts a list of multiple configuration items.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAgents",
                "description": "Lists agents or the Connector by ID or lists all agents/Connectors associated with your user account if you did not specify an ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurations",
                "description": "Retrieves attributes for a list of configuration item IDs. All of the supplied IDs must be for the same asset type (server, application, process, or connection). Output fields are specific to the asset type selected. For example, the output for a server configuration item includes a list of attributes about the server, such as host name, operating system, and number of network cards.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeContinuousExports",
                "description": "Lists exports as specified by ID. All continuous exports associated with your user account can be listed if you call DescribeContinuousExports as is without passing any parameters.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExportConfigurations",
                "description": "Retrieves the status of a given export process. You can retrieve status from a maximum of 100 processes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExportTasks",
                "description": "Retrieve status of one or more export tasks. You can retrieve the status of up to 100 export tasks.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImportTasks",
                "description": "Returns an array of import tasks for your account, including status information, times, IDs, the Amazon S3 Object URL for the import file, and more.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Retrieves a list of configuration items that are tagged with a specific tag. Or retrieves a list of all tags assigned to a specific configuration item.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateConfigurationItemsFromApplication",
                "description": "Disassociates one or more configuration items from an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportConfigurations",
                "description": "Exports all discovered configuration data to an Amazon S3 bucket or an application that enables you to view and evaluate the data. Data includes tags and tag associations, processes, connections, servers, and system performance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDiscoverySummary",
                "description": "Retrieves a short summary of discovered assets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurations",
                "description": "Retrieves a list of configuration items according to criteria you specify in a filter. The filter criteria identify relationship requirements.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServerNeighbors",
                "description": "Retrieves a list of servers which are one network hop away from a specified server.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartContinuousExport",
                "description": "Start the continuous flow of agent's discovered data into Amazon Athena.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDataCollectionByAgentIds",
                "description": "Instructs the specified agents or Connectors to start collecting data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartExportTask",
                "description": "Export the configuration data about discovered configuration items and relationships to an S3 bucket in a specified format.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartImportTask",
                "description": "Starts an import task. The Migration Hub import feature allows you to import details of your on-premises environment directly into AWS without having to use the Application Discovery Service (ADS) tools such as the Discovery Connector or Discovery Agent. This gives you the option to perform migration assessment and planning directly from your imported data including the ability to group your devices as applications and track their migration status.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopContinuousExport",
                "description": "Stop the continuous flow of agent's discovered data into Amazon Athena.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDataCollectionByAgentIds",
                "description": "Instructs the specified agents or Connectors to stop collecting data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Updates metadata about an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Data Lifecycle Manager",
        "prefix": "dlm",
        "privileges": [
            {
                "privilege": "CreateLifecyclePolicy",
                "description": "Create a data lifecycle policy to manage the scheduled creation and retention of Amazon EBS snapshots. You may have up to 100 policies.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLifecyclePolicy",
                "description": "Delete an existing data lifecycle policy. In addition, this action halts the creation and deletion of snapshots that the policy specified. Existing snapshots are not affected.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLifecyclePolicies",
                "description": "Returns a list of summary descriptions of data lifecycle policies.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLifecyclePolicy",
                "description": "Returns a complete description of a single data lifecycle policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags associated with a resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add or update tags of a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove associated with a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLifecyclePolicy",
                "description": "Updates an existing data lifecycle policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "policy",
                "arn": "arn:${Partition}:dlm:${Region}:${Account}:policy/${ResourceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Database Migration Service",
        "prefix": "dms",
        "privileges": [
            {
                "privilege": "AddTagsToResource",
                "description": "Adds metadata tags to a DMS resource, including replication instance, endpoint, security group, and migration task",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Certificate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "EventSubscription",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationInstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationSubnetGroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationTask",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "dms:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApplyPendingMaintenanceAction",
                "description": "Applies a pending maintenance action to a resource (for example, to a replication instance).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEndpoint",
                "description": "Creates an endpoint using the provided settings",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "dms:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEventSubscription",
                "description": "Creates an AWS DMS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "dms:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReplicationInstance",
                "description": "Creates the replication instance using the specified parameters",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "dms:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReplicationSubnetGroup",
                "description": "Creates a replication subnet group given a list of the subnet IDs in a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "dms:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReplicationTask",
                "description": "Creates a replication task using the specified parameters",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "dms:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCertificate",
                "description": "Deletes the specified certificate",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpoint",
                "description": "Deletes the specified endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventSubscription",
                "description": "Deletes an AWS DMS event subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "EventSubscription*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReplicationInstance",
                "description": "Deletes the specified replication instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReplicationSubnetGroup",
                "description": "Deletes a subnet group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationSubnetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReplicationTask",
                "description": "Deletes the specified replication task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAttributes",
                "description": "Lists all of the AWS DMS attributes for a customer account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificates",
                "description": "Provides a description of the certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConnections",
                "description": "Describes the status of the connections that have been made between the replication instance and an endpoint",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpointTypes",
                "description": "Returns information about the type of endpoints available",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpoints",
                "description": "Returns information about the endpoints for your account in the current region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventCategories",
                "description": "Lists categories for all event source types, or, if specified, for a specified source type.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventSubscriptions",
                "description": "Lists all the event subscriptions for a customer account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "Lists events for a given source identifier and source type.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrderableReplicationInstances",
                "description": "Returns information about the replication instance types that can be created in the specified region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRefreshSchemasStatus",
                "description": "Returns the status of the RefreshSchemas operation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReplicationInstanceTaskLogs",
                "description": "Returns information about the task logs for the specified task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReplicationInstances",
                "description": "Returns information about replication instances for your account in the current region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReplicationSubnetGroups",
                "description": "Returns information about the replication subnet groups",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReplicationTaskAssessmentResults",
                "description": "Returns the task assessment results from Amazon S3. This action always returns the latest results.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReplicationTasks",
                "description": "Returns information about replication tasks for your account in the current region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSchemas",
                "description": "Returns information about the schema for the specified endpoint",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTableStatistics",
                "description": "Returns table statistics on the database migration task, including table name, rows inserted, rows updated, and rows deleted",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportCertificate",
                "description": "Uploads the specified certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists all tags for an AWS DMS resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Certificate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "EventSubscription",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationInstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationSubnetGroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationTask",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyEndpoint",
                "description": "Modifies the specified endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Certificate",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyEventSubscription",
                "description": "Modifies an existing AWS DMS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReplicationInstance",
                "description": "Modifies the replication instance to apply new settings",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReplicationSubnetGroup",
                "description": "Modifies the settings for the specified replication subnet group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReplicationTask",
                "description": "Modifies the specified replication task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootReplicationInstance",
                "description": "Reboots a replication instance. Rebooting results in a momentary outage, until the replication instance becomes available again.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RefreshSchemas",
                "description": "Populates the schema for the specified endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReloadTables",
                "description": "Reloads the target database table with the source data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "Removes metadata tags from a DMS resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Certificate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "EventSubscription",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationInstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationSubnetGroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationTask",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartReplicationTask",
                "description": "Starts the replication task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartReplicationTaskAssessment",
                "description": "Starts the replication task assessment for unsupported data types in the source database.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopReplicationTask",
                "description": "Stops the replication task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ReplicationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestConnection",
                "description": "Tests the connection between the replication instance and the endpoint",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ReplicationInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "ReplicationInstance",
                "arn": "arn:${Partition}:dms:${Region}:${Account}:rep:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "dms:rep-tag/${TagKey}"
                ]
            },
            {
                "resource": "ReplicationTask",
                "arn": "arn:${Partition}:dms:${Region}:${Account}:task:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "dms:task-tag/${TagKey}"
                ]
            },
            {
                "resource": "Endpoint",
                "arn": "arn:${Partition}:dms:${Region}:${Account}:endpoint:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "dms:endpoint-tag/${TagKey}"
                ]
            },
            {
                "resource": "Certificate",
                "arn": "arn:${Partition}:dms:${Region}:${Account}:cert:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "dms:cert-tag/${TagKey}"
                ]
            },
            {
                "resource": "EventSubscription",
                "arn": "arn:${Partition}:dms:${Region}:${Account}:es:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "dms:es-tag/${TagKey}"
                ]
            },
            {
                "resource": "ReplicationSubnetGroup",
                "arn": "arn:${Partition}:dms:${Region}:${Account}:subgrp:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "dms:subgrp-tag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "dms:cert-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag keys in the request for Certificate",
                "type": "String"
            },
            {
                "condition": "dms:endpoint-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag keys in the request for Endpoint",
                "type": "String"
            },
            {
                "condition": "dms:es-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag keys in the request for EventSubscription",
                "type": "String"
            },
            {
                "condition": "dms:rep-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag keys in the request for ReplicationInstance",
                "type": "String"
            },
            {
                "condition": "dms:req-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "dms:subgrp-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag keys in the request for ReplicationSubnetGroup",
                "type": "String"
            },
            {
                "condition": "dms:task-tag/${TagKey}",
                "description": "Filters actions based on the presence of tag keys in the request for ReplicationTask",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Directory Service",
        "prefix": "ds",
        "privileges": [
            {
                "privilege": "AcceptSharedDirectory",
                "description": "Accepts a directory sharing request that was sent from the directory owner account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddIpRoutes",
                "description": "Adds a CIDR address block to correctly route traffic to and from your Microsoft AD on Amazon Web Services",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:AuthorizeSecurityGroupEgress",
                            "ec2:AuthorizeSecurityGroupIngress",
                            "ec2:DescribeSecurityGroups"
                        ]
                    }
                ]
            },
            {
                "privilege": "AddTagsToResource",
                "description": "Adds or overwrites one or more tags for the specified Amazon Directory Services directory.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateTags"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeApplication",
                "description": "Authorizes an application for your AWS Directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelSchemaExtension",
                "description": "Cancels an in-progress schema extension to a Microsoft AD directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CheckAlias",
                "description": "Verifies that the alias is available for use.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConnectDirectory",
                "description": "Creates an AD Connector to connect to an on-premises directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": [
                            "ec2:AuthorizeSecurityGroupEgress",
                            "ec2:AuthorizeSecurityGroupIngress",
                            "ec2:CreateNetworkInterface",
                            "ec2:CreateSecurityGroup",
                            "ec2:CreateTags",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateAlias",
                "description": "Creates an alias for a directory and assigns the alias to the directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateComputer",
                "description": "Creates a computer account in the specified directory, and joins the computer to the directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConditionalForwarder",
                "description": "Creates a conditional forwarder associated with your AWS directory.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDirectory",
                "description": "Creates a Simple AD directory.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": [
                            "ec2:AuthorizeSecurityGroupEgress",
                            "ec2:AuthorizeSecurityGroupIngress",
                            "ec2:CreateNetworkInterface",
                            "ec2:CreateSecurityGroup",
                            "ec2:CreateTags",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateIdentityPoolDirectory",
                "description": "Creates a IdentityPool Directory in the AWS cloud.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLogSubscription",
                "description": "Creates a subscription to forward real time Directory Service domain controller security logs to the specified CloudWatch log group in your AWS account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMicrosoftAD",
                "description": "Creates a Microsoft AD in the AWS cloud.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": [
                            "ec2:AuthorizeSecurityGroupEgress",
                            "ec2:AuthorizeSecurityGroupIngress",
                            "ec2:CreateNetworkInterface",
                            "ec2:CreateSecurityGroup",
                            "ec2:CreateTags",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateSnapshot",
                "description": "Creates a snapshot of a Simple AD or Microsoft AD directory in the AWS cloud.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrust",
                "description": "Initiates the creation of the AWS side of a trust relationship between a Microsoft AD in the AWS cloud and an external domain.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConditionalForwarder",
                "description": "Deletes a conditional forwarder that has been set up for your AWS directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDirectory",
                "description": "Deletes an AWS Directory Service directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:DeleteNetworkInterface",
                            "ec2:DeleteSecurityGroup",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:RevokeSecurityGroupEgress",
                            "ec2:RevokeSecurityGroupIngress"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteLogSubscription",
                "description": "Deletes the specified log subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSnapshot",
                "description": "Deletes a directory snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrust",
                "description": "Deletes an existing trust relationship between your Microsoft AD in the AWS cloud and an external domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterCertificate",
                "description": "Deletes from the system the certificate that was registered for a secured LDAP connection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterEventTopic",
                "description": "Removes the specified directory as a publisher to the specified SNS topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificate",
                "description": "Displays information about the certificate registered for a secured LDAP connection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConditionalForwarders",
                "description": "Obtains information about the conditional forwarders for this account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectories",
                "description": "Obtains information about the directories that belong to this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDomainControllers",
                "description": "Provides information about any domain controllers in your directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventTopics",
                "description": "Obtains information about which SNS topics receive status messages from the specified directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLDAPSSettings",
                "description": "Describes the status of LDAP security for the specified directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSharedDirectories",
                "description": "Returns the shared directories in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshots",
                "description": "Obtains information about the directory snapshots that belong to this account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrusts",
                "description": "Obtains information about the trust relationships for this account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableLDAPS",
                "description": "Deactivates LDAP secure calls for the specified directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableRadius",
                "description": "Disables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableSso",
                "description": "Disables single-sign on for a directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableLDAPS",
                "description": "Activates the switch for the specific directory to always use LDAP secure calls.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableRadius",
                "description": "Enables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableSso",
                "description": "Enables single-sign on for a directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAuthorizedApplicationDetails",
                "description": "",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDirectoryLimits",
                "description": "Obtains directory limit information for the current region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSnapshotLimits",
                "description": "Obtains the manual snapshot limits for a directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAuthorizedApplications",
                "description": "Obtains the aws applications authorized for a directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCertificates",
                "description": "For the specified directory, lists all the certificates registered for a secured LDAP connection.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIpRoutes",
                "description": "Lists the address blocks that you have added to a directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLogSubscriptions",
                "description": "Lists the active log subscriptions for the AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSchemaExtensions",
                "description": "Lists all schema extensions applied to a Microsoft AD Directory.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists all tags on an Amazon Directory Services directory.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterCertificate",
                "description": "Registers a certificate for secured LDAP connection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterEventTopic",
                "description": "Associates a directory with an SNS topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sns:GetTopicAttributes"
                        ]
                    }
                ]
            },
            {
                "privilege": "RejectSharedDirectory",
                "description": "Rejects a directory sharing request that was sent from the directory owner account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveIpRoutes",
                "description": "Removes IP address blocks from a directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "Removes tags from an Amazon Directory Services directory.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:DeleteTags"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetUserPassword",
                "description": "Resets the password for any user in your AWS Managed Microsoft AD or Simple AD directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreFromSnapshot",
                "description": "Restores a directory using an existing directory snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ShareDirectory",
                "description": "Shares a specified directory in your AWS account (directory owner) with another AWS account (directory consumer). With this operation you can use your directory from any AWS account and from any Amazon VPC within an AWS Region.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSchemaExtension",
                "description": "Applies a schema extension to a Microsoft AD directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnauthorizeApplication",
                "description": "Unauthorizes an application from your AWS Directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnshareDirectory",
                "description": "Stops the directory sharing between the directory owner and consumer accounts.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConditionalForwarder",
                "description": "Updates a conditional forwarder that has been set up for your AWS directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNumberOfDomainControllers",
                "description": "Adds or removes domain controllers to or from the directory. Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRadius",
                "description": "Updates the Remote Authentication Dial In User Service (RADIUS) server information for an AD Connector directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrust",
                "description": "Updates the trust that has been set up between your AWS Managed Microsoft AD directory and an on-premises Active Directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyTrust",
                "description": "Verifies a trust relationship between your Microsoft AD in the AWS cloud and an external domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "directory*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "directory",
                "arn": "arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon DynamoDB",
        "prefix": "dynamodb",
        "privileges": [
            {
                "privilege": "BatchGetItem",
                "description": "Returns the attributes of one or more items from one or more tables",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:Select"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchWriteItem",
                "description": "Puts or deletes multiple items in one or more tables",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConditionCheckItem",
                "description": "The ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:ReturnValues"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBackup",
                "description": "Creates a backup for an existing table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGlobalTable",
                "description": "Enables the user to create a global table from an existing table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTable",
                "description": "The CreateTable operation adds a new table to your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTableReplica",
                "description": "Adds a new replica table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackup",
                "description": "Deletes an existing backup of a table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteItem",
                "description": "Deletes a single item in a table by primary key",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:EnclosingOperation",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:ReturnValues"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTable",
                "description": "The DeleteTable operation deletes a table and all of its items",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTableReplica",
                "description": "Deletes a replica table and all of its items",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBackup",
                "description": "Describes an existing backup of a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeContinuousBackups",
                "description": "Checks the status of the backup restore settings on the specified table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeContributorInsights",
                "description": "Describes the contributor insights status and related details for a given table or global secondary index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGlobalTable",
                "description": "Returns information about the specified global table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "global-table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGlobalTableSettings",
                "description": "Returns settings information about the specified global table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "global-table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLimits",
                "description": "Returns the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedCapacity",
                "description": "Describes one or more of the Reserved Capacity purchased",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedCapacityOfferings",
                "description": "Describes Reserved Capacity offerings that are available for purchase",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStream",
                "description": "Returns information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTable",
                "description": "Returns information about the table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTableReplicaAutoScaling",
                "description": "Describes the auto scaling settings across all replicas of the global table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTimeToLive",
                "description": "Gives a description of the Time to Live (TTL) status on the specified table.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetItem",
                "description": "The GetItem operation returns a set of attributes for the item with the given primary key",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:EnclosingOperation",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:Select"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecords",
                "description": "Retrieves the stream records from a given shard",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetShardIterator",
                "description": "Returns a shard iterator",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBackups",
                "description": "List backups associated with the account and endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListContributorInsights",
                "description": "Lists the ContributorInsightsSummary for all tables and global secondary indexes associated with the current account and endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGlobalTables",
                "description": "Lists all global tables that have a replica in the specified region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreams",
                "description": "Returns an array of stream ARNs associated with the current account and endpoint",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTables",
                "description": "Returns an array of table names associated with the current account and endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsOfResource",
                "description": "List all tags on an Amazon DynamoDB resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseReservedCapacityOfferings",
                "description": "Purchases Reserved Capacity for use with your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutItem",
                "description": "Creates a new item, or replaces an old item with a new item",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:EnclosingOperation",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:ReturnValues"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Query",
                "description": "Uses the primary key of a table or a secondary index to directly access items from that table or index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:ReturnValues",
                            "dynamodb:Select"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreTableFromBackup",
                "description": "Creates a new table from an existing backup",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreTableToPointInTime",
                "description": "Restores a table to a point in time",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Scan",
                "description": "Returns one or more items and item attributes by accessing every item in a table or a secondary index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:ReturnValues",
                            "dynamodb:Select"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Associate a set of tags with an Amazon DynamoDB resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the association of tags from an Amazon DynamoDB resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateContinuousBackups",
                "description": "Enables or disables continuous backups",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateContributorInsights",
                "description": "Updates the status for contributor insights for a specific table or global secondary index",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGlobalTable",
                "description": "Enables the user to add or remove replicas in the specified global table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGlobalTableSettings",
                "description": "Enables the user to update settings of the specified global table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateItem",
                "description": "Edits an existing item's attributes, or adds a new item to the table if it does not already exist",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "dynamodb:Attributes",
                            "dynamodb:EnclosingOperation",
                            "dynamodb:LeadingKeys",
                            "dynamodb:ReturnConsumedCapacity",
                            "dynamodb:ReturnValues"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTable",
                "description": "Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTableReplicaAutoScaling",
                "description": "Updates auto scaling settings on your replica table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTimeToLive",
                "description": "Enables or disables TTL for the specified table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "index",
                "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/index/${IndexName}",
                "condition_keys": []
            },
            {
                "resource": "stream",
                "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/stream/${StreamLabel}",
                "condition_keys": []
            },
            {
                "resource": "table",
                "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}",
                "condition_keys": []
            },
            {
                "resource": "backup",
                "arn": "arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/backup/${BackupName}",
                "condition_keys": []
            },
            {
                "resource": "global-table",
                "arn": "arn:${Partition}:dynamodb::${Account}:global-table/${GlobalTableName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "dynamodb:Attributes",
                "description": "Filter based on the attribute (field or column) names of the table.",
                "type": "String"
            },
            {
                "condition": "dynamodb:EnclosingOperation",
                "description": "Used to block Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa.",
                "type": "String"
            },
            {
                "condition": "dynamodb:LeadingKeys",
                "description": "Filters based on the partition key of the table.",
                "type": "String"
            },
            {
                "condition": "dynamodb:ReturnConsumedCapacity",
                "description": "Filter based on the ReturnConsumedCapacity parameter of a request. Contains either \"TOTAL\" or \"NONE\".",
                "type": "String"
            },
            {
                "condition": "dynamodb:ReturnValues",
                "description": "Filter based on the ReturnValues parameter of request. Contains one of the following: \"ALL_OLD\", \"UPDATED_OLD\",\"ALL_NEW\",\"UPDATED_NEW\", or \"NONE\".",
                "type": "String"
            },
            {
                "condition": "dynamodb:Select",
                "description": "Filter based on the Select parameter of a Query or Scan request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic Block Store",
        "prefix": "ebs",
        "privileges": [
            {
                "privilege": "GetSnapshotBlock",
                "description": "Grants permission to return the data of a block in an Amazon Elastic Block Store (EBS) snapshot",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChangedBlocks",
                "description": "Grants permission to list the block indexes and block tokens for blocks that are different between two Amazon Elastic Block Store (EBS) snapshots of the same volume/snapshot lineage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSnapshotBlocks",
                "description": "Grants permission to list the block indexes and block tokens for blocks in an Amazon Elastic Block Store (EBS) snapshot.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "snapshot",
                "arn": "arn:${Partition}:ec2:${Region}::snapshot/${SnapshotId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access based on tag key-value pairs assigned to the AWS resource",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon EC2",
        "prefix": "ec2",
        "privileges": [
            {
                "privilege": "AcceptReservedInstancesExchangeQuote",
                "description": "Grants permission to accept a Convertible Reserved Instance exchange quote",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AcceptTransitGatewayPeeringAttachment",
                "description": "Grants permission to accept a transit gateway peering attachment request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AcceptTransitGatewayVpcAttachment",
                "description": "Grants permission to accept a request to attach a VPC to a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AcceptVpcEndpointConnections",
                "description": "Grants permission to accept one or more interface VPC endpoint connections to your VPC endpoint service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AcceptVpcPeeringConnection",
                "description": "Grants permission to accept a VPC peering connection request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-peering-connection*",
                        "condition_keys": [
                            "ec2:AccepterVpc",
                            "ec2:Region",
                            "ec2:RequesterVpc",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AdvertiseByoipCidr",
                "description": "Grants permission to advertise an IP address range that is provisioned for use in AWS through bring your own IP addresses (BYOIP)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocateAddress",
                "description": "Grants permission to allocate an Elastic IP address (EIP) to your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AllocateHosts",
                "description": "Grants permission to allocate a Dedicated Host to your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dedicated-host*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApplySecurityGroupsToClientVpnTargetNetwork",
                "description": "Grants permission to apply a security group to the association between a Client VPN endpoint and a target network",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssignIpv6Addresses",
                "description": "Grants permission to assign one or more IPv6 addresses to a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssignPrivateIpAddresses",
                "description": "Grants permission to assign one or more secondary private IP addresses to a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateAddress",
                "description": "Grants permission to associate an Elastic IP address (EIP) with an instance or a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateClientVpnTargetNetwork",
                "description": "Grants permission to associate a target network with a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateDhcpOptions",
                "description": "Grants permission to associate or disassociate a set of DHCP options with a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateIamInstanceProfile",
                "description": "Grants permission to associate an IAM instance profile with a running or stopped instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "AssociateRouteTable",
                "description": "Grants permission to associate a subnet or gateway with a route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateSubnetCidrBlock",
                "description": "Grants permission to associate a CIDR block with a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateTransitGatewayMulticastDomain",
                "description": "Grants permission to associate an attachment and list of subnets with a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subnet*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateTransitGatewayRouteTable",
                "description": "Grants permission to associate an attachment with a transit gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateVpcCidrBlock",
                "description": "Grants permission to associate a CIDR block with a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachClassicLinkVpc",
                "description": "Grants permission to link an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC's security groups",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachInternetGateway",
                "description": "Grants permission to attach an internet gateway to a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachNetworkInterface",
                "description": "Grants permission to attach a network interface to an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachVolume",
                "description": "Grants permission to attach an EBS volume to a running or stopped instance and expose it to the instance with the specified device name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:Encrypted",
                            "ec2:ParentSnapshot",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachVpnGateway",
                "description": "Grants permission to attach a virtual private gateway to a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeClientVpnIngress",
                "description": "Grants permission to add an inbound authorization rule to a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeSecurityGroupEgress",
                "description": "Grants permission to add one or more outbound rules to a VPC security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeSecurityGroupIngress",
                "description": "Grants permission to add one or more inbound rules to a security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BundleInstance",
                "description": "Grants permission to bundle an instance store-backed Windows instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelBundleTask",
                "description": "Grants permission to cancel a bundling operation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelCapacityReservation",
                "description": "Grants permission to cancel a Capacity Reservation and release the reserved capacity",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "capacity-reservation*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelConversionTask",
                "description": "Grants permission to cancel an active conversion task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelExportTask",
                "description": "Grants permission to cancel an active export task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelImportTask",
                "description": "Grants permission to cancel an in-process import virtual machine or import snapshot task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelReservedInstancesListing",
                "description": "Grants permission to cancel a Reserved Instance listing on the Reserved Instance Marketplace",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelSpotFleetRequests",
                "description": "Grants permission to cancel one or more Spot Fleet requests",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelSpotInstanceRequests",
                "description": "Grants permission to cancel one or more Spot Instance requests",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmProductInstance",
                "description": "Grants permission to determine whether an owned product code is associated with an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyFpgaImage",
                "description": "Grants permission to copy a source Amazon FPGA image (AFI) to the current Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyImage",
                "description": "Grants permission to copy an Amazon Machine Image (AMI) from a source Region to the current Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopySnapshot",
                "description": "Grants permission to copy a point-in-time snapshot of an EBS volume and store it in Amazon S3",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCapacityReservation",
                "description": "Grants permission to create a Capacity Reservation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClientVpnEndpoint",
                "description": "Grants permission to create a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClientVpnRoute",
                "description": "Grants permission to add a network route to a Client VPN endpoint's route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCustomerGateway",
                "description": "Grants permission to create a customer gateway, which provides information to AWS about your customer gateway device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDefaultSubnet",
                "description": "Grants permission to create a default subnet in a specified Availability Zone in a default VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDefaultVpc",
                "description": "Grants permission to create a default VPC with a default subnet in each Availability Zone",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDhcpOptions",
                "description": "Grants permission to create a set of DHCP options for a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEgressOnlyInternetGateway",
                "description": "Grants permission to create an egress-only internet gateway for a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFleet",
                "description": "Grants permission to launch an EC2 Fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFlowLogs",
                "description": "Grants permission to create one or more flow logs to capture IP traffic for a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-flow-log*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "network-interface",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:Subnet",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc",
                        "condition_keys": [
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFpgaImage",
                "description": "Grants permission to create an Amazon FPGA Image (AFI) from a design checkpoint (DCP)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImage",
                "description": "Grants permission to create an Amazon EBS-backed AMI from a stopped or running Amazon EBS-backed instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstanceExportTask",
                "description": "Grants permission to export a running or stopped instance to an Amazon S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInternetGateway",
                "description": "Grants permission to create an internet gateway for a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateKeyPair",
                "description": "Grants permission to create a 2048-bit RSA key pair",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLaunchTemplate",
                "description": "Grants permission to create a launch template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLaunchTemplateVersion",
                "description": "Grants permission to create a new version of a launch template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "launch-template*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLocalGatewayRoute",
                "description": "Grants permission to create a static route for a local gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "local-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-virtual-interface-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLocalGatewayRouteTableVpcAssociation",
                "description": "Grants permission to associate a VPC with a local gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "local-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNatGateway",
                "description": "Grants permission to create a NAT gateway in a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNetworkAcl",
                "description": "Grants permission to create a network ACL in a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNetworkAclEntry",
                "description": "Grants permission to create a numbered entry (a rule) in a network ACL",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNetworkInterface",
                "description": "Grants permission to create a network interface in a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNetworkInterfacePermission",
                "description": "Grants permission to create a permission for an AWS-authorized user to perform certain operations on a network interface",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:AuthorizedUser",
                            "ec2:AvailabilityZone",
                            "ec2:Permission",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Subnet",
                            "ec2:Vpc",
                            "ec2:AuthorizedService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlacementGroup",
                "description": "Grants permission to create a placement group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReservedInstancesListing",
                "description": "Grants permission to create a listing for Standard Reserved Instances to be sold in the Reserved Instance Marketplace",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoute",
                "description": "Grants permission to create a route in a VPC route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRouteTable",
                "description": "Grants permission to create a route table for a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSecurityGroup",
                "description": "Grants permission to create a security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSnapshot",
                "description": "Grants permission to create a snapshot of an EBS volume and store it in Amazon S3",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "ec2:ParentVolume",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "ec2:Encrypted",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSnapshots",
                "description": "Grants permission to create crash-consistent snapshots of multiple EBS volumes and store them in Amazon S3",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "ec2:ParentVolume",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "ec2:Encrypted",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSpotDatafeedSubscription",
                "description": "Grants permission to create a data feed for Spot Instances to view Spot Instance usage logs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSubnet",
                "description": "Grants permission to create a subnet in a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Grants permission to add or overwrite one or more tags for Amazon EC2 resources",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "capacity-reservation",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "client-vpn-endpoint",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dedicated-host",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dhcp-options",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fpga-image",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Owner",
                            "ec2:Public",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:ImageType",
                            "ec2:Owner",
                            "ec2:Public",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instance",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "internet-gateway",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-route-table",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-route-table-virtual-interface-group-association",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-route-table-vpc-association",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-virtual-interface",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-virtual-interface-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "network-acl",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "network-interface",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Subnet",
                            "ec2:Vpc",
                            "ec2:AssociatePublicIpAddress"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reserved-instances",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:InstanceType",
                            "ec2:Region",
                            "ec2:ReservedInstancesOfferingType",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route-table",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Owner",
                            "ec2:ParentVolume",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:SnapshotTime",
                            "ec2:VolumeSize"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "spot-instance-request",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-filter",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-session",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-target",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:Encrypted",
                            "ec2:ParentSnapshot",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-endpoint",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-endpoint-service",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-flow-log",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpn-connection",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpn-gateway",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ec2:CreateAction"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficMirrorFilter",
                "description": "Grants permission to create a traffic mirror filter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficMirrorFilterRule",
                "description": "Grants permission to create a traffic mirror filter rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-filter-rule*",
                        "condition_keys": [
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficMirrorSession",
                "description": "Grants permission to create a traffic mirror session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-session*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-target*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficMirrorTarget",
                "description": "Grants permission to create a traffic mirror target",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-target*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "network-interface",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitGateway",
                "description": "Grants permission to create a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitGatewayMulticastDomain",
                "description": "Grants permission to create a multicast domain for a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitGatewayPeeringAttachment",
                "description": "Grants permission to request a transit gateway peering attachment between a requester and accepter transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitGatewayRoute",
                "description": "Grants permission to create a static route for a transit gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitGatewayRouteTable",
                "description": "Grants permission to create a route table for a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransitGatewayVpcAttachment",
                "description": "Grants permission to attach a VPC to a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVolume",
                "description": "Grants permission to create an EBS volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:Encrypted",
                            "ec2:ParentSnapshot",
                            "ec2:Region",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpc",
                "description": "Grants permission to create a VPC with a specified CIDR block",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpcEndpoint",
                "description": "Grants permission to create a VPC endpoint for an AWS service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": [
                            "route53:AssociateVPCWithHostedZone"
                        ]
                    },
                    {
                        "resource_type": "vpc-endpoint*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:VpceServiceName",
                            "ec2:VpceServiceOwner"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route-table",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpcEndpointConnectionNotification",
                "description": "Grants permission to create a connection notification for a VPC endpoint or VPC endpoint service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpcEndpointServiceConfiguration",
                "description": "Grants permission to create a VPC endpoint service configuration to which service consumers (AWS accounts, IAM users, and IAM roles) can connect",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:VpceServicePrivateDnsName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpcPeeringConnection",
                "description": "Grants permission to request a VPC peering connection between two VPCs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-peering-connection*",
                        "condition_keys": [
                            "ec2:AccepterVpc",
                            "ec2:Region",
                            "ec2:RequesterVpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpnConnection",
                "description": "Grants permission to create a VPN connection between a virtual private gateway or transit gateway and a customer gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpn-connection*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:AuthenticationType",
                            "ec2:DPDTimeoutSeconds",
                            "ec2:GatewayType",
                            "ec2:IKEVersions",
                            "ec2:InsideTunnelCidr",
                            "ec2:Phase1DHGroupNumbers",
                            "ec2:Phase2DHGroupNumbers",
                            "ec2:Phase1EncryptionAlgorithms",
                            "ec2:Phase2EncryptionAlgorithms",
                            "ec2:Phase1IntegrityAlgorithms",
                            "ec2:Phase2IntegrityAlgorithms",
                            "ec2:Phase1LifetimeSeconds",
                            "ec2:Phase2LifetimeSeconds",
                            "ec2:PresharedKeys",
                            "ec2:RekeyFuzzPercentage",
                            "ec2:RekeyMarginTimeSeconds",
                            "ec2:RoutingType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpnConnectionRoute",
                "description": "Grants permission to create a static route for a VPN connection between a virtual private gateway and a customer gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpnGateway",
                "description": "Grants permission to create a virtual private gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClientVpnEndpoint",
                "description": "Grants permission to delete a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClientVpnRoute",
                "description": "Grants permission to delete a route from a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCustomerGateway",
                "description": "Grants permission to delete a customer gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "customer-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDhcpOptions",
                "description": "Grants permission to delete a set of DHCP options",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dhcp-options*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEgressOnlyInternetGateway",
                "description": "Grants permission to delete an egress-only internet gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFleets",
                "description": "Grants permission to delete one or more EC2 Fleets",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFlowLogs",
                "description": "Grants permission to delete one or more flow logs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFpgaImage",
                "description": "Grants permission to delete an Amazon FPGA Image (AFI)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInternetGateway",
                "description": "Grants permission to delete an internet gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "internet-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteKeyPair",
                "description": "Grants permission to delete a key pair by removing the public key from Amazon EC2",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLaunchTemplate",
                "description": "Grants permission to delete a launch template and its associated versions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "launch-template*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLaunchTemplateVersions",
                "description": "Grants permission to delete one or more versions of a launch template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "launch-template*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLocalGatewayRoute",
                "description": "Grants permission to delete a route from a local gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "local-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLocalGatewayRouteTableVpcAssociation",
                "description": "Grants permission to delete an association between a VPC and local gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "local-gateway-route-table-vpc-association*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNatGateway",
                "description": "Grants permission to delete a NAT gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNetworkAcl",
                "description": "Grants permission to delete a network ACL",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-acl*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNetworkAclEntry",
                "description": "Grants permission to delete an inbound or outbound entry (rule) from a network ACL",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-acl*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNetworkInterface",
                "description": "Grants permission to delete a detached network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNetworkInterfacePermission",
                "description": "Grants permission to delete a permission that is associated with a network interface",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePlacementGroup",
                "description": "Grants permission to delete a placement group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoute",
                "description": "Grants permission to delete a route from a route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRouteTable",
                "description": "Grants permission to delete a route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSecurityGroup",
                "description": "Grants permission to delete a security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSnapshot",
                "description": "Grants permission to delete a snapshot of an EBS volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "ec2:Owner",
                            "ec2:ParentVolume",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:SnapshotTime",
                            "ec2:VolumeSize"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSpotDatafeedSubscription",
                "description": "Grants permission to delete a data feed for Spot Instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSubnet",
                "description": "Grants permission to delete a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Grants permission to delete one or more tags from Amazon EC2 resources",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "capacity-reservation",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "client-vpn-endpoint",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dedicated-host",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dhcp-options",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fpga-image",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instance",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "internet-gateway",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-route-table",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-route-table-virtual-interface-group-association",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-route-table-vpc-association",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-virtual-interface",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "local-gateway-virtual-interface-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "network-acl",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "network-interface",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reserved-instances",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route-table",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "spot-instance-request",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-endpoint",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-endpoint-service",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc-flow-log",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpn-connection",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpn-gateway",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrafficMirrorFilter",
                "description": "Grants permission to delete a traffic mirror filter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrafficMirrorFilterRule",
                "description": "Grants permission to delete a traffic mirror filter rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-filter-rule*",
                        "condition_keys": [
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrafficMirrorSession",
                "description": "Grants permission to delete a traffic mirror session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-session*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrafficMirrorTarget",
                "description": "Grants permission to delete a traffic mirror target",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-target*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTransitGateway",
                "description": "Grants permission to delete a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTransitGatewayMulticastDomain",
                "description": "Grants permissions to delete a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTransitGatewayPeeringAttachment",
                "description": "Grants permission to delete a peering attachment from a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTransitGatewayRoute",
                "description": "Grants permission to delete a route from a transit gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTransitGatewayRouteTable",
                "description": "Grants permission to delete a transit gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTransitGatewayVpcAttachment",
                "description": "Grants permission to delete a VPC attachment from a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVolume",
                "description": "Grants permission to delete an EBS volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:Encrypted",
                            "ec2:ParentSnapshot",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpc",
                "description": "Grants permission to delete a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpcEndpointConnectionNotifications",
                "description": "Grants permission to delete one or more VPC endpoint connection notifications",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpcEndpointServiceConfigurations",
                "description": "Grants permission to delete one or more VPC endpoint service configurations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpcEndpoints",
                "description": "Grants permission to delete one or more VPC endpoints",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpcPeeringConnection",
                "description": "Grants permission to delete a VPC peering connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-peering-connection*",
                        "condition_keys": [
                            "ec2:AccepterVpc",
                            "ec2:Region",
                            "ec2:RequesterVpc",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpnConnection",
                "description": "Grants permission to delete a VPN connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpnConnectionRoute",
                "description": "Grants permission to delete a static route for a VPN connection between a virtual private gateway and a customer gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpnGateway",
                "description": "Grants permission to delete a virtual private gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprovisionByoipCidr",
                "description": "Grants permission to release an IP address range that was provisioned through bring your own IP addresses (BYOIP), and to delete the corresponding address pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterImage",
                "description": "Grants permission to deregister an Amazon Machine Image (AMI)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTransitGatewayMulticastGroupMembers",
                "description": "Grants permission to deregister one or more network interface members from a group IP address in a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTransitGatewayMulticastGroupSources",
                "description": "Grants permission to deregister one or more network interface sources from a group IP address in a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAttributes",
                "description": "Grants permission to describe the attributes of the AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAddresses",
                "description": "Grants permission to describe one or more Elastic IP addresses",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAggregateIdFormat",
                "description": "Grants permission to describe the longer ID format settings for all resource types",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAvailabilityZones",
                "description": "Grants permission to describe one or more of the Availability Zones that are available to you",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBundleTasks",
                "description": "Grants permission to describe one or more bundling tasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeByoipCidrs",
                "description": "Grants permission to describe the IP address ranges that were provisioned through bring your own IP addresses (BYOIP)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCapacityReservations",
                "description": "Grants permission to describe one or more Capacity Reservations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClassicLinkInstances",
                "description": "Grants permission to describe one or more linked EC2-Classic instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClientVpnAuthorizationRules",
                "description": "Grants permission to describe the authorization rules for a Client VPN endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClientVpnConnections",
                "description": "Grants permission to describe active client connections and connections that have been terminated within the last 60 minutes for a Client VPN endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClientVpnEndpoints",
                "description": "Grants permission to describe one or more Client VPN endpoints",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClientVpnRoutes",
                "description": "Grants permission to describe the routes for a Client VPN endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClientVpnTargetNetworks",
                "description": "Grants permission to describe the target networks that are associated with a Client VPN endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConversionTasks",
                "description": "Grants permission to describe one or more conversion tasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCustomerGateways",
                "description": "Grants permission to describe one or more customer gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDhcpOptions",
                "description": "Grants permission to describe one or more DHCP options sets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEgressOnlyInternetGateways",
                "description": "Grants permission to describe one or more egress-only internet gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticGpus",
                "description": "Grants permission to describe an Elastic Graphics accelerator that is associated with an instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExportImageTasks",
                "description": "Grants permission to describe one or more export image tasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExportTasks",
                "description": "Grants permission to describe one or more export instance tasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFastSnapshotRestores",
                "description": "Grants permission to describe the state of fast snapshot restores for snapshots",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetHistory",
                "description": "Grants permission to describe the events for an EC2 Fleet during a specified time",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetInstances",
                "description": "Grants permission to describe the running instances for an EC2 Fleet",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleets",
                "description": "Grants permission to describe one or more EC2 Fleets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFlowLogs",
                "description": "Grants permission to describe one or more flow logs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFpgaImageAttribute",
                "description": "Grants permission to describe the attributes of an Amazon FPGA Image (AFI)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFpgaImages",
                "description": "Grants permission to describe one or more Amazon FPGA Images (AFIs)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHostReservationOfferings",
                "description": "Grants permission to describe the Dedicated Host Reservations that are available to purchase",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHostReservations",
                "description": "Grants permission to describe the Dedicated Host Reservations that are associated with Dedicated Hosts in the AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHosts",
                "description": "Grants permission to describe one or more Dedicated Hosts",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIamInstanceProfileAssociations",
                "description": "Grants permission to describe the IAM instance profile associations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdFormat",
                "description": "Grants permission to describe the ID format settings for resources",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentityIdFormat",
                "description": "Grants permission to describe the ID format settings for resources for an IAM user, IAM role, or root user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImageAttribute",
                "description": "Grants permission to describe an attribute of an Amazon Machine Image (AMI)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImages",
                "description": "Grants permission to describe one or more images (AMIs, AKIs, and ARIs)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImportImageTasks",
                "description": "Grants permission to describe import virtual machine or import snapshot tasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImportSnapshotTasks",
                "description": "Grants permission to describe import snapshot tasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceAttribute",
                "description": "Grants permission to describe the attributes of an instance",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceCreditSpecifications",
                "description": "Grants permission to describe the credit option for CPU usage of one or more burstable performance instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceStatus",
                "description": "Grants permission to describe the status of one or more instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceTypes",
                "description": "Grants permission to describe all instance types that are offered in an AWS Region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstances",
                "description": "Grants permission to describe one or more instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInternetGateways",
                "description": "Grants permission to describe one or more internet gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeKeyPairs",
                "description": "Grants permission to describe one or more key pairs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLaunchTemplateVersions",
                "description": "Grants permission to describe one or more launch template versions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLaunchTemplates",
                "description": "Grants permission to describe one or more launch templates",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
                "description": "Grants permission to describe the associations between virtual interface groups and local gateway route tables",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocalGatewayRouteTableVpcAssociations",
                "description": "Grants permission to describe an association between VPCs and local gateway route tables",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocalGatewayRouteTables",
                "description": "Grants permission to describe one or more local gateway route tables",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocalGatewayVirtualInterfaceGroups",
                "description": "Grants permission to describe local gateway virtual interface groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocalGatewayVirtualInterfaces",
                "description": "Grants permission to describe local gateway virtual interfaces",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLocalGateways",
                "description": "Grants permission to describe one or more local gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMovingAddresses",
                "description": "Grants permission to describe Elastic IP addresses that are being moved to the EC2-VPC platform",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNatGateways",
                "description": "Grants permission to describe one or more NAT gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNetworkAcls",
                "description": "Grants permission to describe one or more network ACLs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNetworkInterfaceAttribute",
                "description": "Grants permission to describe a network interface attribute",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNetworkInterfacePermissions",
                "description": "Grants permission to describe the permissions that are associated with a network interface",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNetworkInterfaces",
                "description": "Grants permission to describe one or more network interfaces",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePlacementGroups",
                "description": "Grants permission to describe one or more placement groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrefixLists",
                "description": "Grants permission to describe available AWS services in a prefix list format",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePrincipalIdFormat",
                "description": "Grants permission to describe the ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID (17-character ID) preference",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePublicIpv4Pools",
                "description": "Grants permission to describe one or more IPv4 address pools",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRegions",
                "description": "Grants permission to describe one or more AWS Regions that are currently available in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedInstances",
                "description": "Grants permission to describe one or more purchased Reserved Instances in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedInstancesListings",
                "description": "Grants permission to describe your account's Reserved Instance listings in the Reserved Instance Marketplace",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedInstancesModifications",
                "description": "Grants permission to describe the modifications made to one or more Reserved Instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedInstancesOfferings",
                "description": "Grants permission to describe the Reserved Instance offerings that are available for purchase",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRouteTables",
                "description": "Grants permission to describe one or more route tables",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScheduledInstanceAvailability",
                "description": "Grants permission to find available schedules for Scheduled Instances",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScheduledInstances",
                "description": "Grants permission to describe one or more Scheduled Instances in your account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSecurityGroupReferences",
                "description": "Grants permission to describe the VPCs on the other side of a VPC peering connection that are referencing specified VPC security groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSecurityGroups",
                "description": "Grants permission to describe one or more security groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshotAttribute",
                "description": "Grants permission to describe an attribute of a snapshot",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshots",
                "description": "Grants permission to describe one or more EBS snapshots",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSpotDatafeedSubscription",
                "description": "Grants permission to describe the data feed for Spot Instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSpotFleetInstances",
                "description": "Grants permission to describe the running instances for a Spot Fleet",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSpotFleetRequestHistory",
                "description": "Grants permission to describe the events for a Spot Fleet request during a specified time",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSpotFleetRequests",
                "description": "Grants permission to describe one or more Spot Fleet requests",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSpotInstanceRequests",
                "description": "Grants permission to describe one or more Spot Instance requests",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSpotPriceHistory",
                "description": "Grants permission to describe the Spot Instance price history",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStaleSecurityGroups",
                "description": "Grants permission to describe the stale security group rules for security groups in a specified VPC",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSubnets",
                "description": "Grants permission to describe one or more subnets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Grants permission to describe one or more tags for an Amazon EC2 resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrafficMirrorFilters",
                "description": "Grants permission to describe one or more traffic mirror filters",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrafficMirrorSessions",
                "description": "Grants permission to describe one or more traffic mirror sessions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrafficMirrorTargets",
                "description": "Grants permission to describe one or more traffic mirror targets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransitGatewayAttachments",
                "description": "Grants permission to describe one or more attachments between resources and transit gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransitGatewayMulticastDomains",
                "description": "Grants permission to describe one or more transit gateway multicast domains",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransitGatewayPeeringAttachments",
                "description": "Grants permission to describe one or more transit gateway peering attachments",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransitGatewayRouteTables",
                "description": "Grants permission to describe one or more transit gateway route tables",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransitGatewayVpcAttachments",
                "description": "Grants permission to describe one or more VPC attachments on a transit gateway",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransitGateways",
                "description": "Grants permission to describe one or more transit gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVolumeAttribute",
                "description": "Grants permission to describe an attribute of an EBS volume",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVolumeStatus",
                "description": "Grants permission to describe the status of one or more EBS volumes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVolumes",
                "description": "Grants permission to describe one or more EBS volumes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVolumesModifications",
                "description": "Grants permission to describe the current modification status of one or more EBS volumes",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcAttribute",
                "description": "Grants permission to describe an attribute of a VPC",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcClassicLink",
                "description": "Grants permission to describe the ClassicLink status of one or more VPCs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcClassicLinkDnsSupport",
                "description": "Grants permission to describe the ClassicLink DNS support status of one or more VPCs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcEndpointConnectionNotifications",
                "description": "Grants permission to describe the connection notifications for VPC endpoints and VPC endpoint services",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcEndpointConnections",
                "description": "Grants permission to describe the VPC endpoint connections to your VPC endpoint services",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcEndpointServiceConfigurations",
                "description": "Grants permission to describe VPC endpoint service configurations (your services)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcEndpointServicePermissions",
                "description": "Grants permission to describe the principals (service consumers) that are permitted to discover your VPC endpoint service",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcEndpointServices",
                "description": "Grants permission to describe all supported AWS services that can be specified when creating a VPC endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcEndpoints",
                "description": "Grants permission to describe one or more VPC endpoints",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcPeeringConnections",
                "description": "Grants permission to describe one or more VPC peering connections",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcs",
                "description": "Grants permission to describe one or more VPCs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpnConnections",
                "description": "Grants permission to describe one or more VPN connections",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpnGateways",
                "description": "Grants permission to describe one or more virtual private gateways",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachClassicLinkVpc",
                "description": "Grants permission to unlink (detach) a linked EC2-Classic instance from a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachInternetGateway",
                "description": "Grants permission to detach an internet gateway from a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachNetworkInterface",
                "description": "Grants permission to detach a network interface from an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachVolume",
                "description": "Grants permission to detach an EBS volume from an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:Encrypted",
                            "ec2:ParentSnapshot",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachVpnGateway",
                "description": "Grants permission to detach a virtual private gateway from a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableEbsEncryptionByDefault",
                "description": "Grants permission to disable EBS encryption by default for your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableFastSnapshotRestores",
                "description": "Grants permission to disable fast snapshot restores for one or more snapshots in specified Availability Zones",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "ec2:Owner",
                            "ec2:ParentVolume",
                            "ec2:Region",
                            "ec2:AvailabilityZone",
                            "ec2:SnapshotTime",
                            "ec2:Encrypted",
                            "ec2:VolumeSize",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableTransitGatewayRouteTablePropagation",
                "description": "Grants permission to disable a resource attachment from propagating routes to the specified propagation route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableVgwRoutePropagation",
                "description": "Grants permission to disable a virtual private gateway from propagating routes to a specified route table of a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableVpcClassicLink",
                "description": "Grants permission to disable ClassicLink for a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableVpcClassicLinkDnsSupport",
                "description": "Grants permission to disable ClassicLink DNS support for a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateAddress",
                "description": "Grants permission to disassociate an Elastic IP address from an instance or network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateClientVpnTargetNetwork",
                "description": "Grants permission to disassociate a target network from a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateIamInstanceProfile",
                "description": "Grants permission to disassociate an IAM instance profile from a running or stopped instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateRouteTable",
                "description": "Grants permission to disassociate a subnet from a route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateSubnetCidrBlock",
                "description": "Grants permission to disassociate a CIDR block from a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateTransitGatewayMulticastDomain",
                "description": "Grants permission to disassociate one or more subnets from a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subnet*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateTransitGatewayRouteTable",
                "description": "Grants permission to disassociate a resource attachment from a transit gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateVpcCidrBlock",
                "description": "Grants permission to disassociate a CIDR block from a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableEbsEncryptionByDefault",
                "description": "Grants permission to enable EBS encryption by default for your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableFastSnapshotRestores",
                "description": "Grants permission to enable fast snapshot restores for one or more snapshots in specified Availability Zones",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "ec2:Owner",
                            "ec2:ParentVolume",
                            "ec2:Region",
                            "ec2:AvailabilityZone",
                            "ec2:SnapshotTime",
                            "ec2:Encrypted",
                            "ec2:VolumeSize",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableTransitGatewayRouteTablePropagation",
                "description": "Grants permission to enable an attachment to propagate routes to a propagation route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableVgwRoutePropagation",
                "description": "Grants permission to enable a virtual private gateway to propagate routes to a VPC route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableVolumeIO",
                "description": "Grants permission to enable I/O operations for a volume that had I/O operations disabled",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableVpcClassicLink",
                "description": "Grants permission to enable a VPC for ClassicLink",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableVpcClassicLinkDnsSupport",
                "description": "Grants permission to enable a VPC to support DNS hostname resolution for ClassicLink",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportClientVpnClientCertificateRevocationList",
                "description": "Grants permission to download the client certificate revocation list for a Client VPN endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportClientVpnClientConfiguration",
                "description": "Grants permission to download the contents of the Client VPN endpoint configuration file for a Client VPN endpoint",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportImage",
                "description": "Grants permission to export an Amazon Machine Image (AMI) to a VM file",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportTransitGatewayRoutes",
                "description": "Grants permission to export routes from a transit gateway route table to an Amazon S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCapacityReservationUsage",
                "description": "Grants permission to get usage information about a Capacity Reservation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConsoleOutput",
                "description": "Grants permission to get the console output for an instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConsoleScreenshot",
                "description": "Grants permission to retrieve a JPG-format screenshot of a running instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDefaultCreditSpecification",
                "description": "Grants permission to get the default credit option for CPU usage of a burstable performance instance family",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEbsDefaultKmsKeyId",
                "description": "Grants permission to get the ID of the default customer master key (CMK) for EBS encryption by default",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEbsEncryptionByDefault",
                "description": "Grants permission to describe whether EBS encryption by default is enabled for your account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHostReservationPurchasePreview",
                "description": "Grants permission to preview a reservation purchase with configurations that match those of a Dedicated Host",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLaunchTemplateData",
                "description": "Grants permission to get the configuration data of the specified instance for use with a new launch template or launch template version",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPasswordData",
                "description": "Grants permission to retrieve the encrypted administrator password for a running Windows instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReservedInstancesExchangeQuote",
                "description": "Grants permission to return a quote and exchange information for exchanging one or more Convertible Reserved Instances for a new Convertible Reserved Instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTransitGatewayAttachmentPropagations",
                "description": "Grants permission to list the route tables to which a resource attachment propagates routes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTransitGatewayMulticastDomainAssociations",
                "description": "Grants permission to get information about the associations for a transit gateway multicast domain",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTransitGatewayRouteTableAssociations",
                "description": "Grants permission to get information about associations for a transit gateway route table",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTransitGatewayRouteTablePropagations",
                "description": "Grants permission to get information about the route table propagations for a transit gateway route table",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportClientVpnClientCertificateRevocationList",
                "description": "Grants permission to upload a client certificate revocation list to a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportImage",
                "description": "Grants permission to import single or multi-volume disk images or EBS snapshots into an Amazon Machine Image (AMI)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportInstance",
                "description": "Grants permission to create an import instance task using metadata from a disk image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportKeyPair",
                "description": "Grants permission to import a public key from an RSA key pair that was created with a third-party tool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportSnapshot",
                "description": "Grants permission to import a disk into an EBS snapshot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportVolume",
                "description": "Grants permission to create an import volume task using metadata from a disk image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCapacityReservation",
                "description": "Grants permission to modify a Capacity Reservation's capacity and the conditions under which it is to be released",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "capacity-reservation*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClientVpnEndpoint",
                "description": "Grants permission to modify a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDefaultCreditSpecification",
                "description": "Grants permission to change the account level default credit option for CPU usage of burstable performance instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyEbsDefaultKmsKeyId",
                "description": "Grants permission to change the default customer master key (CMK) for EBS encryption by default for your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyFleet",
                "description": "Grants permission to modify an EC2 Fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyFpgaImageAttribute",
                "description": "Grants permission to modify an attribute of an Amazon FPGA Image (AFI)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyHosts",
                "description": "Grants permission to modify a Dedicated Host",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyIdFormat",
                "description": "Grants permission to modify the ID format for a resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyIdentityIdFormat",
                "description": "Grants permission to modify the ID format of a resource for a specific principal in your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyImageAttribute",
                "description": "Grants permission to modify an attribute of an Amazon Machine Image (AMI)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceAttribute",
                "description": "Grants permission to modify an attribute of an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceCapacityReservationAttributes",
                "description": "Grants permission to modify the Capacity Reservation settings for a stopped instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceCreditSpecification",
                "description": "Grants permission to modify the credit option for CPU usage on an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceEventStartTime",
                "description": "Grants permission to modify the start time for a scheduled EC2 instance event",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceMetadataOptions",
                "description": "Grants permission to modify the metadata options for an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstancePlacement",
                "description": "Grants permission to modify the placement attributes for an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyLaunchTemplate",
                "description": "Grants permission to modify a launch template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "launch-template*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyNetworkInterfaceAttribute",
                "description": "Grants permission to modify an attribute of a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReservedInstances",
                "description": "Grants permission to modify attributes of one or more Reserved Instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifySnapshotAttribute",
                "description": "Grants permission to add or remove permission settings for a snapshot",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [
                            "ec2:Owner",
                            "ec2:ParentVolume",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:SnapshotTime",
                            "ec2:VolumeSize"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifySpotFleetRequest",
                "description": "Grants permission to modify a Spot Fleet request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifySubnetAttribute",
                "description": "Grants permission to modify an attribute of a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyTrafficMirrorFilterNetworkServices",
                "description": "Grants permission to allow or restrict mirroring network services",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyTrafficMirrorFilterRule",
                "description": "Grants permission to modify a traffic mirror rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-filter*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-filter-rule*",
                        "condition_keys": [
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyTrafficMirrorSession",
                "description": "Grants permission to modify a traffic mirror session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "traffic-mirror-session*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-filter",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "traffic-mirror-target",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyTransitGatewayVpcAttachment",
                "description": "Grants permission to modify a VPC attachment on a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVolume",
                "description": "Grants permission to modify the parameters of an EBS volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVolumeAttribute",
                "description": "Grants permission to modify an attribute of a volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcAttribute",
                "description": "Grants permission to modify an attribute of a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcEndpoint",
                "description": "Grants permission to modify an attribute of a VPC endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "route-table",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcEndpointConnectionNotification",
                "description": "Grants permission to modify a connection notification for a VPC endpoint or VPC endpoint service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcEndpointServiceConfiguration",
                "description": "Grants permission to modify the attributes of a VPC endpoint service configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:VpceServicePrivateDnsName",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcEndpointServicePermissions",
                "description": "Grants permission to modify the permissions for a VPC endpoint service",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcPeeringConnectionOptions",
                "description": "Grants permission to modify the VPC peering connection options on one side of a VPC peering connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpcTenancy",
                "description": "Grants permission to modify the instance tenancy attribute of a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpnConnection",
                "description": "Grants permission to modify the target gateway of a Site-to-Site VPN connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpn-connection*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:GatewayType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpnTunnelCertificate",
                "description": "Grants permission to modify the certificate for a Site-to-Site VPN connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyVpnTunnelOptions",
                "description": "Grants permission to modify the options for a Site-to-Site VPN connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpn-connection*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:AuthenticationType",
                            "ec2:DPDTimeoutSeconds",
                            "ec2:IKEVersions",
                            "ec2:InsideTunnelCidr",
                            "ec2:Phase1DHGroupNumbers",
                            "ec2:Phase2DHGroupNumbers",
                            "ec2:Phase1EncryptionAlgorithms",
                            "ec2:Phase2EncryptionAlgorithms",
                            "ec2:Phase1IntegrityAlgorithms",
                            "ec2:Phase2IntegrityAlgorithms",
                            "ec2:Phase1LifetimeSeconds",
                            "ec2:Phase2LifetimeSeconds",
                            "ec2:PresharedKeys",
                            "ec2:RekeyFuzzPercentage",
                            "ec2:RekeyMarginTimeSeconds",
                            "ec2:RoutingType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MonitorInstances",
                "description": "Grants permission to enable detailed monitoring for a running instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MoveAddressToVpc",
                "description": "Grants permission to move an Elastic IP address from the EC2-Classic platform to the EC2-VPC platform",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ProvisionByoipCidr",
                "description": "Grants permission to provision an address range for use in AWS through bring your own IP addresses (BYOIP), and to create a corresponding address pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseHostReservation",
                "description": "Grants permission to purchase a reservation with configurations that match those of a Dedicated Host",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseReservedInstancesOffering",
                "description": "Grants permission to purchase a Reserved Instance offering",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseScheduledInstances",
                "description": "Grants permission to purchase one or more Scheduled Instances with a specified schedule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootInstances",
                "description": "Grants permission to request a reboot of one or more instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterImage",
                "description": "Grants permission to register an Amazon Machine Image (AMI)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTransitGatewayMulticastGroupMembers",
                "description": "Grants permission to register one or more network interfaces as a member of a group IP address in a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTransitGatewayMulticastGroupSources",
                "description": "Grants permission to register one or more network interfaces as a source of a group IP address in a transit gateway multicast domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-multicast-domain*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectTransitGatewayPeeringAttachment",
                "description": "Grants permission to reject a transit gateway peering attachment request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectTransitGatewayVpcAttachment",
                "description": "Grants permission to reject a request to attach a VPC to a transit gateway",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-attachment*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectVpcEndpointConnections",
                "description": "Grants permission to reject one or more VPC endpoint connection requests to a VPC endpoint service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectVpcPeeringConnection",
                "description": "Grants permission to reject a VPC peering connection request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-peering-connection*",
                        "condition_keys": [
                            "ec2:AccepterVpc",
                            "ec2:Region",
                            "ec2:RequesterVpc",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReleaseAddress",
                "description": "Grants permission to release an Elastic IP address",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReleaseHosts",
                "description": "Grants permission to release one or more On-Demand Dedicated Hosts",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplaceIamInstanceProfileAssociation",
                "description": "Grants permission to replace an IAM instance profile for an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "ReplaceNetworkAclAssociation",
                "description": "Grants permission to change which network ACL a subnet is associated with",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplaceNetworkAclEntry",
                "description": "Grants permission to replace an entry (rule) in a network ACL",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplaceRoute",
                "description": "Grants permission to replace a route within a route table in a VPC",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplaceRouteTableAssociation",
                "description": "Grants permission to change the route table that is associated with a subnet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplaceTransitGatewayRoute",
                "description": "Grants permission to replace a route in a transit gateway route table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transit-gateway-route-table*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transit-gateway-attachment",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReportInstanceStatus",
                "description": "Grants permission to submit feedback about the status of an instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestSpotFleet",
                "description": "Grants permission to create a Spot Fleet request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestSpotInstances",
                "description": "Grants permission to create a Spot Instance request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetEbsDefaultKmsKeyId",
                "description": "Grants permission to reset the default customer master key (CMK) for EBS encryption for your account to use the AWS-managed CMK for EBS",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetFpgaImageAttribute",
                "description": "Grants permission to reset an attribute of an Amazon FPGA Image (AFI) to its default value",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetImageAttribute",
                "description": "Grants permission to reset an attribute of an Amazon Machine Image (AMI) to its default value",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetInstanceAttribute",
                "description": "Grants permission to reset an attribute of an instance to its default value",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetNetworkInterfaceAttribute",
                "description": "Grants permission to reset an attribute of a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetSnapshotAttribute",
                "description": "Grants permission to reset permission settings for a snapshot",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreAddressToClassic",
                "description": "Grants permission to restore an Elastic IP address that was previously moved to the EC2-VPC platform back to the EC2-Classic platform",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeClientVpnIngress",
                "description": "Grants permission to remove an inbound authorization rule from a Client VPN endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeSecurityGroupEgress",
                "description": "Grants permission to remove one or more outbound rules from a VPC security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeSecurityGroupIngress",
                "description": "Grants permission to remove one or more inbound rules from a security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunInstances",
                "description": "Grants permission to launch one or more instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [
                            "ec2:ImageType",
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Owner",
                            "ec2:Public",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy",
                            "ec2:MetadataHttpEndpoint",
                            "ec2:MetadataHttpTokens",
                            "ec2:MetadataHttpPutResponseHopLimit"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "network-interface*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Region",
                            "ec2:ResourceTag/",
                            "ec2:Subnet",
                            "ec2:Vpc",
                            "ec2:AssociatePublicIpAddress"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subnet*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ec2:AvailabilityZone",
                            "ec2:Encrypted",
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:ParentSnapshot",
                            "ec2:Region",
                            "ec2:VolumeIops",
                            "ec2:VolumeSize",
                            "ec2:VolumeType"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "elastic-gpu",
                        "condition_keys": [
                            "ec2:ElasticGpuType"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "key-pair",
                        "condition_keys": [
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "launch-template",
                        "condition_keys": [
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "placement-group",
                        "condition_keys": [
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:PlacementGroupStrategy",
                            "ec2:Region"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot",
                        "condition_keys": [
                            "ec2:IsLaunchTemplateResource",
                            "ec2:LaunchTemplate",
                            "ec2:Owner",
                            "ec2:ParentVolume",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:SnapshotTime",
                            "ec2:VolumeSize"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunScheduledInstances",
                "description": "Grants permission to launch one or more Scheduled Instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchLocalGatewayRoutes",
                "description": "Grants permission to search for routes in a local gateway route table",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchTransitGatewayMulticastGroups",
                "description": "Grants permission to search for groups, sources, and members in a transit gateway multicast domain",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchTransitGatewayRoutes",
                "description": "Grants permission to search for routes in a transit gateway route table",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendDiagnosticInterrupt",
                "description": "Grants permission to send a diagnostic interrupt to an Amazon EC2 instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartInstances",
                "description": "Grants permission to start a stopped instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartVpcEndpointServicePrivateDnsVerification",
                "description": "Grants permission to start the private DNS verification process for a VPC endpoint service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vpc-endpoint-service*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopInstances",
                "description": "Grants permission to stop an Amazon EBS-backed instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateClientVpnConnections",
                "description": "Grants permission to terminate active Client VPN endpoint connections",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client-vpn-endpoint*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateInstances",
                "description": "Grants permission to shut down one or more instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [
                            "ec2:AvailabilityZone",
                            "ec2:EbsOptimized",
                            "ec2:InstanceProfile",
                            "ec2:InstanceType",
                            "ec2:PlacementGroup",
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:RootDeviceType",
                            "ec2:Tenancy"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnassignIpv6Addresses",
                "description": "Grants permission to unassign one or more IPv6 addresses from a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnassignPrivateIpAddresses",
                "description": "Grants permission to unassign one or more secondary private IP addresses from a network interface",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnmonitorInstances",
                "description": "Grants permission to disable detailed monitoring for a running instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSecurityGroupRuleDescriptionsEgress",
                "description": "Grants permission to update descriptions for one or more outbound rules in a VPC security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSecurityGroupRuleDescriptionsIngress",
                "description": "Grants permission to update descriptions for one or more inbound rules in a security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "security-group*",
                        "condition_keys": [
                            "ec2:Region",
                            "ec2:ResourceTag/${TagKey}",
                            "ec2:Vpc"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "WithdrawByoipCidr",
                "description": "Grants permission to stop advertising an address range that was provisioned for use in AWS through bring your own IP addresses (BYOIP)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "capacity-reservation",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation/${CapacityReservationId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "client-vpn-endpoint",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:client-vpn-endpoint/${ClientVpnEndpointId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "customer-gateway",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:customer-gateway/${CustomerGatewayId}",
                "condition_keys": [
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dedicated-host",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:dedicated-host/${HostId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AutoPlacement",
                    "ec2:AvailabilityZone",
                    "ec2:HostRecovery",
                    "ec2:InstanceType",
                    "ec2:Quantity",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dhcp-options",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:dhcp-options/${DhcpOptionsId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "elastic-gpu",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:elasticGpu/${ElasticGpuId}",
                "condition_keys": []
            },
            {
                "resource": "fpga-image",
                "arn": "arn:${Partition}:ec2:${Region}::fpga-image/${FpgaImageId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Owner",
                    "ec2:Public",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "image",
                "arn": "arn:${Partition}:ec2:${Region}::image/${ImageId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:ImageType",
                    "ec2:Owner",
                    "ec2:Public",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:RootDeviceType"
                ]
            },
            {
                "resource": "instance",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AvailabilityZone",
                    "ec2:EbsOptimized",
                    "ec2:InstanceProfile",
                    "ec2:InstanceType",
                    "ec2:PlacementGroup",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:RootDeviceType",
                    "ec2:Tenancy"
                ]
            },
            {
                "resource": "internet-gateway",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:internet-gateway/${InternetGatewayId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "key-pair",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:key-pair/${KeyPairName}",
                "condition_keys": [
                    "ec2:Region"
                ]
            },
            {
                "resource": "launch-template",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:launch-template/${LaunchTemplateId}",
                "condition_keys": [
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "local-gateway",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:local-gateway/${LocalGatewayId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "local-gateway-route-table",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table/${LocalGatewayRouteTableId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "local-gateway-route-table-virtual-interface-group-association",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-virtual-interface-group-association/${LocalGatewayRouteTableVirtualInterfaceGroupAssociationId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "local-gateway-route-table-vpc-association",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-vpc-association/${LocalGatewayRouteTableVpcAssociationId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "local-gateway-virtual-interface",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface/${LocalGatewayVirtualInterfaceId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "local-gateway-virtual-interface-group",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface-group/${LocalGatewayVirtualInterfaceGroupId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "network-acl",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:network-acl/${NaclId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Vpc"
                ]
            },
            {
                "resource": "network-interface",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:network-interface/${NetworkInterfaceId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AssociatePublicIpAddress",
                    "ec2:AuthorizedService",
                    "ec2:AvailabilityZone",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Subnet",
                    "ec2:Vpc"
                ]
            },
            {
                "resource": "placement-group",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:placement-group/${PlacementGroupName}",
                "condition_keys": [
                    "ec2:PlacementGroupStrategy",
                    "ec2:Region"
                ]
            },
            {
                "resource": "reserved-instances",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:reserved-instances/${ReservationId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AvailabilityZone",
                    "ec2:InstanceType",
                    "ec2:Region",
                    "ec2:ReservedInstancesOfferingType",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Tenancy"
                ]
            },
            {
                "resource": "route-table",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:route-table/${RouteTableId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Vpc"
                ]
            },
            {
                "resource": "security-group",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:security-group/${SecurityGroupId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Vpc"
                ]
            },
            {
                "resource": "snapshot",
                "arn": "arn:${Partition}:ec2:${Region}::snapshot/${SnapshotId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Owner",
                    "ec2:ParentVolume",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:SnapshotTime",
                    "ec2:VolumeSize"
                ]
            },
            {
                "resource": "spot-instance-request",
                "arn": "arn:${Partition}:ec2:${Region}::spot-instances-request/${SpotInstanceRequestId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "subnet",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:subnet/${SubnetId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AvailabilityZone",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Vpc"
                ]
            },
            {
                "resource": "traffic-mirror-session",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-session/${TrafficMirrorSessionId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "traffic-mirror-target",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-target/${TrafficMirrorTargetId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "traffic-mirror-filter",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-filter/${TrafficMirrorFilterId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "traffic-mirror-filter-rule",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-filter-rule/${TrafficMirrorFilterRuleId}",
                "condition_keys": [
                    "ec2:Region"
                ]
            },
            {
                "resource": "transit-gateway-attachment",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-attachment/${TransitGatewayAttachmentId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "transit-gateway-multicast-domain",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-multicast-domain/${TransitGatewayMulticastDomainId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "transit-gateway-route-table",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-route-table/${TransitGatewayRouteTableId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "transit-gateway",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:transit-gateway/${TransitGatewayId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "volume",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:volume/${VolumeId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AvailabilityZone",
                    "ec2:Encrypted",
                    "ec2:ParentSnapshot",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:VolumeIops",
                    "ec2:VolumeSize",
                    "ec2:VolumeType"
                ]
            },
            {
                "resource": "vpc",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpc/${VpcId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:Tenancy"
                ]
            },
            {
                "resource": "vpc-endpoint",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint/${VpceId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:VpceServiceName",
                    "ec2:VpceServiceOwner"
                ]
            },
            {
                "resource": "vpc-endpoint-service",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-service/${VpceServiceId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:VpceServicePrivateDnsName"
                ]
            },
            {
                "resource": "vpc-flow-log",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpc-flow-log/${VpcFlowLogId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:Region",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "vpc-peering-connection",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpc-peering-connection/${VpcPeeringConnectionId}",
                "condition_keys": [
                    "ec2:AccepterVpc",
                    "ec2:Region",
                    "ec2:RequesterVpc",
                    "ec2:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "vpn-connection",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpn-connection/${VpnConnectionId}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "ec2:AuthenticationType",
                    "ec2:DPDTimeoutSeconds",
                    "ec2:GatewayType",
                    "ec2:IKEVersions",
                    "ec2:InsideTunnelCidr",
                    "ec2:Phase1DHGroupNumbers",
                    "ec2:Phase1EncryptionAlgorithms",
                    "ec2:Phase1IntegrityAlgorithms",
                    "ec2:Phase1LifetimeSeconds",
                    "ec2:Phase2DHGroupNumbers",
                    "ec2:Phase2EncryptionAlgorithms",
                    "ec2:Phase2IntegrityAlgorithms",
                    "ec2:Phase2LifetimeSeconds",
                    "ec2:PresharedKeys",
                    "ec2:Region",
                    "ec2:RekeyFuzzPercentage",
                    "ec2:RekeyMarginTimeSeconds",
                    "ec2:ResourceTag/${TagKey}",
                    "ec2:RoutingType"
                ]
            },
            {
                "resource": "vpn-gateway",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:vpn-gateway/${VpnGatewayId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access by a tag key and value pair that is allowed in the request",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by a list of tag keys that are allowed in the request",
                "type": "String"
            },
            {
                "condition": "ec2:AccepterVpc",
                "description": "Filters access by the ARN of an accepter VPC in a VPC peering connection",
                "type": "ARN"
            },
            {
                "condition": "ec2:AssociatePublicIpAddress",
                "description": "Filters access by whether the user wants to associate a public IP address with the instance",
                "type": "Bool"
            },
            {
                "condition": "ec2:AuthenticationType",
                "description": "Filters access by the authentication type for the VPN tunnel endpoints",
                "type": "String"
            },
            {
                "condition": "ec2:AuthorizedService",
                "description": "Filters access by the AWS service that has permission to use a resource",
                "type": "String"
            },
            {
                "condition": "ec2:AuthorizedUser",
                "description": "Filters access by an IAM principal that has permission to use a resource",
                "type": "String"
            },
            {
                "condition": "ec2:AutoPlacement",
                "description": "Filters access by the Auto Placement properties of a Dedicated Host",
                "type": "String"
            },
            {
                "condition": "ec2:AvailabilityZone",
                "description": "Filters access by the name of an Availability Zone in an AWS Region",
                "type": "String"
            },
            {
                "condition": "ec2:CreateAction",
                "description": "Filters access by the name of a resource-creating API action",
                "type": "String"
            },
            {
                "condition": "ec2:DPDTimeoutSeconds",
                "description": "Filters access by the duration after which DPD timeout occurs on a VPN tunnel",
                "type": "Numeric"
            },
            {
                "condition": "ec2:EbsOptimized",
                "description": "Filters access by whether the instance is enabled for EBS optimization",
                "type": "Bool"
            },
            {
                "condition": "ec2:ElasticGpuType",
                "description": "Filters access by the type of Elastic Graphics accelerator",
                "type": "String"
            },
            {
                "condition": "ec2:Encrypted",
                "description": "Filters access by whether the EBS volume is encrypted",
                "type": "Bool"
            },
            {
                "condition": "ec2:GatewayType",
                "description": "Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection",
                "type": "String"
            },
            {
                "condition": "ec2:HostRecovery",
                "description": "Filters access by whether host recovery is enabled for a Dedicated Host",
                "type": "String"
            },
            {
                "condition": "ec2:IKEVersions",
                "description": "Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel",
                "type": "String"
            },
            {
                "condition": "ec2:ImageType",
                "description": "Filters access by the type of image (machine, aki, or ari)",
                "type": "String"
            },
            {
                "condition": "ec2:InsideTunnelCidr",
                "description": "Filters access by the range of inside IP addresses for a VPN tunnel",
                "type": "String"
            },
            {
                "condition": "ec2:InstanceMarketType",
                "description": "Filters access by the market or purchasing option of an instance (on-demand or spot)",
                "type": "String"
            },
            {
                "condition": "ec2:InstanceProfile",
                "description": "Filters access by the ARN of an instance profile",
                "type": "ARN"
            },
            {
                "condition": "ec2:InstanceType",
                "description": "Filters access by the type of instance",
                "type": "String"
            },
            {
                "condition": "ec2:IsLaunchTemplateResource",
                "description": "Filters access by whether users are able to override resources that are specified in the launch template",
                "type": "Bool"
            },
            {
                "condition": "ec2:LaunchTemplate",
                "description": "Filters access by the ARN of a launch template",
                "type": "ARN"
            },
            {
                "condition": "ec2:MetadataHttpEndpoint",
                "description": "Filters access by whether the HTTP endpoint is enabled for the instance metadata service",
                "type": "String"
            },
            {
                "condition": "ec2:MetadataHttpPutResponseHopLimit",
                "description": "Filters access by the allowed number of hops when calling the instance metadata service",
                "type": "Numeric"
            },
            {
                "condition": "ec2:MetadataHttpTokens",
                "description": "Filters access by whether tokens are required when calling the instance metadata service (optional or required)",
                "type": "String"
            },
            {
                "condition": "ec2:Owner",
                "description": "Filters access by the owner of the resource (amazon, aws-marketplace, or an AWS account ID)",
                "type": "String"
            },
            {
                "condition": "ec2:ParentSnapshot",
                "description": "Filters access by the ARN of the parent snapshot",
                "type": "ARN"
            },
            {
                "condition": "ec2:ParentVolume",
                "description": "Filters access by the ARN of the parent volume from which the snapshot was created",
                "type": "ARN"
            },
            {
                "condition": "ec2:Permission",
                "description": "Filters access by the type of permission for a resource (INSTANCE-ATTACH or EIP-ASSOCIATE)",
                "type": "String"
            },
            {
                "condition": "ec2:Phase1DHGroupNumbers",
                "description": "Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations",
                "type": "Numeric"
            },
            {
                "condition": "ec2:Phase1EncryptionAlgorithms",
                "description": "Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations",
                "type": "String"
            },
            {
                "condition": "ec2:Phase1IntegrityAlgorithms",
                "description": "Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations",
                "type": "String"
            },
            {
                "condition": "ec2:Phase1LifetimeSeconds",
                "description": "Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel",
                "type": "Numeric"
            },
            {
                "condition": "ec2:Phase2DHGroupNumbers",
                "description": "Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations",
                "type": "Numeric"
            },
            {
                "condition": "ec2:Phase2EncryptionAlgorithms",
                "description": "Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations",
                "type": "String"
            },
            {
                "condition": "ec2:Phase2IntegrityAlgorithms",
                "description": "Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations",
                "type": "String"
            },
            {
                "condition": "ec2:Phase2LifetimeSeconds",
                "description": "Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel",
                "type": "Numeric"
            },
            {
                "condition": "ec2:PlacementGroup",
                "description": "Filters access by the ARN of the placement group",
                "type": "ARN"
            },
            {
                "condition": "ec2:PlacementGroupStrategy",
                "description": "Filters access by the instance placement strategy used by the placement group (cluster, spread, or partition)",
                "type": "String"
            },
            {
                "condition": "ec2:PresharedKeys",
                "description": "Filters access by the pre-shared key (PSK) used to establish the initial IKE security association between a virtual private gateway and a customer gateway",
                "type": "String"
            },
            {
                "condition": "ec2:ProductCode",
                "description": "Filters access by the product code that is associated with the AMI",
                "type": "String"
            },
            {
                "condition": "ec2:Public",
                "description": "Filters access by whether the image has public launch permissions",
                "type": "Bool"
            },
            {
                "condition": "ec2:Quantity",
                "description": "Filters access by the number of Dedicated Hosts in a request",
                "type": "Numeric"
            },
            {
                "condition": "ec2:Region",
                "description": "Filters access by the name of the AWS Region",
                "type": "String"
            },
            {
                "condition": "ec2:RekeyFuzzPercentage",
                "description": "Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel",
                "type": "Numeric"
            },
            {
                "condition": "ec2:RekeyMarginTimeSeconds",
                "description": "Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel",
                "type": "Numeric"
            },
            {
                "condition": "ec2:RequesterVpc",
                "description": "Filters access by the ARN of a requester VPC in a VPC peering connection",
                "type": "ARN"
            },
            {
                "condition": "ec2:ReservedInstancesOfferingType",
                "description": "Filters access by the payment option of the Reserved Instance offering (No Upfront, Partial Upfront, or All Upfront)",
                "type": "String"
            },
            {
                "condition": "ec2:ResourceTag/",
                "description": "Filters access by the preface string for a tag key and value pair that are attached to a resource",
                "type": "String"
            },
            {
                "condition": "ec2:ResourceTag/${TagKey}",
                "description": "Filters access by a tag key and value pair of a resource",
                "type": "String"
            },
            {
                "condition": "ec2:RoleDelivery",
                "description": "Filters access by the version of the instance metadata service for retrieving IAM role credentials for EC2",
                "type": "Numeric"
            },
            {
                "condition": "ec2:RootDeviceType",
                "description": "Filters access by the root device type of the instance (ebs or instance-store)",
                "type": "String"
            },
            {
                "condition": "ec2:RoutingType",
                "description": "Filters access by the routing type for the VPN connection",
                "type": "String"
            },
            {
                "condition": "ec2:SnapshotTime",
                "description": "Filters access by the initiation time of a snapshot",
                "type": "String"
            },
            {
                "condition": "ec2:SourceInstanceARN",
                "description": "Filters access by the ARN of the instance from which the request originated",
                "type": "ARN"
            },
            {
                "condition": "ec2:Subnet",
                "description": "Filters access by the ARN of the subnet",
                "type": "ARN"
            },
            {
                "condition": "ec2:Tenancy",
                "description": "Filters access by the tenancy of the VPC or instance (default, dedicated, or host)",
                "type": "String"
            },
            {
                "condition": "ec2:VolumeIops",
                "description": "Filters access by the the number of input/output operations per second (IOPS) provisioned for the volume",
                "type": "Numeric"
            },
            {
                "condition": "ec2:VolumeSize",
                "description": "Filters access by the size of the volume, in GiB.",
                "type": "Numeric"
            },
            {
                "condition": "ec2:VolumeType",
                "description": "Filters access by the type of volume (gp2, io1, st1, sc1, or standard)",
                "type": "String"
            },
            {
                "condition": "ec2:Vpc",
                "description": "Filters access by the ARN of the VPC",
                "type": "ARN"
            },
            {
                "condition": "ec2:VpceServiceName",
                "description": "Filters access by the name of the VPC endpoint service",
                "type": "String"
            },
            {
                "condition": "ec2:VpceServiceOwner",
                "description": "Filters access by the service owner of the VPC endpoint service (amazon, aws-marketplace, or an AWS account ID)",
                "type": "String"
            },
            {
                "condition": "ec2:VpceServicePrivateDnsName",
                "description": "Filters access by the private DNS name of the VPC endpoint service",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon EC2 Instance Connect",
        "prefix": "ec2-instance-connect",
        "privileges": [
            {
                "privilege": "SendSSHPublicKey",
                "description": "Grants permission to push the SSH public key to the instance metadata where it remains for 60 seconds.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ec2:osuser"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "instance",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "ec2:osuser",
                "description": "Filters access by specifying the default user name for the AMI that you used to launch your instance",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Message Delivery Service",
        "prefix": "ec2messages",
        "privileges": [
            {
                "privilege": "AcknowledgeMessage",
                "description": "Acknowledges a message, ensuring it will not be delivered again",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMessage",
                "description": "Deletes a message",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "FailMessage",
                "description": "Fails a message, signifying the message could not be processed successfully, ensuring it cannot be replied to or delivered again",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEndpoint",
                "description": "Routes traffic to the correct endpoint based on the given destination for the messages",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMessages",
                "description": "Delivers messages to clients/instances using long polling",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendReply",
                "description": "Sends replies from clients/instances to upstream service",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Elastic Container Registry",
        "prefix": "ecr",
        "privileges": [
            {
                "privilege": "BatchCheckLayerAvailability",
                "description": "Grants permission to check the availability of multiple image layers in a specified registry and repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteImage",
                "description": "Grants permission to delete a list of specified images within a specified repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetImage",
                "description": "Grants permission to get detailed information for specified images within a specified repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteLayerUpload",
                "description": "Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRepository",
                "description": "Grants permission to create an image repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLifecyclePolicy",
                "description": "Grants permission to delete the specified lifecycle policy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRepository",
                "description": "Grants permission to delete an existing image repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRepositoryPolicy",
                "description": "Grants permission to delete the repository policy from a specified repository",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImageScanFindings",
                "description": "Grants permission to describe the image scan findings for the specified image",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeImages",
                "description": "Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRepositories",
                "description": "Grants permission to describe image repositories in a registry",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "repository",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAuthorizationToken",
                "description": "Grants permission to retrieve a token that is valid for a specified registry for 12 hours",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDownloadUrlForLayer",
                "description": "Grants permission to retrieve the download URL corresponding to an image layer",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLifecyclePolicy",
                "description": "Grants permission to retrieve the specified lifecycle policy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLifecyclePolicyPreview",
                "description": "Grants permission to retrieve the results of the specified lifecycle policy preview request",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRepositoryPolicy",
                "description": "Grants permission to retrieve the repository policy for a specified repository",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateLayerUpload",
                "description": "Grants permission to notify Amazon ECR that you intend to upload an image layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListImages",
                "description": "Grants permission to list all the image IDs for a given repository",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags for an Amazon ECR resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutImage",
                "description": "Grants permission to create or update the image manifest associated with an image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutImageScanningConfiguration",
                "description": "Grants permission to update the image scanning configuration for a repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutImageTagMutability",
                "description": "Grants permission to update the image tag mutability settings for a repository",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLifecyclePolicy",
                "description": "Grants permission to create or update a lifecycle policy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetRepositoryPolicy",
                "description": "Grants permission to apply a repository policy on a specified repository to control access permissions",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartImageScan",
                "description": "Grants permission to start an image scan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartLifecyclePolicyPreview",
                "description": "Grants permission to start a preview of the specified lifecycle policy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag an Amazon ECR resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag an Amazon ECR resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadLayerPart",
                "description": "Grants permission to upload an image layer part to Amazon ECR",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "repository",
                "arn": "arn:${Partition}:ecr:${Region}:${Account}:repository/${RepositoryName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecr:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            },
            {
                "condition": "ecr:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic Container Service",
        "prefix": "ecs",
        "privileges": [
            {
                "privilege": "CreateCluster",
                "description": "Creates a new Amazon ECS cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateService",
                "description": "Runs and maintains a desired number of tasks from a specified task definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:task-definition",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTaskSet",
                "description": "Creates a new Amazon ECS task set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:service",
                            "ecs:task-definition"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccountSetting",
                "description": "Modifies the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are disabled for new resources that are created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAttributes",
                "description": "Deletes one or more custom attributes from an Amazon ECS resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCluster",
                "description": "Deletes the specified cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteService",
                "description": "Deletes a specified service within a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTaskSet",
                "description": "Deletes the specified task set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterContainerInstance",
                "description": "Deregisters an Amazon ECS container instance from the specified cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTaskDefinition",
                "description": "Deregisters the specified task definition by family and revision.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusters",
                "description": "Describes one or more of your clusters.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeContainerInstances",
                "description": "Describes Amazon ECS container instances.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServices",
                "description": "Describes the specified services running in your cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTaskDefinition",
                "description": "Describes a task definition. You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTaskSets",
                "description": "Describes Amazon ECS task sets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "task-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTasks",
                "description": "Describes a specified task or tasks.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DiscoverPollEndpoint",
                "description": "Returns an endpoint for the Amazon ECS agent to poll for updates.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccountSettings",
                "description": "Lists the account settings for an Amazon ECS resource for a specified principal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttributes",
                "description": "Lists the attributes for Amazon ECS resources within a specified target type and cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusters",
                "description": "Returns a list of existing clusters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListContainerInstances",
                "description": "Returns a list of container instances in a specified cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServices",
                "description": "Lists the services that are running in a specified cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags for the specified resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "container-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task-definition",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTaskDefinitionFamilies",
                "description": "Returns a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTaskDefinitions",
                "description": "Returns a list of task definitions that are registered to your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTasks",
                "description": "Returns a list of tasks for a specified cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Poll",
                "description": "Grants permission to an agent to connect with the Amazon ECS service to report status and get commands.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccountSetting",
                "description": "Modifies the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are enabled for new resources that are created. Enabling this setting is required to use new Amazon ECS features such as resource tagging.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccountSettingDefault",
                "description": "Modifies the ARN and resource ID format of a resource type for all IAM users on an account for which no individual account setting has been set. Enabling this setting is required to use new Amazon ECS features such as resource tagging.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAttributes",
                "description": "Create or update an attribute on an Amazon ECS resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterContainerInstance",
                "description": "Registers an EC2 instance into the specified cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTaskDefinition",
                "description": "Registers a new task definition from the supplied family and containerDefinitions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunTask",
                "description": "Start a task using random placement and the default Amazon ECS scheduler.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTask",
                "description": "Starts a new task from the specified task definition on the specified container instance or instances.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:container-instances",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTelemetrySession",
                "description": "Grants permission to start a telemetry session.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTask",
                "description": "Stops a running task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubmitAttachmentStateChanges",
                "description": "Sent to acknowledge that attachments changed states.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubmitContainerStateChange",
                "description": "Sent to acknowledge that a container changed states.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubmitTaskStateChange",
                "description": "Sent to acknowledge that a task changed states.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "container-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "service",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task-definition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untags the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "container-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "service",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task-definition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateContainerAgent",
                "description": "Updates the Amazon ECS container agent on a specified container instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateContainerInstancesState",
                "description": "Enables the user to modify the status of an Amazon ECS container instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "container-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateService",
                "description": "Modifies the desired count, deployment configuration, or task definition used in a service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:task-definition"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServicePrimaryTaskSet",
                "description": "Modifies the primary task set used in a service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTaskSet",
                "description": "Updates the specified task set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ecs:cluster",
                            "ecs:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:ecs:${Region}:${Account}:cluster/${ClusterName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecs:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "container-instance",
                "arn": "arn:${Partition}:ecs:${Region}:${Account}:container-instance/${ContainerInstanceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecs:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "service",
                "arn": "arn:${Partition}:ecs:${Region}:${Account}:service/${ServiceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecs:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "task",
                "arn": "arn:${Partition}:ecs:${Region}:${Account}:task/${TaskId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecs:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "task-definition",
                "arn": "arn:${Partition}:ecs:${Region}:${Account}:task-definition/${TaskDefinitionFamilyName}:${TaskDefinitionRevisionNumber}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecs:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "task-set",
                "arn": "arn:${Partition}:ecs:${region}:${Account}:task-set/${ClusterName}/${ServiceName}/${TaskSetId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ecs:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            },
            {
                "condition": "ecs:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "ecs:cluster",
                "description": "The ARN of an ECS cluster.",
                "type": "ARN"
            },
            {
                "condition": "ecs:container-instances",
                "description": "The ARN of an ECS container instance.",
                "type": "ARN"
            },
            {
                "condition": "ecs:service",
                "description": "The ARN of an ECS service.",
                "type": "ARN"
            },
            {
                "condition": "ecs:task-definition",
                "description": "The ARN of an ECS task definition.",
                "type": "ARN"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic Container Service for Kubernetes",
        "prefix": "eks",
        "privileges": [
            {
                "privilege": "CreateCluster",
                "description": "Creates an Amazon EKS cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFargateProfile",
                "description": "Creates an AWS Fargate profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNodegroup",
                "description": "Creates an Amazon EKS Nodegroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCluster",
                "description": "Deletes an Amazon EKS cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFargateProfile",
                "description": "Deletes an AWS Fargate profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fargateprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNodegroup",
                "description": "Deletes an Amazon EKS Nodegroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "nodegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCluster",
                "description": "Returns descriptive information about an Amazon EKS cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFargateProfile",
                "description": "Returns descriptive information about an AWS Fargate profile associated with a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fargateprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNodegroup",
                "description": "Returns descriptive information about an Amazon EKS nodegroup.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "nodegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUpdate",
                "description": "Describes a given update for a given Amazon EKS cluster/nodegroup (in the specified or default region).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "nodegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusters",
                "description": "Lists the Amazon EKS clusters in your AWS account (in the specified or default region).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFargateProfiles",
                "description": "Lists the AWS Fargate profiles in your AWS account (in the specified or default region) associated with a given cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNodegroups",
                "description": "Lists the Amazon EKS nodegroups in your AWS account (in the specified or default region) attached to given cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags for the specified resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fargateprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "nodegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUpdates",
                "description": "Lists the updates for a given Amazon EKS cluster/nodegroup (in the specified or default region).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "nodegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fargateprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "nodegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untags the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fargateprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "nodegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateClusterConfig",
                "description": "Update Amazon EKS cluster configurations (eg: API server endpoint access).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateClusterVersion",
                "description": "Update the Kubernetes version of an Amazon EKS cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNodegroupConfig",
                "description": "Update Amazon EKS nodegroup configurations (eg: min/max/desired capacity or labels).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "nodegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNodegroupVersion",
                "description": "Update the Kubernetes version of an Amazon EKS nodegroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "nodegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:eks:${Region}:${Account}:cluster/${ClusterName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "nodegroup",
                "arn": "arn:${Partition}:eks:${Region}:${Account}:nodegroup/${ClusterName}/${NodegroupName}/${UUID}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "fargateprofile",
                "arn": "arn:${Partition}:eks:${Region}:${Account}:fargateprofile/${ClusterName}/${FargateProfileName}/${UUID}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access by a key that is present in the request the user makes to the EKS service.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access by a tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by the list of all the tag key names present in the request the user makes to the EKS service.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic Inference",
        "prefix": "elastic-inference",
        "privileges": [
            {
                "privilege": "Connect",
                "description": "Connects customer to Elastic Inference accelerator",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "accelerator",
                "arn": "arn:${Partition}:elastic-inference:${Region}:${Account}:elastic-inference-accelerator/${AcceleratorId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon ElastiCache",
        "prefix": "elasticache",
        "privileges": [
            {
                "privilege": "AddTagsToResource",
                "description": "The AddTagsToResource action adds up to 10 cost allocation tags to the named resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeCacheSecurityGroupIngress",
                "description": "The AuthorizeCacheSecurityGroupIngress action allows network ingress to a cache security group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:AuthorizeSecurityGroupIngress"
                        ]
                    }
                ]
            },
            {
                "privilege": "CopySnapshot",
                "description": "The CopySnapshot action makes a copy of an existing snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:DeleteObject",
                            "s3:GetBucketAcl",
                            "s3:PutObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateCacheCluster",
                "description": "The CreateCacheCluster action creates a cache cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs",
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateCacheParameterGroup",
                "description": "The CreateCacheParameterGroup action creates a new cache parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCacheSecurityGroup",
                "description": "The CreateCacheSecurityGroup action creates a new cache security group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCacheSubnetGroup",
                "description": "The CreateCacheSubnetGroup action creates a new cache subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReplicationGroup",
                "description": "The CreateReplicationGroup action creates a replication group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs",
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateSnapshot",
                "description": "The CreateSnapshot action creates a copy of an entire cache cluster at a specific moment in time.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DecreaseReplicaCount",
                "description": "The DecreaseReplicaCount action decreases the number of replicas in a Redis replication group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteCacheCluster",
                "description": "The DeleteCacheCluster action deletes a previously provisioned cache cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCacheParameterGroup",
                "description": "The DeleteCacheParameterGroup action deletes the specified cache parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCacheSecurityGroup",
                "description": "The DeleteCacheSecurityGroup action deletes a cache security group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCacheSubnetGroup",
                "description": "The DeleteCacheSubnetGroup action deletes a cache subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReplicationGroup",
                "description": "The DeleteReplicationGroup action deletes an existing replication group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSnapshot",
                "description": "The DeleteSnapshot action deletes an existing snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCacheClusters",
                "description": "The DescribeCacheClusters action returns information about all provisioned cache clusters if no cache cluster identifier is specified, or about a specific cache cluster if a cache cluster identifier is supplied.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCacheEngineVersions",
                "description": "The DescribeCacheEngineVersions action returns a list of the available cache engines and their versions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCacheParameterGroups",
                "description": "The DescribeCacheParameterGroups action returns a list of cache parameter group descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCacheParameters",
                "description": "The DescribeCacheParameters action returns the detailed parameter list for a particular cache parameter group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCacheSecurityGroups",
                "description": "The DescribeCacheSecurityGroups action returns a list of cache security group descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCacheSubnetGroups",
                "description": "The DescribeCacheSubnetGroups action returns a list of cache subnet group descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEngineDefaultParameters",
                "description": "The DescribeEngineDefaultParameters action returns the default engine and system parameter information for the specified cache engine.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "The DescribeEvents action returns events related to cache clusters, cache security groups, and cache parameter groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReplicationGroups",
                "description": "The DescribeReplicationGroups action returns information about a particular replication group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedCacheNodes",
                "description": "The DescribeReservedCacheNodes action returns information about reserved cache nodes for this account, or about a specified reserved cache node.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedCacheNodesOfferings",
                "description": "The DescribeReservedCacheNodesOfferings action lists available reserved cache node offerings.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshots",
                "description": "The DescribeSnapshots action returns information about cache cluster snapshots.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IncreaseReplicaCount",
                "description": "The IncreaseReplicaCount action increases the number of replicas in a Redis replication group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            },
            {
                "privilege": "ListAllowedNodeTypeModifications",
                "description": "List Allowed Node Type Modifications",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "The ListTagsForResource action lists all cost allocation tags currently on the named resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCacheCluster",
                "description": "The ModifyCacheCluster action modifies the settings for a cache cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCacheParameterGroup",
                "description": "The ModifyCacheParameterGroup action modifies the parameters of a cache parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCacheSubnetGroup",
                "description": "The ModifyCacheSubnetGroup action modifies an existing cache subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReplicationGroup",
                "description": "The ModifyReplicationGroup action modifies the settings for a replication group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyReplicationGroupShardConfiguration",
                "description": "The ModifyReplicationGroupShardConfiguration action allows you to add shards, remove shards, or rebalance the keyspaces among exisiting shards.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            },
            {
                "privilege": "PurchaseReservedCacheNodesOffering",
                "description": "The PurchaseReservedCacheNodesOffering action allows you to purchase a reserved cache node offering.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootCacheCluster",
                "description": "The RebootCacheCluster action reboots some, or all, of the cache nodes within a provisioned cache cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "The RemoveTagsFromResource action removes the tags identified by the TagKeys list from the named resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetCacheParameterGroup",
                "description": "The ResetCacheParameterGroup action modifies the parameters of a cache parameter group to the engine or system default value.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeCacheSecurityGroupIngress",
                "description": "The RevokeCacheSecurityGroupIngress action revokes ingress from a cache security group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestFailover",
                "description": "The TestFailover action allows you to test automatic failover on a specified node group in a replication group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "ec2:CreateNetworkInterface",
                            "ec2:DeleteNetworkInterface",
                            "ec2:DescribeNetworkInterfaces",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs"
                        ]
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Elastic Beanstalk",
        "prefix": "elasticbeanstalk",
        "privileges": [
            {
                "privilege": "AbortEnvironmentUpdate",
                "description": "Grants permission to cancel in-progress environment configuration update or application version deployment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTags",
                "description": "Grants permission to add tags to an Elastic Beanstalk resource and to update tag values.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "applicationversion",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "platform",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApplyEnvironmentManagedAction",
                "description": "Grants permission to apply a scheduled managed action immediately.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CheckDNSAvailability",
                "description": "Grants permission to check CNAME availability.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ComposeEnvironments",
                "description": "Grants permission to create or update a group of environments, each running a separate component of a single application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "applicationversion*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplication",
                "description": "Grants permission to create a new application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplicationVersion",
                "description": "Grants permission to create an application version for an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "applicationversion*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationTemplate",
                "description": "Grants permission to create a configuration template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configurationtemplate*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticbeanstalk:FromApplication",
                            "elasticbeanstalk:FromApplicationVersion",
                            "elasticbeanstalk:FromConfigurationTemplate",
                            "elasticbeanstalk:FromEnvironment",
                            "elasticbeanstalk:FromSolutionStack",
                            "elasticbeanstalk:FromPlatform",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEnvironment",
                "description": "Grants permission to launch an environment for an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticbeanstalk:FromApplicationVersion",
                            "elasticbeanstalk:FromConfigurationTemplate",
                            "elasticbeanstalk:FromSolutionStack",
                            "elasticbeanstalk:FromPlatform",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlatformVersion",
                "description": "Grants permission to create a new version of a custom platform.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "platform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStorageLocation",
                "description": "Grants permission to create the Amazon S3 storage location for the account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Grants permission to delete an application along with all associated versions and configurations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationVersion",
                "description": "Grants permission to delete an application version from an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applicationversion*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationTemplate",
                "description": "Grants permission to delete a configuration template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configurationtemplate*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEnvironmentConfiguration",
                "description": "Grants permission to delete the draft configuration associated with the running environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePlatformVersion",
                "description": "Grants permission to delete a version of a custom platform.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "platform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAttributes",
                "description": "Grants permission to retrieve a list of account attributes, including resource quotas.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplicationVersions",
                "description": "Grants permission to retrieve a list of application versions stored in an AWS Elastic Beanstalk storage bucket.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "applicationversion",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplications",
                "description": "Grants permission to retrieve the descriptions of existing applications.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationOptions",
                "description": "Grants permission to retrieve descriptions of environment configuration options.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "solutionstack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationSettings",
                "description": "Grants permission to retrieve a description of the settings for a configuration set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironmentHealth",
                "description": "Grants permission to retrieve information about the overall health of an environment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironmentManagedActionHistory",
                "description": "Grants permission to retrieve a list of an environment's completed and failed managed actions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironmentManagedActions",
                "description": "Grants permission to retrieve a list of an environment's upcoming and in-progress managed actions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironmentResources",
                "description": "Grants permission to retrieve a list of AWS resources for an environment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEnvironments",
                "description": "Grants permission to retrieve descriptions for existing environments.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "Grants permission to retrieve a list of event descriptions matching a set of criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "applicationversion",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstancesHealth",
                "description": "Grants permission to retrieve more detailed information about the health of environment instances.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePlatformVersion",
                "description": "Grants permission to retrieve a description of a platform version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "platform",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableSolutionStacks",
                "description": "Grants permission to retrieve a list of the available solution stack names.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "solutionstack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPlatformBranches",
                "description": "Grants permission to retrieve a list of the available platform branches.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPlatformVersions",
                "description": "Grants permission to retrieve a list of the available platforms.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "platform",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to retrieve a list of tags of an Elastic Beanstalk resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "applicationversion",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "platform",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebuildEnvironment",
                "description": "Grants permission to delete and recreate all of the AWS resources for an environment and to force a restart.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Grants permission to remove tags from an Elastic Beanstalk resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "applicationversion",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "platform",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestEnvironmentInfo",
                "description": "Grants permission to initiate a request to compile information of the deployed environment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestartAppServer",
                "description": "Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetrieveEnvironmentInfo",
                "description": "Grants permission to retrieve the compiled information from a RequestEnvironmentInfo request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SwapEnvironmentCNAMEs",
                "description": "Grants permission to swap the CNAMEs of two environments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticbeanstalk:FromEnvironment"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateEnvironment",
                "description": "Grants permission to terminate an environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Grants permission to update an application with specified properties.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationResourceLifecycle",
                "description": "Grants permission to update the application version lifecycle policy associated with the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationVersion",
                "description": "Grants permission to update an application version with specified properties.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applicationversion*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationTemplate",
                "description": "Grants permission to update a configuration template with specified properties or configuration option values.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configurationtemplate*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticbeanstalk:FromApplication",
                            "elasticbeanstalk:FromApplicationVersion",
                            "elasticbeanstalk:FromConfigurationTemplate",
                            "elasticbeanstalk:FromEnvironment",
                            "elasticbeanstalk:FromSolutionStack",
                            "elasticbeanstalk:FromPlatform"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEnvironment",
                "description": "Grants permission to update an environment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "environment*",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticbeanstalk:FromApplicationVersion",
                            "elasticbeanstalk:FromConfigurationTemplate",
                            "elasticbeanstalk:FromSolutionStack",
                            "elasticbeanstalk:FromPlatform"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateConfigurationSettings",
                "description": "Grants permission to check the validity of a set of configuration settings for a configuration template or an environment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configurationtemplate",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "environment",
                        "condition_keys": [
                            "elasticbeanstalk:InApplication"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "application",
                "arn": "arn:${Partition}:elasticbeanstalk:${Region}:${Account}:application/${ApplicationName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "applicationversion",
                "arn": "arn:${Partition}:elasticbeanstalk:${Region}:${Account}:applicationversion/${ApplicationName}/${VersionLabel}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "elasticbeanstalk:InApplication"
                ]
            },
            {
                "resource": "configurationtemplate",
                "arn": "arn:${Partition}:elasticbeanstalk:${Region}:${Account}:configurationtemplate/${ApplicationName}/${TemplateName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "elasticbeanstalk:InApplication"
                ]
            },
            {
                "resource": "environment",
                "arn": "arn:${Partition}:elasticbeanstalk:${Region}:${Account}:environment/${ApplicationName}/${EnvironmentName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "elasticbeanstalk:InApplication"
                ]
            },
            {
                "resource": "solutionstack",
                "arn": "arn:${Partition}:elasticbeanstalk:${Region}::solutionstack/${SolutionStackName}",
                "condition_keys": []
            },
            {
                "resource": "platform",
                "arn": "arn:${Partition}:elasticbeanstalk:${Region}::platform/${PlatformNameWithVersion}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request.",
                "type": "String"
            },
            {
                "condition": "elasticbeanstalk:FromApplication",
                "description": "Filters access by an application as a dependency or a constraint on an input parameter.",
                "type": "ARN"
            },
            {
                "condition": "elasticbeanstalk:FromApplicationVersion",
                "description": "Filters access by an application version as a dependency or a constraint on an input parameter.",
                "type": "ARN"
            },
            {
                "condition": "elasticbeanstalk:FromConfigurationTemplate",
                "description": "Filters access by a configuration template as a dependency or a constraint on an input parameter.",
                "type": "ARN"
            },
            {
                "condition": "elasticbeanstalk:FromEnvironment",
                "description": "Filters access by an environment as a dependency or a constraint on an input parameter.",
                "type": "ARN"
            },
            {
                "condition": "elasticbeanstalk:FromPlatform",
                "description": "Filters access by a platform as a dependency or a constraint on an input parameter.",
                "type": "ARN"
            },
            {
                "condition": "elasticbeanstalk:FromSolutionStack",
                "description": "Filters access by a solution stack as a dependency or a constraint on an input parameter.",
                "type": "ARN"
            },
            {
                "condition": "elasticbeanstalk:InApplication",
                "description": "Filters access by the application that contains the resource that the action operates on.",
                "type": "ARN"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic File System",
        "prefix": "elasticfilesystem",
        "privileges": [
            {
                "privilege": "Backup",
                "description": "Starts a backup job for an existing file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ClientMount",
                "description": "Permission for allowing read-access to a file system.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticfilesystem:AccessPointArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ClientRootAccess",
                "description": "Permission for allowing root-access to a file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticfilesystem:AccessPointArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ClientWrite",
                "description": "Permission for allowing write-access to a file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "elasticfilesystem:AccessPointArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccessPoint",
                "description": "Creates an access point for the specified file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFileSystem",
                "description": "Creates a new, empty file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMountTarget",
                "description": "Creates a mount target for a file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Creates or overwrites tags associated with a file system.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccessPoint",
                "description": "Deletes the specified access point.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "access-point*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFileSystem",
                "description": "Deletes a file system, permanently severing access to its contents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFileSystemPolicy",
                "description": "Clears the resource-level policy for a given file system.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMountTarget",
                "description": "Deletes the specified mount target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Deletes the specified tags from a file system.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccessPoints",
                "description": "Returns the descriptions of Amazon EFS access points.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFileSystemPolicy",
                "description": "Returns the current resource-level policy for a given file system.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "file-system",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFileSystems",
                "description": "Returns the description of a specific Amazon EFS file system if either the file system CreationToken or the FileSystemId is provided; otherwise, returns descriptions of all file systems owned by the caller's AWS account in the AWS region of the endpoint that you're calling.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "file-system",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLifecycleConfiguration",
                "description": "Returns the current LifecycleConfiguration object for the specified Amazon EFS file system.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMountTargetSecurityGroups",
                "description": "Returns the security groups currently in effect for a mount target.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMountTargets",
                "description": "Returns the descriptions of all the current mount targets, or a specific mount target, for a file system.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Returns the tags associated with a file system.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Returns the tags associated with the specified Amazon EFS resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyMountTargetSecurityGroups",
                "description": "Modifies the set of security groups in effect for a mount target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutFileSystemPolicy",
                "description": "Apply a resource-level policy granting and/or restricting actions from given actors for the specified file system.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLifecycleConfiguration",
                "description": "Enables lifecycle management by creating a new LifecycleConfiguration object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Restore",
                "description": "Starts a restore job for an existing file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Creates or overwrites tags associated with the specified Amazon EFS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Deletes the specified tags from a specified Amazon EFS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFileSystem",
                "description": "Updates the throughput mode or the amount of provisioned throughput of an existing file system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "file-system",
                "arn": "arn:${Partition}:elasticfilesystem:${Region}:${Account}:file-system/${FileSystemId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "access-point",
                "arn": "arn:${Partition}:elasticfilesystem:${Region}:${Account}:access-point/${AccessPointId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            },
            {
                "condition": "elasticfilesystem:AccessPointArn",
                "description": "The ARN of the access point used to mount the file system",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Elastic Load Balancing V2",
        "prefix": "elasticloadbalancing",
        "privileges": [
            {
                "privilege": "AddListenerCertificates",
                "description": "Adds the specified certificates to the specified secure listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTags",
                "description": "Adds the specified tags to the specified load balancer. Each load balancer can have a maximum of 10 tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "targetgroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateListener",
                "description": "Creates a listener for the specified Application Load Balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoadBalancer",
                "description": "Creates a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRule",
                "description": "Creates a rule for the specified listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTargetGroup",
                "description": "Creates a target group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "targetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteListener",
                "description": "Deletes the specified listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoadBalancer",
                "description": "Deletes the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRule",
                "description": "Deletes the specified rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener-rule/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener-rule/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTargetGroup",
                "description": "Deletes the specified target group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "targetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTargets",
                "description": "Deregisters the specified targets from the specified target group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "targetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountLimits",
                "description": "Describes the Elastic Load Balancing resource limits for the AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeListenerCertificates",
                "description": "Describes the certificates for the specified secure listener.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeListeners",
                "description": "Describes the specified listeners or the listeners for the specified Application Load Balancer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancerAttributes",
                "description": "Describes the attributes for the specified load balancer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancers",
                "description": "Describes the specified the load balancers. If no load balancers are specified, the call describes all of your load balancers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRules",
                "description": "Describes the specified rules or the rules for the specified listener.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSSLPolicies",
                "description": "Describes the specified policies or all policies used for SSL negotiation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Describes the tags associated with the specified load balancers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTargetGroupAttributes",
                "description": "Describes the attributes for the specified target group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTargetGroups",
                "description": "Describes the specified target groups or all of your target groups.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTargetHealth",
                "description": "Describes the health of the specified targets or all of your targets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyListener",
                "description": "Modifies the specified properties of the specified listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyLoadBalancerAttributes",
                "description": "Modifies the attributes of the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyRule",
                "description": "Modifies the specified rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener-rule/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener-rule/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyTargetGroup",
                "description": "Modifies the health checks used when evaluating the health state of the targets in the specified target group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "targetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyTargetGroupAttributes",
                "description": "Modifies the specified attributes of the specified target group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "targetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTargets",
                "description": "Registers the specified targets with the specified target group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "targetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveListenerCertificates",
                "description": "Removes the specified certificates of the specified secure listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Removes one or more tags from the specified load balancer.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "targetgroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIpAddressType",
                "description": "Not found",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetRulePriorities",
                "description": "Sets the priorities of the specified rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener-rule/app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "listener-rule/net*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetSecurityGroups",
                "description": "Associates the specified security groups with the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetSubnets",
                "description": "Enables the Availability Zone for the specified subnets for the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/net/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetWebAcl",
                "description": "Gives WebAcl permission to WAF",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "listener/app",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener/app/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}",
                "condition_keys": []
            },
            {
                "resource": "listener-rule/app",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener-rule/app/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}/${ListenerRuleId}",
                "condition_keys": []
            },
            {
                "resource": "listener/net",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener/net/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}",
                "condition_keys": []
            },
            {
                "resource": "listener-rule/net",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener-rule/net/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}/${ListenerRuleId}",
                "condition_keys": []
            },
            {
                "resource": "loadbalancer/app/",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/app/${LoadBalancerName}/${LoadBalancerId}",
                "condition_keys": [
                    "aws:RequestTag/tag-key",
                    "aws:TagKeys",
                    "elasticloadbalancing:ResourceTag/tag-key"
                ]
            },
            {
                "resource": "loadbalancer/net/",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/net/${LoadBalancerName}/${LoadBalancerId}",
                "condition_keys": [
                    "aws:RequestTag/tag-key",
                    "aws:TagKeys",
                    "elasticloadbalancing:ResourceTag/tag-key"
                ]
            },
            {
                "resource": "targetgroup",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:targetgroup/${TargetGroupName}/${TargetGroupId}",
                "condition_keys": [
                    "aws:RequestTag/tag-key",
                    "aws:TagKeys",
                    "elasticloadbalancing:ResourceTag/tag-key"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/tag-key",
                "description": "A key that is present in the request the user makes to the ELB service.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "elasticloadbalancing:ResourceTag/tag-key",
                "description": "A tag key and value pair.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Elastic Load Balancing",
        "prefix": "elasticloadbalancing",
        "privileges": [
            {
                "privilege": "AddTags",
                "description": "Adds the specified tags to the specified load balancer. Each load balancer can have a maximum of 10 tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApplySecurityGroupsToLoadBalancer",
                "description": "Associates one or more security groups with your load balancer in a virtual private cloud (VPC).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachLoadBalancerToSubnets",
                "description": "Adds one or more subnets to the set of configured subnets for the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfigureHealthCheck",
                "description": "Specifies the health check settings to use when evaluating the health state of your back-end instances.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAppCookieStickinessPolicy",
                "description": "Generates a stickiness policy with sticky session lifetimes that follow that of an application-generated cookie.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLBCookieStickinessPolicy",
                "description": "Generates a stickiness policy with sticky session lifetimes controlled by the lifetime of the browser (user-agent) or a specified expiration period.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoadBalancer",
                "description": "Creates a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoadBalancerListeners",
                "description": "Creates one or more listeners for the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoadBalancerPolicy",
                "description": "Creates a policy with the specified attributes for the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoadBalancer",
                "description": "Deletes the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoadBalancerListeners",
                "description": "Deletes the specified listeners from the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoadBalancerPolicy",
                "description": "Deletes the specified policy from the specified load balancer. This policy must not be enabled for any listeners.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterInstancesFromLoadBalancer",
                "description": "Deregisters the specified instances from the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceHealth",
                "description": "Describes the state of the specified instances with respect to the specified load balancer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancerAttributes",
                "description": "Describes the attributes for the specified load balancer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancerPolicies",
                "description": "Describes the specified policies.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancerPolicyTypes",
                "description": "Describes the specified load balancer policy types.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBalancers",
                "description": "Describes the specified the load balancers. If no load balancers are specified, the call describes all of your load balancers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Describes the tags associated with the specified load balancers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachLoadBalancerFromSubnets",
                "description": "Removes the specified subnets from the set of configured subnets for the load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableAvailabilityZonesForLoadBalancer",
                "description": "Removes the specified Availability Zones from the set of Availability Zones for the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableAvailabilityZonesForLoadBalancer",
                "description": "Adds the specified Availability Zones to the set of Availability Zones for the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyLoadBalancerAttributes",
                "description": "Modifies the attributes of the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterInstancesWithLoadBalancer",
                "description": "Adds the specified instances to the specified load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Removes one or more tags from the specified load balancer.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetLoadBalancerListenerSSLCertificate",
                "description": "Sets the certificate that terminates the specified listener's SSL connections.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetLoadBalancerPoliciesForBackendServer",
                "description": "Replaces the set of policies associated with the specified port on which the back-end server is listening with a new set of policies.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetLoadBalancerPoliciesOfListener",
                "description": "Replaces the current set of policies for the specified load balancer port with the specified set of policies.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "listener",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}",
                "condition_keys": []
            },
            {
                "resource": "loadbalancer",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/${LoadBalancerName}",
                "condition_keys": [
                    "aws:RequestTag/tag-key",
                    "aws:TagKeys",
                    "elasticloadbalancing:ResourceTag/tag-key"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/tag-key",
                "description": "A key that is present in the request the user makes to the ELB service.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "elasticloadbalancing:ResourceTag/",
                "description": "The preface string for a tag key and value pair attached to a resource.",
                "type": "String"
            },
            {
                "condition": "elasticloadbalancing:ResourceTag/tag-key",
                "description": "A tag key and value pair.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic MapReduce",
        "prefix": "elasticmapreduce",
        "privileges": [
            {
                "privilege": "AddInstanceFleet",
                "description": "Grants permission to add an instance fleet to a running cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddInstanceGroups",
                "description": "Grants permission to add instance groups to a running cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddJobFlowSteps",
                "description": "Grants permission to add new steps to a running cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTags",
                "description": "Grants permission to add tags to an Amazon EMR resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "editor",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "elasticmapreduce:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelSteps",
                "description": "Grants permission to cancel a pending step or steps in a running cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEditor",
                "description": "Grants permission to create an EMR notebook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "elasticmapreduce:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSecurityConfiguration",
                "description": "Grants permission to create a security configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEditor",
                "description": "Grants permission to delete an EMR notebook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "editor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSecurityConfiguration",
                "description": "Grants permission to delete a security configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCluster",
                "description": "Grants permission to get details about a cluster, including status, hardware and software configuration, VPC settings, and so on.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEditor",
                "description": "Grants permission to view information about a notebook, including status, user, role, tags, location, and more.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "editor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJobFlows",
                "description": "This API is deprecated and will eventually be removed. We recommend you use ListClusters, DescribeCluster, ListSteps, ListInstanceGroups and ListBootstrapActions instead.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSecurityConfiguration",
                "description": "Grants permission to get details of a security configuration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStep",
                "description": "Grants permission to get details about a cluster step.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBlockPublicAccessConfiguration",
                "description": "Grants permission to retrieve the EMR block public access configuration for the AWS account in the Region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBootstrapActions",
                "description": "Grants permission to get details about the bootstrap actions associated with a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusters",
                "description": "Grants permission to get the status of accessible clusters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEditors",
                "description": "Grants permission to list summary information for accessible EMR notebooks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstanceFleets",
                "description": "Grants permission to get details of instance fleets in a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstanceGroups",
                "description": "Grants permission to get details of instance groups in a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstances",
                "description": "Grants permission to get details about the Amazon EC2 instances in a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSecurityConfigurations",
                "description": "Grants permission to list available security configurations in this account by name, along with creation dates and times.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSteps",
                "description": "Grants permission to list steps associated with a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCluster",
                "description": "Grants permission to change cluster settings such as number of steps that can be executed concurrently for a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceFleet",
                "description": "Grants permission to change the target On-Demand and target Spot capacities for a instance fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyInstanceGroups",
                "description": "Grants permission to change the number and configuration of EC2 instances for an instance group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OpenEditorInConsole",
                "description": "Grants permission to launch the Jupyter notebook editor for an EMR notebook from within the console.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "editor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAutoScalingPolicy",
                "description": "Grants permission to create or update an automatic scaling policy for a core instance group or task instance group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBlockPublicAccessConfiguration",
                "description": "Grants permission to create or update the EMR block public access configuration for the AWS account in the Region.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveAutoScalingPolicy",
                "description": "Grants permission to remove an automatic scaling policy from an instance group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Grants permission to remove tags from an Amazon EMR resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "editor",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunJobFlow",
                "description": "Grants permission to create and launch a cluster (job flow).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "elasticmapreduce:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetTerminationProtection",
                "description": "Grants permission to add and remove termination protection for a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartEditor",
                "description": "Grants permission to start an EMR notebook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "editor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopEditor",
                "description": "Grants permission to shut down an EMR notebook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "editor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateJobFlows",
                "description": "Grants permission to terminate a cluster (job flow).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewEventsFromAllClustersInConsole",
                "description": "Grants permission to use the EMR management console to view events from all clusters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:elasticmapreduce:${Region}:${Account}:cluster/${ClusterId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "elasticmapreduce:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "editor",
                "arn": "arn:${Partition}:elasticmapreduce:${Region}:${Account}:editor/${EditorId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "elasticmapreduce:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access based on whether the tag and value pair is provided with the action",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access based on the tag and value pair associated with an Amazon EMR resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access based on whether the tag keys are provided with the action regardless of tag value",
                "type": "String"
            },
            {
                "condition": "elasticmapreduce:RequestTag/${TagKey}",
                "description": "Filters actions based on whether the tag and value pair is provided with the action",
                "type": "String"
            },
            {
                "condition": "elasticmapreduce:ResourceTag/${TagKey}",
                "description": "Filters actions based on the tag and value pair associated with an Amazon EMR resource",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Elastic Transcoder",
        "prefix": "elastictranscoder",
        "privileges": [
            {
                "privilege": "CancelJob",
                "description": "Cancel a job that Elastic Transcoder has not begun to process",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Create a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePipeline",
                "description": "Create a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePreset",
                "description": "Create a preset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePipeline",
                "description": "Delete a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePreset",
                "description": "Delete a preset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobsByPipeline",
                "description": "Get a list of the jobs that you assigned to a pipeline",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobsByStatus",
                "description": "Get information about all of the jobs associated with the current AWS account that have a specified status",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPipelines",
                "description": "Get a list of the pipelines associated with the current AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPresets",
                "description": "Get a list of all presets associated with the current AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReadJob",
                "description": "Get detailed information about a job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReadPipeline",
                "description": "Get detailed information about a pipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReadPreset",
                "description": "Get detailed information about a preset.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestRole",
                "description": "Test the settings for a pipeline to ensure that Elastic Transcoder can create and process jobs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePipeline",
                "description": "Update settings for a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePipelineNotifications",
                "description": "Update only Amazon Simple Notification Service (Amazon SNS) notifications for a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePipelineStatus",
                "description": "Pause or reactivate a pipeline, so the pipeline stops or restarts processing jobs, update the status for the pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "job",
                "arn": "arn:${Partition}:elastictranscoder:${Region}:${Account}:job/${JobId}",
                "condition_keys": []
            },
            {
                "resource": "pipeline",
                "arn": "arn:${Partition}:elastictranscoder:${Region}:${Account}:pipeline/${PipelineId}",
                "condition_keys": []
            },
            {
                "resource": "preset",
                "arn": "arn:${Partition}:elastictranscoder:${Region}:${Account}:preset/${PresetId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Elasticsearch Service",
        "prefix": "es",
        "privileges": [
            {
                "privilege": "AddTags",
                "description": "Grants permission to attach resource tags to an Amazon ES domain.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateElasticsearchDomain",
                "description": "Grants permission to create an Amazon ES domain.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateElasticsearchServiceRole",
                "description": "Grants permission to create the service-linked role required for Amazon ES domains that use VPC access.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteElasticsearchDomain",
                "description": "Grants permission to delete an Amazon ES domain and all of its data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteElasticsearchServiceRole",
                "description": "Grants permission to delete the service-linked role required for Amazon ES domains that use VPC access.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticsearchDomain",
                "description": "Grants permission to view a description of the domain configuration for the specified Amazon ES domain, including the domain ID, domain service endpoint, and domain ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticsearchDomainConfig",
                "description": "Grants permission to view a description of the configuration options and status of an Amazon ES domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticsearchDomains",
                "description": "Grants permission to view a description of the domain configuration for up to five specified Amazon ES domains.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticsearchInstanceTypeLimits",
                "description": "Grants permission to view the instance count, storage, and master node limits for a given Elasticsearch version and instance type.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedElasticsearchInstanceOfferings",
                "description": "Grants permission to fetch reserved instance offerings for ES",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedElasticsearchInstances",
                "description": "Grants permission to fetch ES reserved instances already purchased by customer",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ESHttpDelete",
                "description": "Grants permission to send HTTP DELETE requests to the Elasticsearch APIs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ESHttpGet",
                "description": "Grants permission to send HTTP GET requests to the Elasticsearch APIs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ESHttpHead",
                "description": "Grants permission to send HTTP HEAD requests to the Elasticsearch APIs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ESHttpPatch",
                "description": "Grants permission to send HTTP PATCH requests to the Elasticsearch APIs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ESHttpPost",
                "description": "Grants permission to send HTTP POST requests to the Elasticsearch APIs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ESHttpPut",
                "description": "Grants permission to send HTTP PUT requests to the Elasticsearch APIs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCompatibleElasticsearchVersions",
                "description": "Grants permission to fetch list of compatible elastic search versions to which Amazon ES domain can be upgraded",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUpgradeHistory",
                "description": "Grants permission to fetch upgrade history for given ES domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUpgradeStatus",
                "description": "Grants permission to fetch upgrade status for given ES domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomainNames",
                "description": "Grants permission to display the names of all Amazon ES domains that the current user owns.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListElasticsearchInstanceTypeDetails",
                "description": "Grants permission to list all instance types and available features for a given Elasticsearch version.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListElasticsearchInstanceTypes",
                "description": "Grants permission to list all Elasticsearch instance types that are supported for a given Elasticsearch version.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListElasticsearchVersions",
                "description": "Grants permission to list all supported Elasticsearch versions on Amazon ES.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Grants permission to display all of the tags for an Amazon ES domain.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseReservedElasticsearchInstanceOffering",
                "description": "Grants permission to purchase ES reserved instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTags",
                "description": "Grants permission to remove tags from Amazon ES domains.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateElasticsearchDomainConfig",
                "description": "Grants permission to modify the configuration of an Amazon ES domain, such as the instance type or number of instances.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpgradeElasticsearchDomain",
                "description": "Grants permission to initiate upgrade of elastic search domain to given version",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "domain",
                "arn": "arn:${Partition}:es:${Region}:${Account}:domain/${DomainName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon EventBridge",
        "prefix": "events",
        "privileges": [
            {
                "privilege": "ActivateEventSource",
                "description": "Activates a partner event source that has been deactivated. Once activated, your matching event bus will start receiving events from the event source.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEventBus",
                "description": "Creates a new event bus within your account. This can be a custom event bus which you can use to receive events from your own custom applications and services, or it can be a partner event bus which can be matched to a partner event source.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "event-bus*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePartnerEventSource",
                "description": "Called by an AWS partner to create a partner event source.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeactivateEventSource",
                "description": "Called by an AWS partner to create a partner event source.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventBus",
                "description": "Deletes the specified custom event bus or partner event bus. All rules associated with this event bus are also deleted. You can't delete your account's default event bus.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "event-bus*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePartnerEventSource",
                "description": "Called by an AWS partner to delete a partner event source.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRule",
                "description": "Deletes a rule. You must remove all targets from a rule using RemoveTargets before you can delete the rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventBus",
                "description": "Displays the external AWS accounts that are permitted to write events to your account using your account's event bus, and the associated policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "event-bus",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventSource",
                "description": "Describes the details of the specified partner event source that is shared with your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePartnerEventSource",
                "description": "Called by an AWS partner describe the details of the specified partner event source that they have created.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRule",
                "description": "Describes the details of the specified rule.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableRule",
                "description": "Disables a rule. A disabled rule won't match any events, and won't self-trigger if it has a schedule expression.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableRule",
                "description": "Enables a rule. If the rule does not exist, the operation fails.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEventBuses",
                "description": "Lists all the event buses in your account, including the default event bus, custom event buses, and partner event buses.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "event-bus*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEventSources",
                "description": "Lists the event sources shared with this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPartnerEventSourceAccounts",
                "description": "Called by an AWS partner to display the AWS account ID that the specified partner event source is associated with.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPartnerEventSources",
                "description": "Called by an AWS partner to list all the partner event sources that they have created.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "event-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRuleNamesByTarget",
                "description": "Lists the names of the rules that the given target is put to.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRules",
                "description": "Lists the Amazon EventBridge rules in your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This action lists tags for an Amazon EventBridge resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "event-bus",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTargetsByRule",
                "description": "Lists of targets assigned to the rule.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEvents",
                "description": "Sends custom events to Amazon EventBridge so that they can be matched to rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPartnerEvents",
                "description": "Sends custom events to Amazon EventBridge so that they can be matched to rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPermission",
                "description": "Running PutPermission permits the specified AWS account to put events to your account's default event bus.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRule",
                "description": "Creates or updates a rule. Rules are enabled by default, or based on value of the State parameter.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "events:detail.userIdentity.principalId",
                            "events:detail-type",
                            "events:source",
                            "events:detail.service",
                            "events:detail.eventTypeCode",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutTargets",
                "description": "Adds target(s) to a rule. Targets are the resources that can be invoked when a rule is triggered.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "events:TargetArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemovePermission",
                "description": "Revokes the permission of another AWS account to be able to put events to your default event bus.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTargets",
                "description": "Removes target(s) from a rule so that when the rule is triggered, those targets will no longer be invoked.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an Amazon EventBridge resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "event-bus",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestEventPattern",
                "description": "Tests whether an event pattern matches the provided event.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from an Amazon EventBridge resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "event-bus",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "event-source",
                "arn": "arn:${Partition}:events:${Region}::event-source/${EventSourceName}",
                "condition_keys": []
            },
            {
                "resource": "event-bus",
                "arn": "arn:${Partition}:events:${Region}:${Account}:event-bus/${EventBusName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "rule",
                "arn": "arn:${Partition}:events:${Region}:${Account}:rule/[${EventBusName}/]${RuleName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            },
            {
                "condition": "events:TargetArn",
                "description": "The ARN of a target that can be put to a rule.",
                "type": "ARN"
            },
            {
                "condition": "events:detail-type",
                "description": "Matches the literal string of the detail-type filed of the event.",
                "type": "String"
            },
            {
                "condition": "events:detail.eventTypeCode",
                "description": "Matches the literal string for the detail.eventTypeCode field of the event.",
                "type": "String"
            },
            {
                "condition": "events:detail.service",
                "description": "Matches the literal string for the detail.service field of the event.",
                "type": "String"
            },
            {
                "condition": "events:detail.userIdentity.principalId",
                "description": "Matches the literal string for the detail.useridentity.principalid field of the event.",
                "type": "String"
            },
            {
                "condition": "events:source",
                "description": "The AWS service or AWS partner event source that generated the event. Matches the literal string of the source field of the event.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon API Gateway",
        "prefix": "execute-api",
        "privileges": [
            {
                "privilege": "InvalidateCache",
                "description": "Used to invalidate API cache upon a client request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "execute-api-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Invoke",
                "description": "Used to invoke an API upon a client request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "execute-api-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ManageConnections",
                "description": "ManageConnections controls access to the @connections API",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "execute-api-general*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "execute-api-general",
                "arn": "arn:${Partition}:execute-api:${Region}:${Account}:${ApiId}/${Stage}/${Method}/${ApiSpecificResourcePath}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Kinesis Firehose",
        "prefix": "firehose",
        "privileges": [
            {
                "privilege": "CreateDeliveryStream",
                "description": "Creates a delivery stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDeliveryStream",
                "description": "Deletes a delivery stream and its data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDeliveryStream",
                "description": "Describes the specified delivery stream and gets the status.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeliveryStreams",
                "description": "Lists your delivery streams.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForDeliveryStream",
                "description": "Lists the tags for the specified delivery stream.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRecord",
                "description": "Writes a single data record into an Amazon Kinesis Firehose delivery stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRecordBatch",
                "description": "Writes multiple data records into a delivery stream in a single call, which can achieve higher throughput per producer than when writing single records.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDeliveryStreamEncryption",
                "description": "Enables server-side encryption (SSE) for the delivery stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDeliveryStreamEncryption",
                "description": "Disables the specified destination of the specified delivery stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagDeliveryStream",
                "description": "Adds or updates tags for the specified delivery stream.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagDeliveryStream",
                "description": "Removes tags from the specified delivery stream.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDestination",
                "description": "Updates the specified destination of the specified delivery stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deliverystream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "deliverystream",
                "arn": "arn:${Partition}:firehose:${Region}:${Account}:deliverystream/${DeliveryStreamName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Firewall Manager",
        "prefix": "fms",
        "privileges": [
            {
                "privilege": "AssociateAdminAccount",
                "description": "Sets the AWS Firewall Manager administrator account and enables the service in all organization accounts",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNotificationChannel",
                "description": "Deletes an AWS Firewall Manager association with the IAM role and the Amazon Simple Notification Service (SNS) topic that is used to notify the FM administrator about major FM events and errors across the organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicy",
                "description": "Permanently deletes an AWS Firewall Manager policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateAdminAccount",
                "description": "Disassociates the account that has been set as the AWS Firewall Manager administrator account and and disables the service in all organization accounts",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAdminAccount",
                "description": "Returns the AWS Organizations master account that is associated with AWS Firewall Manager as the AWS Firewall Manager administrator.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComplianceDetail",
                "description": "Returns detailed compliance information about the specified member account. Details include resources that are in and out of compliance with the specified policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNotificationChannel",
                "description": "Returns information about the Amazon Simple Notification Service (SNS) topic that is used to record AWS Firewall Manager SNS logs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicy",
                "description": "Returns information about the specified AWS Firewall Manager policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProtectionStatus",
                "description": "Returns policy-level attack summary information in the event of a potential DDoS attack.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListComplianceStatus",
                "description": "Returns an array of PolicyComplianceStatus objects in the response. Use PolicyComplianceStatus to get a summary of which member accounts are protected by the specified policy.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMemberAccounts",
                "description": "Returns an array of member account ids if the caller is FMS admin account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicies",
                "description": "Returns an array of PolicySummary objects in the response.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the Tags for a given resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutNotificationChannel",
                "description": "Designates the IAM role and Amazon Simple Notification Service (SNS) topic that AWS Firewall Manager (FM) could use to notify the FM administrator about major FM events and errors across the organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPolicy",
                "description": "Creates an AWS Firewall Manager policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds a Tag to a given resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes a Tag from a given resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "policy",
                "arn": "arn:${Partition}:fms:${Region}:${Account}:policy/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Forecast",
        "prefix": "forecast",
        "privileges": [
            {
                "privilege": "CreateDataset",
                "description": "Creates a dataset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatasetGroup",
                "description": "Creates a dataset group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatasetImportJob",
                "description": "Creates a dataset import job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetImportJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateForecast",
                "description": "Creates a forecast",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "predictor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateForecastExportJob",
                "description": "Creates a forecast export job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "forecast*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePredictor",
                "description": "Creates a predictor",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataset",
                "description": "Deletes a dataset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDatasetGroup",
                "description": "Deletes a dataset group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDatasetImportJob",
                "description": "Deletes a dataset import job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetImportJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteForecast",
                "description": "Deletes a forecast",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "forecast*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteForecastExportJob",
                "description": "Deletes a forecast export job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "forecastExport*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePredictor",
                "description": "Deletes a predictor",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "predictor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataset",
                "description": "Describes a dataset",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDatasetGroup",
                "description": "Describes a dataset group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDatasetImportJob",
                "description": "Describes a dataset import job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datasetImportJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeForecast",
                "description": "Describes a forecast",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "forecast*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeForecastExportJob",
                "description": "Describes a forecast export job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "forecastExport*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePredictor",
                "description": "Describes a predictor",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "predictor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccuracyMetrics",
                "description": "Gets Accuracy Metrics for a predictor",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "predictor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasetGroups",
                "description": "Lists dataset groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasetImportJobs",
                "description": "Lists dataset import jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasets",
                "description": "Lists datasets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListForecastExportJobs",
                "description": "Lists forecast export jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListForecasts",
                "description": "Lists forecasts",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPredictors",
                "description": "Lists predictors",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "QueryForecast",
                "description": "Retrieves a forecast for a single item",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "forecast*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDatasetGroup",
                "description": "Updates a dataset group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "dataset",
                "arn": "arn:${Partition}:forecast:${Region}:${Account}:dataset/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "datasetGroup",
                "arn": "arn:${Partition}:forecast:${Region}:${Account}:dataset-group/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "datasetImportJob",
                "arn": "arn:${Partition}:forecast:${Region}:${Account}:dataset-import-job/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "algorithm",
                "arn": "arn:${Partition}:forecast:::algorithm/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "predictor",
                "arn": "arn:${Partition}:forecast:${Region}:${Account}:predictor/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "forecast",
                "arn": "arn:${Partition}:forecast:${Region}:${Account}:forecast/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "forecastExport",
                "arn": "arn:${Partition}:forecast:${Region}:${Account}:forecast-export-job/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Fraud Detector",
        "prefix": "frauddetector",
        "privileges": [
            {
                "privilege": "BatchCreateVariable",
                "description": "Creates a batch of variables.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetVariable",
                "description": "Gets a batch of variables.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDetectorVersion",
                "description": "Creates a detector version. The detector version starts in a DRAFT status.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateModelVersion",
                "description": "Creates a version of the model using the specified model type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRule",
                "description": "Creates a rule for use with the specified detector.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVariable",
                "description": "Creates a variable.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDetectorVersion",
                "description": "Deletes the detector version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEvent",
                "description": "Deletes the specified event.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDetector",
                "description": "Gets all versions for a specified detector.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeModelVersions",
                "description": "Gets all of the model versions for the specified model type or for the specified model type and model ID. You can also get details for a single, specified model version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDetectorVersion",
                "description": "Gets a particular detector version.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDetectors",
                "description": "Gets all of detectors. This is a paginated API. If you provide a null maxSizePerPage, this actions retrieves a maximum of 10 records per page. If you provide a maxSizePerPage, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEventTypesResponse as part of your request. A null pagination token fetches the records from the beginning.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExternalModels",
                "description": "Gets the details for one or more Amazon SageMaker models that have been imported into the service. This is a paginated API. If you provide a null maxSizePerPage, this actions retrieves a maximum of 10 records per page. If you provide a maxSizePerPage, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetExternalModelsResult as part of your request. A null pagination token fetches the records from the beginning.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetModelVersion",
                "description": "Gets a model version.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetModels",
                "description": "Gets all of the models for the AWS account, or the specified model type, or gets a single model for the specified model type, model ID combination.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOutcomes",
                "description": "Gets one or more outcomes. This is a paginated API. If you provide a null maxSizePerPage, this actions retrieves a maximum of 10 records per page. If you provide a maxSizePerPage, the value must be between 50 and 100. To get the next page results, provide the pagination token from the GetOutcomesResult as part of your request. A null pagination token fetches the records from the beginning.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPrediction",
                "description": "Evaluates an event against a detector version. If a version ID is not provided, the detector\u2019s (ACTIVE) version is used.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRules",
                "description": "Gets all rules available for the specified detector.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVariables",
                "description": "Gets all of the variables or the specific variable. This is a paginated API. Providing null maxSizePerPage results in retrieving maximum of 100 records per page. If you provide maxSizePerPage the value must be between 50 and 100. To get the next page result, a provide a pagination token from GetVariablesResult as part of your request. Null pagination token fetches the records from the beginning.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDetector",
                "description": "Creates or updates a detector.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutExternalModel",
                "description": "Creates or updates an Amazon SageMaker model endpoint. You can also use this action to update the configuration of the model endpoint, including the IAM role and/or the mapped variables.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutModel",
                "description": "Creates or updates a model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "PutOutcome",
                "description": "Creates or updates an outcome.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDetectorVersion",
                "description": "Updates a detector version. The detector version attributes that you can update include models, external model endpoints, rules, and description. You can only update a DRAFT detector version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDetectorVersionMetadata",
                "description": "Updates the detector version's description. You can update the metadata for any detector version (DRAFT, ACTIVE, or INACTIVE).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDetectorVersionStatus",
                "description": "Updates the detector version\u2019s status. You can perform the following promotions or demotions using UpdateDetectorVersionStatus: DRAFT to ACTIVE, ACTIVE to INACTIVE, and INACTIVE to ACTIVE.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateModelVersion",
                "description": "Updates a model version. You can update the description and status attributes using this action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRuleMetadata",
                "description": "Updates a rule's metadata.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRuleVersion",
                "description": "Updates a rule version resulting in a new rule version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVariable",
                "description": "Updates a variable.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon FreeRTOS",
        "prefix": "freertos",
        "privileges": [
            {
                "privilege": "CreateSoftwareConfiguration",
                "description": "Creates a software configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSoftwareConfiguration",
                "description": "Deletes the software configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHardwarePlatform",
                "description": "Describes the hardware platform.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSoftwareConfiguration",
                "description": "Describes the software configuration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSoftwareURL",
                "description": "Get the URL for Amazon FreeRTOS software download.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSoftwareURLForConfiguration",
                "description": "Get the URL for Amazon FreeRTOS software download based on the configuration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFreeRTOSVersions",
                "description": "Lists versions of AmazonFreeRTOS.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHardwarePlatforms",
                "description": "Lists the hardware platforms.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHardwareVendors",
                "description": "Lists the hardware vendors.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSoftwareConfigurations",
                "description": "Lists the software configurations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSoftwareConfiguration",
                "description": "Updates the software configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "configuration",
                "arn": "arn:${Partition}:freertos:${Region}:${Account}:configuration/${configurationName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A tag key that is present in the request that the user makes to Amazon FreeRTOS.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "The tag key component of a tag attached to an Amazon FreeRTOS resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the resource in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon FSx",
        "prefix": "fsx",
        "privileges": [
            {
                "privilege": "CancelDataRepositoryTask",
                "description": "This action cancels a data repository task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBackup",
                "description": "This action creates a new backup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataRepositoryTask",
                "description": "This action creates a new task.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFileSystem",
                "description": "This action creates a new, empty, Amazon FSx file system",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFileSystemFromBackup",
                "description": "This action creates a new Amazon FSx file system from an existing backup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackup",
                "description": "This action deletes a backup, deleting its contents. After deletion, the backup no longer exists, and its data is gone.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "backup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFileSystem",
                "description": "This action deletes a file system, deleting its contents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBackups",
                "description": "This action returns the description of specific Amazon FSx backups, if one or more BackupIds are provided for that backup. Otherwise, it returns all backups owned by your AWS account in the AWS Region of the endpoint that you're calling.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataRepositoryTasks",
                "description": "This action returns the description of specific Amazon FSx data repository task, if one or more TaskIds are provided for that data repository task. Otherwise, it returns all data repository task owned by your AWS account in the AWS Region of the endpoint that you're calling.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFileSystems",
                "description": "This action returns the description of specific Amazon FSx file systems, if a FileSystemIds value is provided for that file system. Otherwise, it returns descriptions of all file systems owned by your AWS account in the AWS Region of the endpoint that you're calling.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This action lists tags for an Amazon FSx resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "file-system",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an Amazon FSx resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "file-system",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from an Amazon FSx resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "backup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "file-system",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "task",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFileSystem",
                "description": "This action updates file system configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "file-system*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "file-system",
                "arn": "arn:${Partition}:fsx:${Region}:${Account}:file-system/*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "backup",
                "arn": "arn:${Partition}:fsx:${Region}:${Account}:backup/*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "task",
                "arn": "arn:${Partition}:fsx:${Region}:${Account}:task/*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon GameLift",
        "prefix": "gamelift",
        "privileges": [
            {
                "privilege": "AcceptMatch",
                "description": "Registers player acceptance or rejection of a proposed FlexMatch match.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAlias",
                "description": "Defines a new alias for a fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBuild",
                "description": "Creates a new game build using files stored in an Amazon S3 bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFleet",
                "description": "Creates a new fleet of computing resources to run your game servers.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGameSession",
                "description": "Starts a new game session on a specified fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGameSessionQueue",
                "description": "Sets up a new queue for processing new game session placement requests.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMatchmakingConfiguration",
                "description": "Creates a new FlexMatch matchmaker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMatchmakingRuleSet",
                "description": "Creates a new matchmaking rule set for FlexMatch.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlayerSession",
                "description": "Reserves an available game session slot for a player.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlayerSessions",
                "description": "Reserves available game session slots for multiple players.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateScript",
                "description": "Creates a new Realtime Servers script.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpcPeeringAuthorization",
                "description": "Allows GameLift to create or delete a peering connection between a GameLift fleet VPC and a VPC on another AWS account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVpcPeeringConnection",
                "description": "Establishes a peering connection between your GameLift fleet VPC and a VPC on another account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAlias",
                "description": "Deletes an alias.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBuild",
                "description": "Deletes a game build.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "build*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFleet",
                "description": "Deletes an empty fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGameSessionQueue",
                "description": "Deletes an existing game session queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gameSessionQueue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMatchmakingConfiguration",
                "description": "Deletes an existing FlexMatch matchmaker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "matchmakingConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMatchmakingRuleSet",
                "description": "Deletes an existing FlexMatch matchmaking rule set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "matchmakingRuleSet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScalingPolicy",
                "description": "Deletes a set of auto-scaling rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScript",
                "description": "Deletes a Realtime Servers script.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "script*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpcPeeringAuthorization",
                "description": "Cancels a VPC peering authorization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVpcPeeringConnection",
                "description": "Removes a peering connection between VPCs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAlias",
                "description": "Retrieves properties for an alias.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBuild",
                "description": "Retrieves properties for a game build.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "build*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEC2InstanceLimits",
                "description": "Retrieves the maximum allowed and current usage for EC2 instance types.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetAttributes",
                "description": "Retrieves general properties, including status, for fleets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetCapacity",
                "description": "Retrieves the current capacity setting for fleets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetEvents",
                "description": "Retrieves entries from a fleet's event log.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetPortSettings",
                "description": "Retrieves the inbound connection permissions for a fleet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetUtilization",
                "description": "Retrieves utilization statistics for fleets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGameSessionDetails",
                "description": "Retrieves properties for game sessions in a fleet, including the protection policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGameSessionPlacement",
                "description": "Retrieves details of a game session placement request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGameSessionQueues",
                "description": "Retrieves properties for game session queues.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGameSessions",
                "description": "Retrieves properties for game sessions in a fleet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstances",
                "description": "Retrieves information about instances in a fleet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMatchmaking",
                "description": "Retrieves details of matchmaking tickets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMatchmakingConfigurations",
                "description": "Retrieves properties for FlexMatch matchmakers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMatchmakingRuleSets",
                "description": "Retrieves properties for FlexMatch matchmaking rule sets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePlayerSessions",
                "description": "Retrieves properties for player sessions in a game session.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRuntimeConfiguration",
                "description": "Retrieves the current runtime configuration for a fleet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScalingPolicies",
                "description": "Retrieves all scaling policies that are applied to a fleet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScript",
                "description": "Retrieves properties for a Realtime Servers script.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "script*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcPeeringAuthorizations",
                "description": "Retrieves valid VPC peering authorizations.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVpcPeeringConnections",
                "description": "Retrieves details on active or pending VPC peering connections.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGameSessionLogUrl",
                "description": "Retrieves the location of stored logs for a game session.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceAccess",
                "description": "Requests remote access to a specified fleet instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAliases",
                "description": "Retrieves all aliases that are defined in the current region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBuilds",
                "description": "Retrieves all game build in the current region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFleets",
                "description": "Retrieves a list of fleet IDs for all fleets in the current region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListScripts",
                "description": "Retrieves properties for all Realtime Servers scripts in the current region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List Tags for GameLift Resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "build",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "gameSessionQueue",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "matchmakingConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "matchmakingRuleSet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "script",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutScalingPolicy",
                "description": "Creates or updates a fleet auto-scaling policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestUploadCredentials",
                "description": "Retrieves fresh upload credentials to use when uploading a new game build.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "build*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResolveAlias",
                "description": "Retrieves the fleet ID associated with an alias.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchGameSessions",
                "description": "Retrieves game sessions that match a set of search criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartFleetActions",
                "description": "Resumes auto-scaling activity on a fleet after it was suspended with StopFleetActions().",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartGameSessionPlacement",
                "description": "Sends a game session placement request to a game session queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gameSessionQueue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMatchBackfill",
                "description": "Requests FlexMatch matchmaking to fill available player slots in an existing game session.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMatchmaking",
                "description": "Requests FlexMatch matchmaking for one or a group of players and game session placement for a resulting match.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopFleetActions",
                "description": "Suspends auto-scaling activity on a fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopGameSessionPlacement",
                "description": "Cancels a game session placement request that is in progress.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopMatchmaking",
                "description": "Cancels a matchmaking or match backfill request that is in progress.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags GameLift Resources",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "build",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "gameSessionQueue",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "matchmakingConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "matchmakingRuleSet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "script",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untagging GameLift Resources",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "build",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "fleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "gameSessionQueue",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "matchmakingConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "matchmakingRuleSet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "script",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAlias",
                "description": "Updates the properties of an existing alias.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBuild",
                "description": "Updates an existing build's metadata.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "build*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFleetAttributes",
                "description": "Updates the general properties of an existing fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFleetCapacity",
                "description": "Adjusts a fleet's capacity settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFleetPortSettings",
                "description": "Adjusts a fleet's port settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGameSession",
                "description": "Updates the properties of an existing game session.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGameSessionQueue",
                "description": "Updates properties of an existing game session queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gameSessionQueue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMatchmakingConfiguration",
                "description": "Updates properties of an existing FlexMatch matchmaking configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "matchmakingConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRuntimeConfiguration",
                "description": "Updates how server processes are configured on instances in an existing fleet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateScript",
                "description": "Updates the metadata and content of an existing Realtime Servers script.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "script*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateMatchmakingRuleSet",
                "description": "Validates the syntax of a FlexMatch matchmaking rule set.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "alias",
                "arn": "arn:${Partition}:gamelift:${Region}::alias/${AliasId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "build",
                "arn": "arn:${Partition}:gamelift:${Region}:${AccountId}:build/${BuildId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "script",
                "arn": "arn:${Partition}:gamelift:${Region}:${AccountId}:script/${ScriptId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "fleet",
                "arn": "arn:${Partition}:gamelift:${Region}:${Account}:fleet/${FleetId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "gameSessionQueue",
                "arn": "arn:${Partition}:gamelift:${Region}:${Account}:gamesessionqueue/${GameSessionQueueName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "matchmakingConfiguration",
                "arn": "arn:${Partition}:gamelift:${Region}:${Account}:matchmakingconfiguration/${MatchmakingConfigurationName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "matchmakingRuleSet",
                "arn": "arn:${Partition}:gamelift:${Region}:${Account}:matchmakingruleset/${MatchmakingRuleSetName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the tags that are passed in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on the tags associated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the tag keys that are passed in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Glacier",
        "prefix": "glacier",
        "privileges": [
            {
                "privilege": "AbortMultipartUpload",
                "description": "Aborts a multipart upload identified by the upload ID",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AbortVaultLock",
                "description": "Aborts the vault locking process if the vault lock is not in the Locked state",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTagsToVault",
                "description": "Adds the specified tags to a vault",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteMultipartUpload",
                "description": "Completes a multipart upload process",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteVaultLock",
                "description": "Completes the vault locking process",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVault",
                "description": "Creates a new vault with the specified name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteArchive",
                "description": "Deletes an archive from a vault",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "glacier:ArchiveAgeInDays"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVault",
                "description": "Deletes a vault",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVaultAccessPolicy",
                "description": "Deletes the access policy associated with the specified vault",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVaultNotifications",
                "description": "Deletes the notification configuration set for a vault",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJob",
                "description": "Returns information about a job you previously initiated",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVault",
                "description": "Returns information about a vault",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataRetrievalPolicy",
                "description": "Returns the current data retrieval policy for the account and region specified in the GET request",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobOutput",
                "description": "Downloads the output of the job you initiated",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVaultAccessPolicy",
                "description": "Retrieves the access-policy subresource set on the vault",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVaultLock",
                "description": "Retrieves attributes from the lock-policy subresource set on the specified vault",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVaultNotifications",
                "description": "Retrieves the notification-configuration subresource set on the vault",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateJob",
                "description": "Initiates a job of the specified type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "glacier:ArchiveAgeInDays"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateMultipartUpload",
                "description": "Initiates a multipart upload",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateVaultLock",
                "description": "Initiates the vault locking process",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Lists jobs for a vault that are in-progress and jobs that have recently finished",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMultipartUploads",
                "description": "Lists in-progress multipart uploads for the specified vault",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListParts",
                "description": "Lists the parts of an archive that have been uploaded in a specific multipart upload",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisionedCapacity",
                "description": "This operation lists the provisioned capacity for the specified AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForVault",
                "description": "Lists all the tags attached to a vault",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVaults",
                "description": "Lists all vaults",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseProvisionedCapacity",
                "description": "This operation purchases a provisioned capacity unit for an AWS account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromVault",
                "description": "Removes one or more tags from the set of tags attached to a vault",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDataRetrievalPolicy",
                "description": "Sets and then enacts a data retrieval policy in the region specified in the PUT request",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetVaultAccessPolicy",
                "description": "Configures an access policy for a vault and will overwrite an existing policy",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetVaultNotifications",
                "description": "Configures vault notifications",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadArchive",
                "description": "Adds an archive to a vault",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadMultipartPart",
                "description": "Uploads a part of an archive",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "vault*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "vault",
                "arn": "arn:${Partition}:glacier:${Region}:${Account}:vaults/${VaultName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "glacier:ArchiveAgeInDays",
                "description": "How long an archive has been stored in the vault, in days.",
                "type": "String"
            },
            {
                "condition": "glacier:ResourceTag/",
                "description": "A customer-defined tag.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Global Accelerator",
        "prefix": "globalaccelerator",
        "privileges": [
            {
                "privilege": "AdvertiseByoipCidr",
                "description": "Advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccelerator",
                "description": "Create an accelerator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEndpointGroup",
                "description": "Add an endpoint group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateListener",
                "description": "Add a listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccelerator",
                "description": "Delete the accelerator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpointGroup",
                "description": "Delete the endpoint group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpointgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteListener",
                "description": "Delete the listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprovisionByoipCidr",
                "description": "Releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP) and deletes the corresponding address pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccelerator",
                "description": "Describe the accelerator.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAcceleratorAttributes",
                "description": "Describe the accelerator Attributes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpointGroup",
                "description": "Describe the endpoint group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "endpointgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeListener",
                "description": "Describe the listener.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "listener*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccelerators",
                "description": "List the accelerators.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListByoipCidrs",
                "description": "List the byoip cidrs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEndpointGroups",
                "description": "List the endpoint groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "listener*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListListeners",
                "description": "List the listeners.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags for a globalaccelerator resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "accelerator",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ProvisionByoipCidr",
                "description": "Provisions an address range for use with your accelerator through bring your own IP addresses (BYOIP) and creates a corresponding address pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to globalaccelerator resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "accelerator",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove tags from globalaccelerator resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "accelerator",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccelerator",
                "description": "Update the accelerator.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAcceleratorAttributes",
                "description": "Update the accelerator attributes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accelerator*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEndpointGroup",
                "description": "Update the endpoint group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpointgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateListener",
                "description": "Update the listener.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "listener*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "WithdrawByoipCidr",
                "description": "Stops advertising an IPv4 address range that is provisioned as an address pool.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "accelerator",
                "arn": "arn:${Partition}:globalaccelerator::${Account}:accelerator/${AcceleratorId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "listener",
                "arn": "arn:${Partition}:globalaccelerator::${Account}:accelerator/${AcceleratorId}/listener/${ListenerId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "endpointgroup",
                "arn": "arn:${Partition}:globalaccelerator::${Account}:accelerator/${AcceleratorId}/listener/${ListenerId}/endpoint-group/${EndpointGroupId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Glue",
        "prefix": "glue",
        "privileges": [
            {
                "privilege": "BatchCreatePartition",
                "description": "Grants permission to create one or more partitions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteConnection",
                "description": "Grants permission to delete one or more connections",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeletePartition",
                "description": "Grants permission to delete one or more partitions",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteTable",
                "description": "Grants permission to delete one or more tables",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteTableVersion",
                "description": "Grants permission to delete one or more versions of a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tableversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetCrawlers",
                "description": "Grants permission to retrieve one or more crawlers",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetDevEndpoints",
                "description": "Grants permission to retrieve one or more development endpoints",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetJobs",
                "description": "Grants permission to retrieve one or more jobs",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetPartition",
                "description": "Grants permission to retrieve one or more partitions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetTriggers",
                "description": "Grants permission to retrieve one or more triggers",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetWorkflows",
                "description": "Grants permission to retrieve one or more workflows",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchStopJobRun",
                "description": "Grants permission to stop one or more job runs for a job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelMLTaskRun",
                "description": "Grants permission to stop a running ML Task Run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClassifier",
                "description": "Grants permission to create a classifier",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConnection",
                "description": "Grants permission to create a connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCrawler",
                "description": "Grants permission to create a crawler",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatabase",
                "description": "Grants permission to create a database",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDevEndpoint",
                "description": "Grants permission to create a development endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Grants permission to create a job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMLTransform",
                "description": "Grants permission to create an ML Transform",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePartition",
                "description": "Grants permission to create a partition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateScript",
                "description": "Grants permission to create a script",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSecurityConfiguration",
                "description": "Grants permission to create a security configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTable",
                "description": "Grants permission to create a table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrigger",
                "description": "Grants permission to create a trigger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserDefinedFunction",
                "description": "Grants permission to create a function definition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "userdefinedfunction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWorkflow",
                "description": "Grants permission to create a workflow",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClassifier",
                "description": "Grants permission to delete a classifier",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConnection",
                "description": "Grants permission to delete a connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCrawler",
                "description": "Grants permission to delete a crawler",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDatabase",
                "description": "Grants permission to delete a database",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDevEndpoint",
                "description": "Grants permission to delete a development endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJob",
                "description": "Grants permission to delete a job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMLTransform",
                "description": "Grants permission to delete an ML Transform",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePartition",
                "description": "Grants permission to delete a partition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourcePolicy",
                "description": "Grants permission to delete a resource policy",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSecurityConfiguration",
                "description": "Grants permission to delete a security configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTable",
                "description": "Grants permission to delete a table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTableVersion",
                "description": "Grants permission to delete a version of a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tableversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrigger",
                "description": "Grants permission to delete a trigger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserDefinedFunction",
                "description": "Grants permission to delete a function definition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "userdefinedfunction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWorkflow",
                "description": "Grants permission to delete a workflow",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCatalogImportStatus",
                "description": "Grants permission to retrieve the catalog import status",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetClassifier",
                "description": "Grants permission to retrieve a classifier",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetClassifiers",
                "description": "Grants permission to list all classifiers",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnection",
                "description": "Grants permission to retrieve a connection",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnections",
                "description": "Grants permission to retrieve a list of connections",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCrawler",
                "description": "Grants permission to retrieve a crawler",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCrawlerMetrics",
                "description": "Grants permission to retrieve metrics about crawlers",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCrawlers",
                "description": "Grants permission to retrieve all crawlers",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataCatalogEncryptionSettings",
                "description": "Grants permission to retrieve catalog encryption settings",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDatabase",
                "description": "Grants permission to retrieve a database",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDatabases",
                "description": "Grants permission to retrieve all databases",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataflowGraph",
                "description": "Grants permission to transform a script into a directed acyclic graph (DAG)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevEndpoint",
                "description": "Grants permission to retrieve a development endpoint",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevEndpoints",
                "description": "Grants permission to retrieve all development endpoints",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJob",
                "description": "Grants permission to retrieve a job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobBookmark",
                "description": "Grants permission to retrieve a job bookmark",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobRun",
                "description": "Grants permission to retrieve a job run",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobRuns",
                "description": "Grants permission to retrieve all job runs of a job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobs",
                "description": "Grants permission to retrieve all current jobs",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMLTaskRun",
                "description": "Grants permission to retrieve an ML Task Run",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMLTaskRuns",
                "description": "Grants permission to retrieve all ML Task Runs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMLTransform",
                "description": "Grants permission to retrieve an ML Transform",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMLTransforms",
                "description": "Grants permission to retrieve all ML Transforms",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMapping",
                "description": "Grants permission to create a mapping",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPartition",
                "description": "Grants permission to retrieve a partition",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPartitions",
                "description": "Grants permission to retrieve the partitions of a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPlan",
                "description": "Grants permission to retrieve a mapping for a script",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourcePolicy",
                "description": "Grants permission to retrieve a resource policy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSecurityConfiguration",
                "description": "Grants permission to retrieve a security configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSecurityConfigurations",
                "description": "Grants permission to retrieve one or more security configurations",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTable",
                "description": "Grants permission to retrieve a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTableVersion",
                "description": "Grants permission to retrieve a version of a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tableversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTableVersions",
                "description": "Grants permission to retrieve a list of versions of a table",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tableversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTables",
                "description": "Grants permission to retrieve the tables in a database",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTags",
                "description": "Grants permission to retrieve all tags associated with a resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "crawler",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devendpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "trigger",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workflow",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrigger",
                "description": "Grants permission to retrieve a trigger",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTriggers",
                "description": "Grants permission to retrieve the triggers associated with a job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserDefinedFunction",
                "description": "Grants permission to retrieve a function definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "userdefinedfunction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserDefinedFunctions",
                "description": "Grants permission to retrieve multiple function definitions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "userdefinedfunction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkflow",
                "description": "Grants permission to retrieve a workflow",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkflowRun",
                "description": "Grants permission to retrieve a workflow run",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkflowRunProperties",
                "description": "Grants permission to retrieve workflow run properties",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkflowRuns",
                "description": "Grants permission to retrieve all runs of a workflow",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportCatalogToGlue",
                "description": "Grants permission to import an Athena data catalog into AWS Glue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCrawlers",
                "description": "Grants permission to retrieve all crawlers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevEndpoints",
                "description": "Grants permission to retrieve all development endpoints",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Grants permission to retrieve all current jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMLTransforms",
                "description": "Grants permission to retrieve all ML Transforms",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTriggers",
                "description": "Grants permission to retrieve all triggers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkflows",
                "description": "Grants permission to retrieve all workflows",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDataCatalogEncryptionSettings",
                "description": "Grants permission to update catalog encryption settings",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutResourcePolicy",
                "description": "Grants permission to update a resource policy",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutWorkflowRunProperties",
                "description": "Grants permission to update workflow run properties",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetJobBookmark",
                "description": "Grants permission to reset a job bookmark",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchTables",
                "description": "Grants permission to retrieve the tables in the catalog",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartCrawler",
                "description": "Grants permission to start a crawler",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartCrawlerSchedule",
                "description": "Grants permission to change the schedule state of a crawler to SCHEDULED",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartExportLabelsTaskRun",
                "description": "Grants permission to start an Export Labels ML Task Run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartImportLabelsTaskRun",
                "description": "Grants permission to start an Import Labels ML Task Run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartJobRun",
                "description": "Grants permission to start running a job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMLEvaluationTaskRun",
                "description": "Grants permission to start an Evaluation ML Task Run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMLLabelingSetGenerationTaskRun",
                "description": "Grants permission to start a Labeling Set Generation ML Task Run",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTrigger",
                "description": "Grants permission to start a trigger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartWorkflowRun",
                "description": "Grants permission to start running a workflow",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopCrawler",
                "description": "Grants permission to stop a running crawler",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopCrawlerSchedule",
                "description": "Grants permission to set the schedule state of a crawler to NOT_SCHEDULED",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTrigger",
                "description": "Grants permission to stop a trigger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "crawler",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devendpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "trigger",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workflow",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags associated with a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "crawler",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "devendpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "trigger",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workflow",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateClassifier",
                "description": "Grants permission to update a classifier",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConnection",
                "description": "Grants permission to update a connection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCrawler",
                "description": "Grants permission to update a crawler",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCrawlerSchedule",
                "description": "Grants permission to update the schedule of a crawler",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDatabase",
                "description": "Grants permission to update a database",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDevEndpoint",
                "description": "Grants permission to update a development endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJob",
                "description": "Grants permission to update a job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMLTransform",
                "description": "Grants permission to update an ML Transform",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePartition",
                "description": "Grants permission to update a partition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTable",
                "description": "Grants permission to update a table",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "table*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrigger",
                "description": "Grants permission to update a trigger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserDefinedFunction",
                "description": "Grants permission to update a function definition",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "catalog*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "userdefinedfunction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWorkflow",
                "description": "Grants permission to update a workflow",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UseMLTransforms",
                "description": "Grants permission to use an ML Transform from within a Glue ETL Script",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlTransform*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "catalog",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:catalog/${CatalogName}",
                "condition_keys": []
            },
            {
                "resource": "database",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:database/${DatabaseName}",
                "condition_keys": []
            },
            {
                "resource": "table",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:table/${TableName}",
                "condition_keys": []
            },
            {
                "resource": "tableversion",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:tableVersion/${TableVersionName}",
                "condition_keys": []
            },
            {
                "resource": "connection",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:connection/${ConnectionName}",
                "condition_keys": []
            },
            {
                "resource": "userdefinedfunction",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:userDefinedFunction/${UserDefinedFunctionName}",
                "condition_keys": []
            },
            {
                "resource": "devendpoint",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:devendpoint/${DevEndpointName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "job",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:job/${JobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "trigger",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:trigger/${TriggerName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "crawler",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:crawler/${CrawlerName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "workflow",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:workflow/${WorkflowName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "mlTransform",
                "arn": "arn:${Partition}:glue:${Region}:${Account}:mlTransform/${TransformId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IoT Greengrass",
        "prefix": "greengrass",
        "privileges": [
            {
                "privilege": "AssociateRoleToGroup",
                "description": "Grants permission to associate a role with a group. The role's permissions must allow Greengrass core Lambda functions and connectors to perform actions in other AWS services.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateServiceRoleToAccount",
                "description": "Grants permission to associate a role with your account. AWS IoT Greengrass uses this role to access your Lambda functions and AWS IoT resources.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConnectorDefinition",
                "description": "Grants permission to create a connector definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConnectorDefinitionVersion",
                "description": "Grants permission to create a version of an existing connector definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "connectorDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCoreDefinition",
                "description": "Grants permission to create a core definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCoreDefinitionVersion",
                "description": "Grants permission to create a version of an existing core definition. Greengrass groups must each contain exactly one Greengrass core.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "coreDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeployment",
                "description": "Grants permission to create a deployment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeviceDefinition",
                "description": "Grants permission to create a device definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeviceDefinitionVersion",
                "description": "Grants permission to create a version of an existing device definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deviceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFunctionDefinition",
                "description": "Grants permission to create a Lambda function definition to be used in a group that contains a list of Lambda functions and their configurations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFunctionDefinitionVersion",
                "description": "Grants permission to create a version of an existing Lambda function definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "functionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Grants permission to create a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroupCertificateAuthority",
                "description": "Grants permission to create a CA for the group, or rotate the existing CA.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroupVersion",
                "description": "Grants permission to create a version of a group that has already been defined.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoggerDefinition",
                "description": "Grants permission to create a logger definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoggerDefinitionVersion",
                "description": "Grants permission to create a version of an existing logger definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loggerDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResourceDefinition",
                "description": "Grants permission to create a resource definition that contains a list of resources to be used in a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResourceDefinitionVersion",
                "description": "Grants permission to create a version of an existing resource definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resourceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSoftwareUpdateJob",
                "description": "Grants permission to create an AWS IoT job that will trigger your Greengrass cores to update the software they are running.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSubscriptionDefinition",
                "description": "Grants permission to create a subscription definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSubscriptionDefinitionVersion",
                "description": "Grants permission to create a version of an existing subscription definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subscriptionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConnectorDefinition",
                "description": "Grants permission to delete a connector definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "connectorDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCoreDefinition",
                "description": "Grants permission to delete a core definition. Deleting a definition that is currently in use in a deployment affects future deployments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "coreDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDeviceDefinition",
                "description": "Grants permission to delete a device definition. Deleting a definition that is currently in use in a deployment affects future deployments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deviceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFunctionDefinition",
                "description": "Grants permission to delete a Lambda function definition. Deleting a definition that is currently in use in a deployment affects future deployments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "functionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Grants permission to delete a group that is not currently in use in a deployment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoggerDefinition",
                "description": "Grants permission to delete a logger definition. Deleting a definition that is currently in use in a deployment affects future deployments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loggerDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourceDefinition",
                "description": "Grants permission to delete a resource definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resourceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSubscriptionDefinition",
                "description": "Grants permission to delete a subscription definition. Deleting a definition that is currently in use in a deployment affects future deployments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subscriptionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateRoleFromGroup",
                "description": "Grants permission to disassociate the role from a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateServiceRoleFromAccount",
                "description": "Grants permission to disassociate the service role from an account. Without a service role, deployments will not work.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssociatedRole",
                "description": "Grants permission to retrieve the role associated with a group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBulkDeploymentStatus",
                "description": "Grants permission to return the status of a bulk deployment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bulkDeployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnectivityInfo",
                "description": "Grants permission to retrieve the connectivity information for a core.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "connectivityInfo*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnectorDefinition",
                "description": "Grants permission to retrieve information about a connector definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "connectorDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnectorDefinitionVersion",
                "description": "Grants permission to retrieve information about a connector definition version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "connectorDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connectorDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCoreDefinition",
                "description": "Grants permission to retrieve information about a core definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "coreDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCoreDefinitionVersion",
                "description": "Grants permission to retrieve information about a core definition version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "coreDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "coreDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeploymentStatus",
                "description": "Grants permission to return the status of a deployment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeviceDefinition",
                "description": "Grants permission to retrieve information about a device definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deviceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeviceDefinitionVersion",
                "description": "Grants permission to retrieve information about a device definition version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deviceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunctionDefinition",
                "description": "Grants permission to retrieve information about a Lambda function definition, such as its creation time and latest version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "functionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunctionDefinitionVersion",
                "description": "Grants permission to retrieve information about a Lambda function definition version, such as which Lambda functions are included in the version and their configurations.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "functionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "functionDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroup",
                "description": "Grants permission to retrieve information about a group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroupCertificateAuthority",
                "description": "Grants permission to return the public key of the CA associated with a group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "certificateAuthority*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroupCertificateConfiguration",
                "description": "Grants permission to retrieve the current configuration for the CA used by a group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroupVersion",
                "description": "Grants permission to retrieve information about a group version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "groupVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoggerDefinition",
                "description": "Grants permission to retrieve information about a logger definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "loggerDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoggerDefinitionVersion",
                "description": "Grants permission to retrieve information about a logger definition version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "loggerDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loggerDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceDefinition",
                "description": "Grants permission to retrieve information about a resource definition, such as its creation time and latest version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resourceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceDefinitionVersion",
                "description": "Grants permission to retrieve information about a resource definition version, such as which resources are included in the version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resourceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resourceDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceRoleForAccount",
                "description": "Grants permission to retrieve the service role that is attached to an account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSubscriptionDefinition",
                "description": "Grants permission to retrieve information about a subscription definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "subscriptionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSubscriptionDefinitionVersion",
                "description": "Grants permission to retrieve information about a subscription definition version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "subscriptionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subscriptionDefinitionVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBulkDeploymentDetailedReports",
                "description": "Grants permission to retrieve a paginated list of the deployments that have been started in a bulk deployment operation and their current deployment status.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "bulkDeployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBulkDeployments",
                "description": "Grants permission to retrieve a list of bulk deployments.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConnectorDefinitionVersions",
                "description": "Grants permission to list the versions of a connector definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "connectorDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConnectorDefinitions",
                "description": "Grants permission to retrieve a list of connector definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCoreDefinitionVersions",
                "description": "Grants permission to list the versions of a core definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "coreDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCoreDefinitions",
                "description": "Grants permission to retrieve a list of core definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeployments",
                "description": "Grants permission to retrieve a list of all deployments for a group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeviceDefinitionVersions",
                "description": "Grants permission to list the versions of a device definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deviceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeviceDefinitions",
                "description": "Grants permission to retrieve a list of device definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFunctionDefinitionVersions",
                "description": "Grants permission to list the versions of a Lambda function definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "functionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFunctionDefinitions",
                "description": "Grants permission to retrieve a list of Lambda function definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupCertificateAuthorities",
                "description": "Grants permission to retrieve a list of current CAs for a group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupVersions",
                "description": "Grants permission to list the versions of a group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Grants permission to retrieve a list of groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLoggerDefinitionVersions",
                "description": "Grants permission to list the versions of a logger definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "loggerDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLoggerDefinitions",
                "description": "Grants permission to retrieve a list of logger definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceDefinitionVersions",
                "description": "Grants permission to list the versions of a resource definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "resourceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceDefinitions",
                "description": "Grants permission to retrieve a list of resource definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscriptionDefinitionVersions",
                "description": "Grants permission to list the versions of a subscription definition.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "subscriptionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscriptionDefinitions",
                "description": "Grants permission to retrieve a list of subscription definitions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags for a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "bulkDeployment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connectorDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "coreDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "functionDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loggerDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resourceDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subscriptionDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetDeployments",
                "description": "Grants permission to reset a group's deployments.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartBulkDeployment",
                "description": "Grants permission to deploy multiple groups in one operation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopBulkDeployment",
                "description": "Grants permission to stop the execution of a bulk deployment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bulkDeployment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "bulkDeployment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connectorDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "coreDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "functionDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loggerDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resourceDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subscriptionDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "bulkDeployment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "connectorDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "coreDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deviceDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "functionDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loggerDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resourceDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subscriptionDefinition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConnectivityInfo",
                "description": "Grants permission to update the connectivity information for a Greengrass core. Any devices that belong to the group that has this core will receive this information in order to find the location of the core and connect to it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "connectivityInfo*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConnectorDefinition",
                "description": "Grants permission to update a connector definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "connectorDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCoreDefinition",
                "description": "Grants permission to update a core definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "coreDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDeviceDefinition",
                "description": "Grants permission to update a device definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deviceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFunctionDefinition",
                "description": "Grants permission to update a Lambda function definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "functionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Grants permission to update a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroupCertificateConfiguration",
                "description": "Grants permission to update the certificate expiry time for a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLoggerDefinition",
                "description": "Grants permission to update a logger definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loggerDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResourceDefinition",
                "description": "Grants permission to update a resource definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resourceDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSubscriptionDefinition",
                "description": "Grants permission to update a subscription definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subscriptionDefinition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "connectivityInfo",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/things/${ThingName}/connectivityInfo",
                "condition_keys": []
            },
            {
                "resource": "artifact",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/deployments/${DeploymentId}/artifacts/lambda/${ArtifactId}",
                "condition_keys": []
            },
            {
                "resource": "certificateAuthority",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/certificateauthorities/${CertificateAuthorityId}",
                "condition_keys": []
            },
            {
                "resource": "deployment",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/deployments/${DeploymentId}",
                "condition_keys": []
            },
            {
                "resource": "bulkDeployment",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/bulk/deployments/${BulkDeploymentId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "group",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "groupVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "coreDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/cores/${CoreDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "coreDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/cores/${CoreDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "deviceDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/devices/${DeviceDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deviceDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/devices/${DeviceDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "functionDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/functions/${FunctionDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "functionDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/functions/${FunctionDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "subscriptionDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/subscriptions/${SubscriptionDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "subscriptionDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/subscriptions/${SubscriptionDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "loggerDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/loggers/${LoggerDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "loggerDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/loggers/${LoggerDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "resourceDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/resources/${ResourceDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "resourceDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/resources/${ResourceDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            },
            {
                "resource": "connectorDefinition",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/connectors/${ConnectorDefinitionId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "connectorDefinitionVersion",
                "arn": "arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/connectors/${ConnectorDefinitionId}/versions/${VersionId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:CurrentTime",
                "description": "Filters access by checking date/time conditions for the current date and time.",
                "type": "Date"
            },
            {
                "condition": "aws:EpochTime",
                "description": "Filters access by checking date/time conditions for the current date and time in epoch or Unix time.",
                "type": "Date"
            },
            {
                "condition": "aws:MultiFactorAuthAge",
                "description": "Filters access by checking how long ago (in seconds) the security credentials validated by multi-factor authentication (MFA) in the request were issued using MFA.",
                "type": "Numeric"
            },
            {
                "condition": "aws:MultiFactorAuthPresent",
                "description": "Filters access by checking whether multi-factor authentication (MFA) was used to validate the temporary security credentials that made the current request.",
                "type": "Boolean"
            },
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the mandatory tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on the tag value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:SecureTransport",
                "description": "Filters access by checking whether the request was sent using SSL.",
                "type": "Boolean"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            },
            {
                "condition": "aws:UserAgent",
                "description": "Filters access by the requester's client application.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Ground Station",
        "prefix": "groundstation",
        "privileges": [
            {
                "privilege": "CancelContact",
                "description": "Grants permission to cancel a contact",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfig",
                "description": "Grants permission to create a configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataflowEndpointGroup",
                "description": "Grants permission to create a data flow endpoint group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMissionProfile",
                "description": "Grants permission to create a mission profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfig",
                "description": "Grants permission to delete a config",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataflowEndpointGroup",
                "description": "Grants permission to delete a data flow endpoint group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "DataflowEndpointGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMissionProfile",
                "description": "Grants permission to delete a mission profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "MissionProfile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeContact",
                "description": "Grants permission to describe a contact",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Contact*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfig",
                "description": "Grants permission to return a configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataflowEndpointGroup",
                "description": "Grants permission to return a data flow endpoint group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "DataflowEndpointGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMinuteUsage",
                "description": "Grants permission to return minutes usage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMissionProfile",
                "description": "Grants permission to retrieve a mission profile",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "MissionProfile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSatellite",
                "description": "Grants permission to return information about a satellite",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Satellite*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigs",
                "description": "Grants permisson to return a list of past configurations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListContacts",
                "description": "Grants permission to return a list of contacts",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDataflowEndpointGroups",
                "description": "Grants permission to list data flow endpoint groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroundStations",
                "description": "Grants permission to list ground stations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMissionProfiles",
                "description": "Grants permission to return a list of mission profiles",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSatellites",
                "description": "Grants permission to list satellites",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags for a resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Config",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Contact",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "DataflowEndpointGroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "MissionProfile",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReserveContact",
                "description": "Grants permission to reserve a contact",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to assign a resource tag",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Config",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Contact",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "DataflowEndpointGroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "MissionProfile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to deassign a resource tag",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Config",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Contact",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "DataflowEndpointGroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "MissionProfile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfig",
                "description": "Grants permission to update a configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMissionProfile",
                "description": "Grants permission to update a mission profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "MissionProfile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Config",
                "arn": "arn:${Partition}:groundstation:${Region}:${Account}:config/${configType}/${configId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "groundstation:configId",
                    "groundstation:configType"
                ]
            },
            {
                "resource": "Contact",
                "arn": "arn:${Partition}:groundstation:${Region}:${Account}:contact/${contactId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "groundstation:contactId"
                ]
            },
            {
                "resource": "DataflowEndpointGroup",
                "arn": "arn:${Partition}:groundstation:${Region}:${Account}:dataflow-endpoint-group/${dataflowEndpointGroupId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "groundstation:dataflowEndpointGroupId"
                ]
            },
            {
                "resource": "GroundStationResource",
                "arn": "arn:${Partition}:groundstation:${Region}:${Account}:groundstation:${groundStationId}",
                "condition_keys": [
                    "groundstation:groundStationId"
                ]
            },
            {
                "resource": "MissionProfile",
                "arn": "arn:${Partition}:groundstation:${Region}:${Account}:mission-profile/${missionProfileId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "groundstation:missionProfileId"
                ]
            },
            {
                "resource": "Satellite",
                "arn": "arn:${Partition}:groundstation:${Region}:${Account}:satellite/${satelliteId}",
                "condition_keys": [
                    "groundstation:satelliteId"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access by a key that is present in the request the user makes to the Ground Station service.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access by a tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by the list of all the tag key names present in the request the user makes to the Ground Station service.",
                "type": "String"
            },
            {
                "condition": "groundstation:configId",
                "description": "Filters access by the ID of a config",
                "type": "String"
            },
            {
                "condition": "groundstation:configType",
                "description": "Filters access by the type of a config",
                "type": "String"
            },
            {
                "condition": "groundstation:contactId",
                "description": "Filters access by the ID of a contact",
                "type": "String"
            },
            {
                "condition": "groundstation:dataflowEndpointGroupId",
                "description": "Filters access by the ID of a dataflow endpoint group",
                "type": "String"
            },
            {
                "condition": "groundstation:groundStationId",
                "description": "Filters access by the ID of a ground station",
                "type": "String"
            },
            {
                "condition": "groundstation:missionProfileId",
                "description": "Filters access by the ID of a mission profile",
                "type": "String"
            },
            {
                "condition": "groundstation:satelliteId",
                "description": "Filters access by the ID of a satellite",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon GroundTruth Labeling",
        "prefix": "groundtruthlabeling",
        "privileges": [
            {
                "privilege": "DescribeConsoleJob",
                "description": "Get status of GroundTruthLabeling Jobs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasetObjects",
                "description": "Paginated list API to list dataset objects in a manifest file.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunFilterOrSampleDatasetJob",
                "description": "Filter records from a manifest file using S3 select. Get sample entries based on random sampling.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunGenerateManifestByCrawlingJob",
                "description": "List a S3 prefix and create manifest files from objects in that location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon GuardDuty",
        "prefix": "guardduty",
        "privileges": [
            {
                "privilege": "AcceptInvitation",
                "description": "Grants permission to accept invitations to become a GuardDuty member account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ArchiveFindings",
                "description": "Grants permission to archive GuardDuty findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDetector",
                "description": "Grants permission to create a detector.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFilter",
                "description": "Grants permission to create GuardDuty filters. A filters defines finding attributes and conditions used to filter findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIPSet",
                "description": "Grants permission to create an IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMembers",
                "description": "Grants permission to create GuardDuty member accounts. The account used to create a member becomes the GuardDuty master account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePublishingDestination",
                "description": "Grants permission to create a publishing destination.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject",
                            "s3:ListBucket"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateSampleFindings",
                "description": "Grants permission to create sample findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateThreatIntelSet",
                "description": "Grants permission to create GuardDuty ThreatIntelSets. A ThreatIntelSet consists of known malicious IP addresses used by GuardDuty to generate findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeclineInvitations",
                "description": "Grants permission to decline invitations to become a GuardDuty member account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDetector",
                "description": "Grants permission to delete GuardDuty detectors.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFilter",
                "description": "Grants permission to delete GuardDuty filters.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "filter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIPSet",
                "description": "Grants permission to delete GuardDuty IPSets.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInvitations",
                "description": "Grants permission to delete invitations to become a GuardDuty member account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMembers",
                "description": "Grants permission to delete GuardDuty member accounts.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePublishingDestination",
                "description": "Grants permission to delete a publishing destination.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishingdestination*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteThreatIntelSet",
                "description": "Grants permission to delete GuardDuty ThreatIntelSets.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "threatintelset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePublishingDestination",
                "description": "Grants permission to retrieve details about a publishing destination.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "publishingdestination*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateFromMasterAccount",
                "description": "Grants permission to disassociate a GuardDuty member account from its GuardDuty master account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateMembers",
                "description": "Grants permission to disassociate GuardDuty member accounts from their master GuardDuty account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDetector",
                "description": "Grants permission to retrieve GuardDuty detectors.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFilter",
                "description": "Grants permission to retrieve GuardDuty filters.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "filter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFindings",
                "description": "Grants permission to retrieve GuardDuty findings.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFindingsStatistics",
                "description": "Grants permission to retrieve a list of GuardDuty finding statistics.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIPSet",
                "description": "Grants permsission to retrieve GuardDuty IPSets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInvitationsCount",
                "description": "Grants permission to retrieve the count of all GuardDuty invitations sent to a specified account. The count does not include an accepted invitation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMasterAccount",
                "description": "Grants permission to retrieve details of the GuardDuty master account associated with a member account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMembers",
                "description": "Grants permission to retrieve the member accounts associated with a master account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetThreatIntelSet",
                "description": "Grants permission to retrieve GuardDuty ThreatIntelSets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "threatintelset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InviteMembers",
                "description": "Grants permission to invite other AWS accounts to enable GuardDuty and become GuardDuty member accounts.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDetectors",
                "description": "Grants permission to retrieve a list of GuardDuty detectors.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFilters",
                "description": "Grants permission to retrieve a list of GuardDuty filters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFindings",
                "description": "Grants permission to retrieve a list of GuardDuty findings.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInvitations",
                "description": "Grants permission to retrieve a lists of all of the GuardDuty membership invitations that were sent to an AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMembers",
                "description": "Grants permission to retrierve a lsit of GuardDuty member accounts associated with a master account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPublishingDestinations",
                "description": "Grants permission to retrieve a list of publishing destinations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to retrieve a list of tags associated with a GuardDuty resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detector",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "filter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ipset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "threatintelset",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThreatIntelSets",
                "description": "Grants permission to retrieve a list of GuardDuty ThreatIntelSets.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMonitoringMembers",
                "description": "Grants permission to a master account to monitor findings from GuardDuty member accounts. Use this after disabling monitoring of member accounts using the StopMonitoringMembers operation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopMonitoringMembers",
                "description": "Grants permission to disable monitoring findings from member accounts.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to a GuardDuty resource. There is a limit of 50 tags per resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "detector",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "filter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ipset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "threatintelset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnarchiveFindings",
                "description": "Grants permission to unarchive GuardDuty findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from a GuardDuty resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "detector",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "filter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ipset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "threatintelset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDetector",
                "description": "Grants permission to update GuardDuty detectors.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFilter",
                "description": "Grants permission to updates GuardDuty filters.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "filter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFindingsFeedback",
                "description": "Grants permission to update findings feedback to mark GuardDuty findings as useful or not useful.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIPSet",
                "description": "Grants permission to update GuardDuty IPSets.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePublishingDestination",
                "description": "Grants permission to update a publishing destination.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject",
                            "s3:ListBucket"
                        ]
                    },
                    {
                        "resource_type": "publishingdestination*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateThreatIntelSet",
                "description": "Grants permission to updates the GuardDuty ThreatIntelSets.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detector*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "threatintelset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "detector",
                "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "filter",
                "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/filter/${FilterName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "ipset",
                "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/ipset/${IPSetId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "threatintelset",
                "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/threatintelset/${ThreatIntelSetId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "publishingdestination",
                "arn": "arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/threatintelset/${PublishingDestinationId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Health APIs and Notifications",
        "prefix": "health",
        "privileges": [
            {
                "privilege": "DescribeAffectedAccountsForOrganization",
                "description": "Gets a list of accounts that have been affected by the specified events in organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            },
            {
                "privilege": "DescribeAffectedEntities",
                "description": "Gets a list of entities that have been affected by the specified events.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "event*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "health:eventTypeCode",
                            "health:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAffectedEntitiesForOrganization",
                "description": "Gets a list of entities that have been affected by the specified events and accounts in organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            },
            {
                "privilege": "DescribeEntityAggregates",
                "description": "Returns the number of entities that are affected by each of the specified events.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventAggregates",
                "description": "Returns the number of events of each event type (issue, scheduled change, and account notification).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventDetails",
                "description": "Returns detailed information about one or more specified events.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "event*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "health:eventTypeCode",
                            "health:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventDetailsForOrganization",
                "description": "Returns detailed information about one or more specified events for provided accounts in organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            },
            {
                "privilege": "DescribeEventTypes",
                "description": "Returns the event types that meet the specified filter criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "Returns information about events that meet the specified filter criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventsForOrganization",
                "description": "Returns information about events that meet the specified filter criteria in organization.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            },
            {
                "privilege": "DescribeHealthServiceStatusForOrganization",
                "description": "Returns the status of enabling or disabling the Organizational View feature",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            },
            {
                "privilege": "DisableHealthServiceAccessForOrganization",
                "description": "Disables the Organizational View feature.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:DisableAWSServiceAccess",
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            },
            {
                "privilege": "EnableHealthServiceAccessForOrganization",
                "description": "Enables the Organizational View feature.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole",
                            "organizations:EnableAWSServiceAccess",
                            "organizations:ListAccounts"
                        ]
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "event",
                "arn": "arn:${Partition}:health:*::event/${Service}/${EventTypeCode}/*",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "health:eventTypeCode",
                "description": "The type of event.",
                "type": "String"
            },
            {
                "condition": "health:service",
                "description": "The service of the event.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Identity And Access Management",
        "prefix": "iam",
        "privileges": [
            {
                "privilege": "AddClientIDToOpenIDConnectProvider",
                "description": "Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "oidc-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddRoleToInstanceProfile",
                "description": "Grants permission to add an IAM role to the specified instance profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "instance-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddUserToGroup",
                "description": "Grants permission to add an IAM user to the specified IAM group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachGroupPolicy",
                "description": "Grants permission to attach a managed policy to the specified IAM group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PolicyARN"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachRolePolicy",
                "description": "Grants permission to attach a managed policy to the specified IAM role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PolicyARN",
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachUserPolicy",
                "description": "Grants permission to attach a managed policy to the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PolicyARN",
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ChangePassword",
                "description": "Grants permission for an IAM user to to change their own password",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccessKey",
                "description": "Grants permission to create access key and secret access key for the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccountAlias",
                "description": "Grants permission to create an alias for your AWS account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Grants permission to create a new group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstanceProfile",
                "description": "Grants permission to create a new instance profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "instance-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoginProfile",
                "description": "Grants permission to create a password for the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOpenIDConnectProvider",
                "description": "Grants permission to create an IAM resource that describes an identity provider (IdP) that supports OpenID Connect (OIDC)",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "oidc-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePolicy",
                "description": "Grants permission to create a new managed policy",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePolicyVersion",
                "description": "Grants permission to create a new version of the specified managed policy",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRole",
                "description": "Grants permission to create a new role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSAMLProvider",
                "description": "Grants permission to create an IAM resource that describes an identity provider (IdP) that supports SAML 2.0",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "saml-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateServiceLinkedRole",
                "description": "Grants permission to create an IAM role that allows an AWS service to perform actions on your behalf",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:AWSServiceName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateServiceSpecificCredential",
                "description": "Grants permission to create a new service-specific credential for an IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Grants permission to create a new IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVirtualMFADevice",
                "description": "Grants permission to create a new virtual MFA device",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "mfa*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeactivateMFADevice",
                "description": "Grants permission to deactivate the specified MFA device and remove its association with the IAM user for which it was originally enabled",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccessKey",
                "description": "Grants permission to delete the access key pair that is associated with the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccountAlias",
                "description": "Grants permission to delete the specified AWS account alias",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccountPasswordPolicy",
                "description": "Grants permission to delete the password policy for the AWS account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Grants permission to delete the specified IAM group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroupPolicy",
                "description": "Grants permission to delete the specified inline policy from its group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInstanceProfile",
                "description": "Grants permission to delete the specified instance profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "instance-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoginProfile",
                "description": "Grants permission to delete the password for the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOpenIDConnectProvider",
                "description": "Grants permission to delete an OpenID Connect identity provider (IdP) resource object in IAM",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "oidc-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicy",
                "description": "Grants permission to delete the specified managed policy and remove it from any IAM entities (users, groups, or roles) to which it is attached",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicyVersion",
                "description": "Grants permission to delete a version from the specified managed policy",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRole",
                "description": "Grants permission to delete the specified role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRolePermissionsBoundary",
                "description": "Grants permission to remove the permissions boundary from a role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRolePolicy",
                "description": "Grants permission to delete the specified inline policy from the specified role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSAMLProvider",
                "description": "Grants permission to delete a SAML provider resource in IAM",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "saml-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSSHPublicKey",
                "description": "Grants permission to delete the specified SSH public key",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServerCertificate",
                "description": "Grants permission to delete the specified server certificate",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "server-certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServiceLinkedRole",
                "description": "Grants permission to delete an IAM role that is linked to a specific AWS service, if the service is no longer using it",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServiceSpecificCredential",
                "description": "Grants permission to delete the specified service-specific credential for an IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSigningCertificate",
                "description": "Grants permission to delete a signing certificate that is associated with the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Grants permission to delete the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserPermissionsBoundary",
                "description": "Grants permission to remove the permissions boundary from the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserPolicy",
                "description": "Grants permission to delete the specified inline policy from an IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVirtualMFADevice",
                "description": "Grants permission to delete a virtual MFA device",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "mfa",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "sms-mfa",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachGroupPolicy",
                "description": "Grants permission to detach a managed policy from the specified IAM group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PolicyARN"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachRolePolicy",
                "description": "Grants permission to detach a managed policy from the specified role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PolicyARN",
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachUserPolicy",
                "description": "Grants permission to detach a managed policy from the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PolicyARN",
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableMFADevice",
                "description": "Grants permission to enable an MFA device and associate it with the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateCredentialReport",
                "description": "Grants permission to generate a credential report for the AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateOrganizationsAccessReport",
                "description": "Grants permission to generate an access report for an AWS Organizations entity",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "access-report*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "organizations:DescribePolicy",
                            "organizations:ListChildren",
                            "organizations:ListParents",
                            "organizations:ListPoliciesForTarget",
                            "organizations:ListRoots",
                            "organizations:ListTargetsForPolicy"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:OrganizationsPolicyId"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateServiceLastAccessedDetails",
                "description": "Grants permission to generate a service last accessed data report for an IAM resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccessKeyLastUsed",
                "description": "Grants permission to retrieve information about when the specified access key was last used",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountAuthorizationDetails",
                "description": "Grants permission to retrieve information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountPasswordPolicy",
                "description": "Grants permission to retrieve the password policy for the AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountSummary",
                "description": "Grants permission to retrieve information about IAM entity usage and IAM quotas in the AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContextKeysForCustomPolicy",
                "description": "Grants permission to retrieve a list of all of the context keys that are referenced in the specified policy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContextKeysForPrincipalPolicy",
                "description": "Grants permission to retrieve a list of all context keys that are referenced in all IAM policies that are attached to the specified IAM identity (user, group, or role)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "role",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCredentialReport",
                "description": "Grants permission to retrieve a credential report for the AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroup",
                "description": "Grants permission to retrieve a list of IAM users in the specified IAM group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroupPolicy",
                "description": "Grants permission to retrieve an inline policy document that is embedded in the specified IAM group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceProfile",
                "description": "Grants permission to retrieve information about the specified instance profile, including the instance profile's path, GUID, ARN, and role",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "instance-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoginProfile",
                "description": "Grants permission to retrieve the user name and password creation date for the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOpenIDConnectProvider",
                "description": "Grants permission to retrieve information about the specified OpenID Connect (OIDC) provider resource in IAM",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "oidc-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOrganizationsAccessReport",
                "description": "Grants permission to retrieve an AWS Organizations access report",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicy",
                "description": "Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicyVersion",
                "description": "Grants permission to retrieve information about a version of the specified managed policy, including the policy document",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRole",
                "description": "Grants permission to retrieve information about the specified role, including the role's path, GUID, ARN, and the role's trust policy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRolePolicy",
                "description": "Grants permission to retrieve an inline policy document that is embedded with the specified IAM role",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSAMLProvider",
                "description": "Grants permission to retrieve the SAML provider metadocument that was uploaded when the IAM SAML provider resource was created or updated",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "saml-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSSHPublicKey",
                "description": "Grants permission to retrieve the specified SSH public key, including metadata about the key",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServerCertificate",
                "description": "Grants permission to retrieve information about the specified server certificate stored in IAM",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "server-certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceLastAccessedDetails",
                "description": "Grants permission to retrieve information about the service last accessed data report",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceLastAccessedDetailsWithEntities",
                "description": "Grants permission to retrieve information about the entities from the service last accessed data report",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceLinkedRoleDeletionStatus",
                "description": "Grants permission to retrieve an IAM service-linked role deletion status",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUser",
                "description": "Grants permission to retrieve information about the specified IAM user, including the user's creation date, path, unique ID, and ARN",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserPolicy",
                "description": "Grants permission to retrieve an inline policy document that is embedded in the specified IAM user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccessKeys",
                "description": "Grants permission to list information about the access key IDs that are associated with the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccountAliases",
                "description": "Grants permission to list the account alias that is associated with the AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttachedGroupPolicies",
                "description": "Grants permission to list all managed policies that are attached to the specified IAM group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttachedRolePolicies",
                "description": "Grants permission to list all managed policies that are attached to the specified IAM role",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttachedUserPolicies",
                "description": "Grants permission to list all managed policies that are attached to the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEntitiesForPolicy",
                "description": "Grants permission to list all IAM identities to which the specified managed policy is attached",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupPolicies",
                "description": "Grants permission to list the names of the inline policies that are embedded in the specified IAM group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Grants permission to list the IAM groups that have the specified path prefix",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupsForUser",
                "description": "Grants permission to list the IAM groups that the specified IAM user belongs to",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstanceProfiles",
                "description": "Grants permission to list the instance profiles that have the specified path prefix",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "instance-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstanceProfilesForRole",
                "description": "Grants permission to list the instance profiles that have the specified associated IAM role",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMFADevices",
                "description": "Grants permission to list the MFA devices for an IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOpenIDConnectProviders",
                "description": "Grants permission to list information about the IAM OpenID Connect (OIDC) provider resource objects that are defined in the AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicies",
                "description": "Grants permission to list all managed policies",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPoliciesGrantingServiceAccess",
                "description": "Grants permission to list information about the policies that grant an entity access to a specific service",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicyVersions",
                "description": "Grants permission to list information about the versions of the specified managed policy, including the version that is currently set as the policy's default version",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRolePolicies",
                "description": "Grants permission to list the names of the inline policies that are embedded in the specified IAM role",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoleTags",
                "description": "Grants permission to list the tags that are attached to the specified IAM role.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoles",
                "description": "Grants permission to list the IAM roles that have the specified path prefix",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSAMLProviders",
                "description": "Grants permission to list the SAML provider resources in IAM",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSSHPublicKeys",
                "description": "Grants permission to list information about the SSH public keys that are associated with the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServerCertificates",
                "description": "Grants permission to list the server certificates that have the specified path prefix",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServiceSpecificCredentials",
                "description": "Grants permission to list the service-specific credentials that are associated with the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSigningCertificates",
                "description": "Grants permission to list information about the signing certificates that are associated with the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserPolicies",
                "description": "Grants permission to list the names of the inline policies that are embedded in the specified IAM user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserTags",
                "description": "Grants permission to list the tags that are attached to the specified IAM user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Grants permission to list the IAM users that have the specified path prefix",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVirtualMFADevices",
                "description": "Grants permission to list virtual MFA devices by assignment status",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PassRole",
                "description": "Grants permission to pass a role to a service",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:AssociatedResourceArn",
                            "iam:PassedToService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutGroupPolicy",
                "description": "Grants permission to create or update an inline policy document that is embedded in the specified IAM group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRolePermissionsBoundary",
                "description": "Grants permission to set a managed policy as a permissions boundary for a role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRolePolicy",
                "description": "Grants permission to create or update an inline policy document that is embedded in the specified IAM role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutUserPermissionsBoundary",
                "description": "Grants permission to set a managed policy as a permissions boundary for an IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutUserPolicy",
                "description": "Grants permission to create or update an inline policy document that is embedded in the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iam:PermissionsBoundary"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveClientIDFromOpenIDConnectProvider",
                "description": "Grants permission to remove the client ID (audience) from the list of client IDs in the specified IAM OpenID Connect (OIDC) provider resource",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "oidc-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveRoleFromInstanceProfile",
                "description": "Grants permission to remove an IAM role from the specified EC2 instance profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "instance-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveUserFromGroup",
                "description": "Grants permission to remove an IAM user from the specified group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetServiceSpecificCredential",
                "description": "Grants permission to reset the password for an existing service-specific credential for an IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResyncMFADevice",
                "description": "Grants permission to synchronize the specified MFA device with its IAM entity (user or role)",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDefaultPolicyVersion",
                "description": "Grants permission to set the version of the specified policy as the policy's default version",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetSecurityTokenServicePreferences",
                "description": "Grants permission to set the STS global endpoint token version",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SimulateCustomPolicy",
                "description": "Grants permission to simulate whether an identity-based policy or resource-based policy provides permissions for specific API operations and resources",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SimulatePrincipalPolicy",
                "description": "Grants permission to simulate whether an identity-based policy that is attached to a specified IAM entity (user or role) provides permissions for specific API operations and resources",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "role",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagRole",
                "description": "Grants permission to add tags to an IAM role.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagUser",
                "description": "Grants permission to add tags to an IAM user.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagRole",
                "description": "Grants permission to remove the specified tags from the role.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagUser",
                "description": "Grants permission to remove the specified tags from the user.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccessKey",
                "description": "Grants permission to update the status of the specified access key as Active or Inactive",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccountPasswordPolicy",
                "description": "Grants permission to update the password policy settings for the AWS account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssumeRolePolicy",
                "description": "Grants permission to update the policy that grants an IAM entity permission to assume a role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Grants permission to update the name or path of the specified IAM group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLoginProfile",
                "description": "Grants permission to change the password for the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateOpenIDConnectProviderThumbprint",
                "description": "Grants permission to update the entire list of server certificate thumbprints that are associated with an OpenID Connect (OIDC) provider resource",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "oidc-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRole",
                "description": "Grants permission to update the description or maximum session duration setting of a role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoleDescription",
                "description": "Grants permission to update only the description of a role",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSAMLProvider",
                "description": "Grants permission to update the metadata document for an existing SAML provider resource",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "saml-provider*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSSHPublicKey",
                "description": "Grants permission to update the status of an IAM user's SSH public key to active or inactive",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServerCertificate",
                "description": "Grants permission to update the name or the path of the specified server certificate stored in IAM",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "server-certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServiceSpecificCredential",
                "description": "Grants permission to update the status of a service-specific credential to active or inactive for an IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSigningCertificate",
                "description": "Grants permission to update the status of the specified user signing certificate to active or disabled",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Grants permission to update the name or the path of the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadSSHPublicKey",
                "description": "Grants permission to upload an SSH public key and associate it with the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadServerCertificate",
                "description": "Grants permission to upload a server certificate entity for the AWS account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "server-certificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadSigningCertificate",
                "description": "Grants permission to upload an X.509 signing certificate and associate it with the specified IAM user",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "access-report",
                "arn": "arn:${Partition}:iam::${Account}:access-report/${EntityPath}",
                "condition_keys": []
            },
            {
                "resource": "assumed-role",
                "arn": "arn:${Partition}:iam::${Account}:assumed-role/${RoleName}/${RoleSessionName}",
                "condition_keys": []
            },
            {
                "resource": "federated-user",
                "arn": "arn:${Partition}:iam::${Account}:federated-user/${UserName}",
                "condition_keys": []
            },
            {
                "resource": "group",
                "arn": "arn:${Partition}:iam::${Account}:group/${GroupNameWithPath}",
                "condition_keys": []
            },
            {
                "resource": "instance-profile",
                "arn": "arn:${Partition}:iam::${Account}:instance-profile/${InstanceProfileNameWithPath}",
                "condition_keys": []
            },
            {
                "resource": "mfa",
                "arn": "arn:${Partition}:iam::${Account}:mfa/${Path}/${MfaTokenId}",
                "condition_keys": []
            },
            {
                "resource": "oidc-provider",
                "arn": "arn:${Partition}:iam::${Account}:oidc-provider/${OidcProviderName}",
                "condition_keys": []
            },
            {
                "resource": "policy",
                "arn": "arn:${Partition}:iam::${Account}:policy/${PolicyNameWithPath}",
                "condition_keys": []
            },
            {
                "resource": "role",
                "arn": "arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}",
                "condition_keys": [
                    "iam:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "saml-provider",
                "arn": "arn:${Partition}:iam::${Account}:saml-provider/${SamlProviderName}",
                "condition_keys": []
            },
            {
                "resource": "server-certificate",
                "arn": "arn:${Partition}:iam::${Account}:server-certificate/${CertificateNameWithPath}",
                "condition_keys": []
            },
            {
                "resource": "sms-mfa",
                "arn": "arn:${Partition}:iam::${Account}:sms-mfa/${MfaTokenIdWithPath}",
                "condition_keys": []
            },
            {
                "resource": "user",
                "arn": "arn:${Partition}:iam::${Account}:user/${UserNameWithPath}",
                "condition_keys": [
                    "iam:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "iam:AWSServiceName",
                "description": "Filters access by the AWS service to which this role is attached",
                "type": "String"
            },
            {
                "condition": "iam:AssociatedResourceArn",
                "description": "Filters by the resource that the role will be used on behalf of",
                "type": "ARN"
            },
            {
                "condition": "iam:OrganizationsPolicyId",
                "description": "Filters access by the ID of an AWS Organizations policy",
                "type": "String"
            },
            {
                "condition": "iam:PassedToService",
                "description": "Filters access by the AWS service to which this role is passed",
                "type": "String"
            },
            {
                "condition": "iam:PermissionsBoundary",
                "description": "Filters access if the specified policy is set as the permissions boundary on the IAM entity (user or role)",
                "type": "String"
            },
            {
                "condition": "iam:PolicyARN",
                "description": "Filters access by the ARN of an IAM policy",
                "type": "ARN"
            },
            {
                "condition": "iam:ResourceTag/${TagKey}",
                "description": "Filters access by the tags attached to an IAM entity (user or role).",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon EC2 Image Builder",
        "prefix": "imagebuilder",
        "privileges": [
            {
                "privilege": "CancelImageCreation",
                "description": "Cancel an image creation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateComponent",
                "description": "Create a new component",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "kmsKey",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDistributionConfiguration",
                "description": "Create a new distribution configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distributionConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImage",
                "description": "Create a new image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "imagebuilder:GetImageRecipe",
                            "imagebuilder:GetInfrastructureConfiguration"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImagePipeline",
                "description": "Create a new image pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "imagePipeline*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "imagebuilder:GetImageRecipe"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImageRecipe",
                "description": "Create a new Image Recipe",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "imageRecipe*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "imagebuilder:GetComponent"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInfrastructureConfiguration",
                "description": "Create a new infrastructure configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "infrastructureConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteComponent",
                "description": "Delete a component",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDistributionConfiguration",
                "description": "Delete a distribution configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distributionConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImage",
                "description": "Delete an image",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImagePipeline",
                "description": "Delete an image pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "imagePipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImageRecipe",
                "description": "Grants permission to delete an image recipe",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "imageRecipe*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInfrastructureConfiguration",
                "description": "Delete an infrastructure configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "infrastructureConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComponent",
                "description": "View details about a component",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComponentPolicy",
                "description": "View the resource policy associated with a component",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDistributionConfiguration",
                "description": "View details about a distribution configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "distributionConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImage",
                "description": "View details about an image",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImagePipeline",
                "description": "View details about an image pipeline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "imagePipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImagePolicy",
                "description": "View the resource policy associated with an image",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImageRecipe",
                "description": "View details about an image recipe",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "imageRecipe*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImageRecipePolicy",
                "description": "View the resource policy associated with an image recipe",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "imageRecipe*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInfrastructureConfiguration",
                "description": "View details about an infrastructure configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "infrastructureConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListComponentBuildVersions",
                "description": "List the component build versions in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "componentVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListComponents",
                "description": "List the component versions owned by or shared with your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDistributionConfigurations",
                "description": "List the distribution configurations in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListImageBuildVersions",
                "description": "List the image build versions in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "imageVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListImagePipelines",
                "description": "List the image pipelines in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListImageRecipes",
                "description": "List the image recipes owned by or shared with your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListImages",
                "description": "List the image versions owned by or shared with your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInfrastructureConfigurations",
                "description": "List the infrastructure configurations in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tag for an Image Builder resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "component",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "distributionConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "imagePipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "imageRecipe",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "infrastructureConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutComponentPolicy",
                "description": "Set the resource policy associated with a component",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutImagePolicy",
                "description": "Set the resource policy associated with an image",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "image*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutImageRecipePolicy",
                "description": "Set the resource policy associated with an image recipe",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "imageRecipe*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartImagePipelineExecution",
                "description": "Create a new image from a pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "imagePipeline*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "imagebuilder:GetImagePipeline"
                        ]
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tag an Image Builder resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "component",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "distributionConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "imagePipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "imageRecipe",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "infrastructureConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untag an Image Builder resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "component",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "distributionConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "image",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "imagePipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "imageRecipe",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "infrastructureConfiguration",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDistributionConfiguration",
                "description": "Update an existing distribution configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "distributionConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateImagePipeline",
                "description": "Update an existing image pipeline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "imagePipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInfrastructureConfiguration",
                "description": "Update an existing infrastructure configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "infrastructureConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "component",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:component/${ComponentName}/${ComponentVersion}/${ComponentBuildVersion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "componentVersion",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:component/${ComponentName}/${ComponentVersion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "distributionConfiguration",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:distribution-configuration/${DistributionConfigurationName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "image",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:image/${ImageName}/${ImageVersion}/${ImageBuildVersion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "imageVersion",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:image/${ImageName}/${ImageVersion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "imageRecipe",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:image-recipe/${ImageRecipeName}/${ImageRecipeVersion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "imagePipeline",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:image-pipeline/${ImagePipelineName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "infrastructureConfiguration",
                "arn": "arn:${Partition}:imagebuilder:${Region}:${Account}:infrastructure-configuration/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "kmsKey",
                "arn": "arn:${Partition}:kms:${Region}:${Account}:key/${KeyId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions by the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions by tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions by the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Import Export Disk Service",
        "prefix": "importexport",
        "privileges": [
            {
                "privilege": "CancelJob",
                "description": "This action cancels a specified job. Only the job owner can cancel it. The action fails if the job has already started or is complete.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "This action initiates the process of scheduling an upload or download of your data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetShippingLabel",
                "description": "This action generates a pre-paid shipping label that you will use to ship your device to AWS for processing.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStatus",
                "description": "This action returns information about a job, including where the job is in the processing pipeline, the status of the results, and the signature value associated with the job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "This action returns the jobs associated with the requester.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJob",
                "description": "You use this action to change the parameters specified in the original manifest file by supplying a new manifest file.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Inspector",
        "prefix": "inspector",
        "privileges": [
            {
                "privilege": "AddAttributesToFindings",
                "description": "Assigns attributes (key and value pairs) to the findings that are specified by the ARNs of the findings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAssessmentTarget",
                "description": "Creates a new assessment target using the ARN of the resource group that is generated by CreateResourceGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAssessmentTemplate",
                "description": "Creates an assessment template for the assessment target that is specified by the ARN of the assessment target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResourceGroup",
                "description": "Creates a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAssessmentRun",
                "description": "Deletes the assessment run that is specified by the ARN of the assessment run.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAssessmentTarget",
                "description": "Deletes the assessment target that is specified by the ARN of the assessment target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAssessmentTemplate",
                "description": "Deletes the assessment template that is specified by the ARN of the assessment template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssessmentRuns",
                "description": "Describes the assessment runs that are specified by the ARNs of the assessment runs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssessmentTargets",
                "description": "Describes the assessment targets that are specified by the ARNs of the assessment targets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssessmentTemplates",
                "description": "Describes the assessment templates that are specified by the ARNs of the assessment templates.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCrossAccountAccessRole",
                "description": "Describes the IAM role that enables Amazon Inspector to access your AWS account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFindings",
                "description": "Describes the findings that are specified by the ARNs of the findings.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResourceGroups",
                "description": "Describes the resource groups that are specified by the ARNs of the resource groups.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRulesPackages",
                "description": "Describes the rules packages that are specified by the ARNs of the rules packages.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTelemetryMetadata",
                "description": "Information about the data that is collected for the specified assessment run.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssessmentRunAgents",
                "description": "Lists the agents of the assessment runs that are specified by the ARNs of the assessment runs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssessmentRuns",
                "description": "Lists the assessment runs that correspond to the assessment templates that are specified by the ARNs of the assessment templates.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssessmentTargets",
                "description": "Lists the ARNs of the assessment targets within this AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssessmentTemplates",
                "description": "Lists the assessment templates that correspond to the assessment targets that are specified by the ARNs of the assessment targets.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEventSubscriptions",
                "description": "Lists all the event subscriptions for the assessment template that is specified by the ARN of the assessment template.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFindings",
                "description": "Lists findings that are generated by the assessment runs that are specified by the ARNs of the assessment runs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRulesPackages",
                "description": "Lists all available Amazon Inspector rules packages.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists all tags associated with an assessment template.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PreviewAgents",
                "description": "Previews the agents installed on the EC2 instances that are part of the specified assessment target.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterCrossAccountAccessRole",
                "description": "Registers the IAM role that Amazon Inspector uses to list your EC2 instances at the start of the assessment run or when you call the PreviewAgents action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveAttributesFromFindings",
                "description": "Removes entire attributes (key and value pairs) from the findings that are specified by the ARNs of the findings where an attribute with the specified key exists.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetTagsForResource",
                "description": "Sets tags (key and value pairs) to the assessment template that is specified by the ARN of the assessment template.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartAssessmentRun",
                "description": "Starts the assessment run specified by the ARN of the assessment template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopAssessmentRun",
                "description": "Stops the assessment run that is specified by the ARN of the assessment run.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubscribeToEvent",
                "description": "Enables the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnsubscribeFromEvent",
                "description": "Disables the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssessmentTarget",
                "description": "Updates the assessment target that is specified by the ARN of the assessment target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS IoT",
        "prefix": "iot",
        "privileges": [
            {
                "privilege": "AcceptCertificateTransfer",
                "description": "Accepts a pending certificate transfer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddThingToBillingGroup",
                "description": "Adds a thing to the specified billing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddThingToThingGroup",
                "description": "Adds a thing to the specified thing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateTargetsWithJob",
                "description": "Associates a group with a continuous job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachPolicy",
                "description": "Attaches a policy to the specified target.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "cert",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachPrincipalPolicy",
                "description": "Attaches the specified policy to the specified principal (certificate or other credential).",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "cert",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachSecurityProfile",
                "description": "Associates a Device Defender security profile with a thing group or with this account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachThingPrincipal",
                "description": "Attaches the specified principal to the specified thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelAuditTask",
                "description": "Cancels an audit that is in progress. The audit can be either scheduled or on-demand.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelCertificateTransfer",
                "description": "Cancels a pending transfer for the specified certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelJob",
                "description": "Cancels a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelJobExecution",
                "description": "Cancels a job execution on a particular device.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ClearDefaultAuthorizer",
                "description": "Clears the default authorizer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CloseTunnel",
                "description": "Closes a tunnel.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "tunnel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "iot:Delete"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Connect",
                "description": "Connect as the specified client",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "client*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAuthorizer",
                "description": "Creates an authorizer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "authorizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBillingGroup",
                "description": "Creates a billing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCertificateFromCsr",
                "description": "Creates an X.509 certificate using the specified certificate signing request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDynamicThingGroup",
                "description": "Creates a Dynamic Thing Group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dynamicthinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Creates a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateKeysAndCertificate",
                "description": "Creates a 2048 bit RSA key pair and issues an X.509 certificate using the issued public key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOTAUpdate",
                "description": "Creates an OTA update job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "otaupdate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePolicy",
                "description": "Creates an AWS IoT policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePolicyVersion",
                "description": "Creates a new version of the specified AWS IoT policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProvisioningClaim",
                "description": "Creates a provisioning claim.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProvisioningTemplate",
                "description": "Creates a fleet provisioning template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProvisioningTemplateVersion",
                "description": "Creates a new version of a fleet provisioning template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRoleAlias",
                "description": "Creates a role alias.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rolealias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateScheduledAudit",
                "description": "Creates a scheduled audit that is run at a specified time interval.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "scheduledaudit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSecurityProfile",
                "description": "Creates a Device Defender security profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStream",
                "description": "Creates a new AWS IoT stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateThing",
                "description": "Creates a thing in the thing registry.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "billinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateThingGroup",
                "description": "Creates a thing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateThingType",
                "description": "Creates a new thing type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thingtype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTopicRule",
                "description": "Creates a rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccountAuditConfiguration",
                "description": "Deletes the audit configuration associated with the account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAuthorizer",
                "description": "Deletes the specified authorizer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "authorizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBillingGroup",
                "description": "Deletes the specified billing group.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCACertificate",
                "description": "Deletes a registered CA certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cacert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCertificate",
                "description": "Deletes the specified certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDynamicThingGroup",
                "description": "Deletes the specified Dynamic Thing Group",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "dynamicthinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJob",
                "description": "Deletes a job and its related job executions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJobExecution",
                "description": "Deletes a job execution.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOTAUpdate",
                "description": "Deletes an OTA update job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "otaupdate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicy",
                "description": "Deletes the specified policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicyVersion",
                "description": "Deletes the specified version of the specified policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProvisioningTemplate",
                "description": "Deletes a fleet provisioning template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProvisioningTemplateVersion",
                "description": "Deletes a fleet provisioning template version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegistrationCode",
                "description": "Deletes a CA certificate registration code.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRoleAlias",
                "description": "Deletes the specified role alias.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rolealias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScheduledAudit",
                "description": "Deletes a scheduled audit.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "scheduledaudit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSecurityProfile",
                "description": "Deletes a Device Defender security profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStream",
                "description": "Deletes a specified stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteThing",
                "description": "Deletes the specified thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteThingGroup",
                "description": "Deletes the specified thing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteThingShadow",
                "description": "Deletes the specified thing shadow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteThingType",
                "description": "Deletes the specified thing type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thingtype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTopicRule",
                "description": "Deletes the specified rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteV2LoggingLevel",
                "description": "Deletes the specified v2 logging level.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprecateThingType",
                "description": "Deprecates the specified thing type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thingtype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAuditConfiguration",
                "description": "Gets information about audit configurations for the account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAuditTask",
                "description": "Gets information about a Device Defender audit.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAuthorizer",
                "description": "Describes an authorizer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "authorizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBillingGroup",
                "description": "Gets information about the specified billing group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCACertificate",
                "description": "Describes a registered CA certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cacert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificate",
                "description": "Gets information about the specified certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDefaultAuthorizer",
                "description": "Describes the default authorizer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpoint",
                "description": "Returns a unique endpoint specific to the AWS account making the call.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventConfigurations",
                "description": "Returns account event configurations.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIndex",
                "description": "Gets information about the specified index.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJob",
                "description": "Describes a job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJobExecution",
                "description": "Describes a job execution.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisioningTemplate",
                "description": "Returns information about a fleet provisioning template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisioningTemplateVersion",
                "description": "Returns information about a fleet provisioning template version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRoleAlias",
                "description": "Describes a role alias.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rolealias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScheduledAudit",
                "description": "Gets information about a scheduled audit.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "scheduledaudit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSecurityProfile",
                "description": "Gets information about a Device Defender security profile.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStream",
                "description": "Gets information about the specified stream.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeThing",
                "description": "Gets information about the specified thing.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeThingGroup",
                "description": "Gets information about the specified thing group.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeThingRegistrationTask",
                "description": "Gets information about the bulk thing registration task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeThingType",
                "description": "Gets information about the specified thing type.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "thingtype*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTunnel",
                "description": "Describes a tunnel.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "tunnel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachPolicy",
                "description": "Detaches a policy from the specified target.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "cert",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachPrincipalPolicy",
                "description": "Removes the specified policy from the specified certificate.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "cert",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachSecurityProfile",
                "description": "Disassociates a Device Defender security profile from a thing group or from this account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachThingPrincipal",
                "description": "Detaches the specified principal from the specified thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableTopicRule",
                "description": "Disables the specified rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableTopicRule",
                "description": "Enables the specified rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCardinality",
                "description": "Get cardinality for IoT fleet index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEffectivePolicies",
                "description": "Gets effective policies.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cert",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIndexingConfiguration",
                "description": "Gets current fleet indexing configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobDocument",
                "description": "Gets a job document.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoggingOptions",
                "description": "Gets the logging options.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOTAUpdate",
                "description": "Gets the information about the OTA update job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "otaupdate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPendingJobExecutions",
                "description": "Gets the list of all jobs for a thing that are not in a terminal state.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPercentiles",
                "description": "Get percentiles for IoT fleet index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicy",
                "description": "Gets information about the specified policy with the policy document of the default version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicyVersion",
                "description": "Gets information about the specified policy version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegistrationCode",
                "description": "Gets a registration code used to register a CA certificate with AWS IoT.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStatistics",
                "description": "Get statistics for IoT fleet index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetThingShadow",
                "description": "Gets the thing shadow.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTopicRule",
                "description": "Gets information about the specified rule.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetV2LoggingOptions",
                "description": "Gets v2 logging options.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActiveViolations",
                "description": "Lists the active violations for a given Device Defender security profile or Thing.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "securityprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttachedPolicies",
                "description": "Lists the policies attached to the specified thing group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAuditFindings",
                "description": "Lists the findings (results) of a Device Defender audit or of the audits performed during a specified time period.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAuditTasks",
                "description": "Lists the Device Defender audits that have been performed during a given time period.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAuthorizers",
                "description": "Lists the authorizers registered in your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBillingGroups",
                "description": "Lists all billing groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCACertificates",
                "description": "Lists the CA certificates registered for your AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCertificates",
                "description": "Lists your certificates.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCertificatesByCA",
                "description": "List the device certificates signed by the specified CA certificate.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIndices",
                "description": "Lists all indices for fleet index",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobExecutionsForJob",
                "description": "Lists the job executions for a job.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobExecutionsForThing",
                "description": "Lists the job executions for the specified thing.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Lists jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOTAUpdates",
                "description": "Lists OTA update jobs in the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOutgoingCertificates",
                "description": "Lists certificates that are being transfered but not yet accepted.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicies",
                "description": "Lists your policies.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicyPrincipals",
                "description": "Lists the principals associated with the specified policy.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicyVersions",
                "description": "Lists the versions of the specified policy, and identifies the default version.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPrincipalPolicies",
                "description": "Lists the policies attached to the specified principal. If you use an Amazon Cognito identity, the ID needs to be in Amazon Cognito Identity format.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPrincipalThings",
                "description": "Lists the things associated with the specified principal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisioningTemplateVersions",
                "description": "A list of fleet provisioning template versions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisioningTemplates",
                "description": "Lists the fleet provisioning templates in your AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoleAliases",
                "description": "Lists role aliases.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListScheduledAudits",
                "description": "Lists all of your scheduled audits.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSecurityProfiles",
                "description": "Lists the Device Defender security profiles you have created.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSecurityProfilesForTarget",
                "description": "Lists the Device Defender security profiles attached to a target.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreams",
                "description": "Lists the streams in your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists all tags for a given resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "billinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dynamicthinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "otaupdate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "scheduledaudit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "securityprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thingtype",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTargetsForPolicy",
                "description": "List targets for the specified policy.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTargetsForSecurityProfile",
                "description": "Lists the targets associated with a given Device Defender security profile.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingGroups",
                "description": "Lists all thing groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingGroupsForThing",
                "description": "List thing groups to which the specified thing belongs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingPrincipals",
                "description": "Lists the principals associated with the specified thing.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingRegistrationTaskReports",
                "description": "Lists information about bulk thing registration tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingRegistrationTasks",
                "description": "Lists bulk thing registration tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingTypes",
                "description": "Lists all thing types.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThings",
                "description": "Lists all things.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingsInBillingGroup",
                "description": "Lists all things in the specified billing group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListThingsInThingGroup",
                "description": "Lists all things in the specified thing group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTopicRules",
                "description": "Lists the rules for the specific topic.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTunnels",
                "description": "Lists tunnels.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListV2LoggingLevels",
                "description": "Lists the v2 logging levels.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListViolationEvents",
                "description": "Lists the Device Defender security profile violations discovered during the given time period.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "securityprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OpenTunnel",
                "description": "Opens a tunnel.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "iot:ThingGroupArn",
                            "iot:TunnelDestinationService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Publish",
                "description": "Publish to the specified topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Receive",
                "description": "Receive from the specified topic.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterCACertificate",
                "description": "Registers a CA certificate with AWS IoT.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterCertificate",
                "description": "Registers a device certificate with AWS IoT.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterThing",
                "description": "Registers your thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectCertificateTransfer",
                "description": "Rejects a pending certificate transfer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveThingFromBillingGroup",
                "description": "Removes thing from the specified billing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveThingFromThingGroup",
                "description": "Removes thing from the specified thing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplaceTopicRule",
                "description": "Replaces the specified rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchIndex",
                "description": "Search IoT fleet index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDefaultAuthorizer",
                "description": "Sets the default authorizer. This will be used if a websocket connection is made without specifying an authorizer.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "authorizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDefaultPolicyVersion",
                "description": "Sets the specified version of the specified policy as the policy's default (operative) version.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetLoggingOptions",
                "description": "Sets the logging options.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetV2LoggingLevel",
                "description": "Sets the v2 logging level.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetV2LoggingOptions",
                "description": "Sets the v2 logging options.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartNextPendingJobExecution",
                "description": "Gets and starts the next pending job execution for a thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartOnDemandAuditTask",
                "description": "Starts an on-demand Device Defender audit.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartThingRegistrationTask",
                "description": "Starts a bulk thing registration task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopThingRegistrationTask",
                "description": "Stops a bulk thing registration task.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Subscribe",
                "description": "Subscribe to the specified TopicFilter.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topicfilter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tag a specified resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "billinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dynamicthinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "otaupdate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "scheduledaudit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "securityprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thingtype",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestAuthorization",
                "description": "Test the policies evaluation for group policies",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cert",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestInvokeAuthorizer",
                "description": "Invoke the specified custom authorizer for testing purposes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "authorizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TransferCertificate",
                "description": "Transfers the specified certificate to the specified AWS account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untag a specified resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "billinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dynamicthinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "otaupdate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "scheduledaudit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "securityprofile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thingtype",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccountAuditConfiguration",
                "description": "Configures or reconfigures the Device Defender audit settings for this account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAuthorizer",
                "description": "Updates an authorizer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "authorizer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBillingGroup",
                "description": "Updates information associated with the specified billing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "billinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCACertificate",
                "description": "Updates a registered CA certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cacert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCertificate",
                "description": "Updates the status of the specified certificate. This operation is idempotent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cert*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDynamicThingGroup",
                "description": "Updates a Dynamic Thing Group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dynamicthinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEventConfigurations",
                "description": "Updates event configurations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIndexingConfiguration",
                "description": "Updates fleet indexing configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJob",
                "description": "Updates a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJobExecution",
                "description": "Updates a job execution.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProvisioningTemplate",
                "description": "Updates a fleet provisioning template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "provisioningtemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRoleAlias",
                "description": "Updates the role alias",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rolealias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "role",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateScheduledAudit",
                "description": "Updates a scheduled audit, including what checks are performed and how often the audit takes place.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "scheduledaudit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSecurityProfile",
                "description": "Updates a Device Defender security profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securityprofile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStream",
                "description": "Updates the data for a stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateThing",
                "description": "Updates information associated with the specified thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateThingGroup",
                "description": "Updates information associated with the specified thing group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thinggroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateThingGroupsForThing",
                "description": "Updates the thing groups to which the thing belongs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "thinggroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateThingShadow",
                "description": "Updates the thing shadow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "thing*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateSecurityProfileBehaviors",
                "description": "Validates a Device Defender security profile behaviors specification.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "client",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:client/${ClientId}",
                "condition_keys": []
            },
            {
                "resource": "index",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:index/${IndexName}",
                "condition_keys": []
            },
            {
                "resource": "job",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:job/${JobId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "tunnel",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:tunnel/${TunnelId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "thing",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:thing/${ThingName}",
                "condition_keys": []
            },
            {
                "resource": "thinggroup",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:thinggroup/${ThingGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "billinggroup",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:billinggroup/${BillingGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dynamicthinggroup",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:thinggroup/${ThingGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "thingtype",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:thingtype/${ThingTypeName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "topic",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:topic/${TopicName}",
                "condition_keys": []
            },
            {
                "resource": "topicfilter",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:topicfilter/${TopicFilter}",
                "condition_keys": []
            },
            {
                "resource": "rolealias",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:rolealias/${RoleAlias}",
                "condition_keys": []
            },
            {
                "resource": "role",
                "arn": "arn:${Partition}:iam::${Account}:role/${Role}",
                "condition_keys": []
            },
            {
                "resource": "authorizer",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:authorizer/${AuthorizerName}",
                "condition_keys": []
            },
            {
                "resource": "policy",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:policy/${PolicyName}",
                "condition_keys": []
            },
            {
                "resource": "cert",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:cert/${Certificate}",
                "condition_keys": []
            },
            {
                "resource": "cacert",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:cacert/${CACertificate}",
                "condition_keys": []
            },
            {
                "resource": "stream",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:stream/${streamId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "otaupdate",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:otaupdate/${otaUpdateId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "scheduledaudit",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:scheduledaudit/${ScheduleName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "securityprofile",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:securityprofile/${SecurityProfileName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "rule",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:rule/${ruleName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "provisioningtemplate",
                "arn": "arn:${Partition}:iot:${Region}:${Account}:provisioningtemplate/${provisioningTemplate}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A tag key that is present in the request that the user makes to IoT.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "The tag key component of a tag attached to an IoT resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "iot:Delete",
                "description": "The flag indicating whether or not to also delete an IoT Tunnel immediately",
                "type": "Bool"
            },
            {
                "condition": "iot:ThingGroupArn",
                "description": "The list of all IoT Thing Group ARNs that the destination IoT Thing belongs to for an IoT Tunnel",
                "type": "String"
            },
            {
                "condition": "iot:TunnelDestinationService",
                "description": "The list of all destination services for an IoT Tunnel",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IoT Device Tester",
        "prefix": "iot-device-tester",
        "privileges": [
            {
                "privilege": "CheckVersion",
                "description": "Grants permission for IoT Device Tester to check if a given set of product, test suite and device tester version are compatible",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DownloadTestSuite",
                "description": "Grants permission for IoT Device Tester to download compatible test suite versions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LatestIdt",
                "description": "Grants permission for IoT Device Tester to get information on latest version of device tester available",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendMetrics",
                "description": "Grants permissions for IoT Device Tester to send usage metrics on your behalf",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SupportedVersion",
                "description": "Grants permission for IoT Device Tester to get list of supported products and test suite versions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS IoT 1-Click",
        "prefix": "iot1click",
        "privileges": [
            {
                "privilege": "AssociateDeviceWithPlacement",
                "description": "Associate a device to a placement",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ClaimDevicesByClaimCode",
                "description": "Claim a batch of devices with a claim code.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlacement",
                "description": "Create a new placement in a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Create a new project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePlacement",
                "description": "Delete a placement from a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Delete a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDevice",
                "description": "Describe a device",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePlacement",
                "description": "Describe a placement",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProject",
                "description": "Describe a project",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDeviceFromPlacement",
                "description": "Disassociate a device from a placement",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "FinalizeDeviceClaim",
                "description": "Finalize a device claim",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeviceMethods",
                "description": "Get available methods of a device",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevicesInPlacement",
                "description": "Get devices associated to a placement",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateDeviceClaim",
                "description": "Initialize a device claim",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InvokeDeviceMethod",
                "description": "Invoke a device method",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeviceEvents",
                "description": "List past events published by a device",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevices",
                "description": "List all devices",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPlacements",
                "description": "List placements in a project",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "List all projects",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the tags (metadata) which you have assigned to the resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnclaimDevice",
                "description": "Unclaim a device",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the given tags (metadata) from the resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDeviceState",
                "description": "Update device state",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePlacement",
                "description": "Update a placement",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Update a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "device",
                "arn": "arn:${Partition}:iot1click:${Region}:${Account}:devices/${DeviceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "project",
                "arn": "arn:${Partition}:iot1click:${Region}:${Account}:projects/${ProjectName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A tag key that is present in the request that the user makes to IoT 1-Click.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "The preface string for a tag key and value pair attached to an IoT 1-Click resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the IoT 1-Click resource in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IoT Analytics",
        "prefix": "iotanalytics",
        "privileges": [
            {
                "privilege": "BatchPutMessage",
                "description": "Puts a batch of messages into the specified channel.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelPipelineReprocessing",
                "description": "Cancels reprocessing for the specified pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateChannel",
                "description": "Creates a channel.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataset",
                "description": "Creates a dataset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatasetContent",
                "description": "Generates content of the specified dataset (by executing the dataset actions).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatastore",
                "description": "Creates a datastore.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datastore*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePipeline",
                "description": "Creates a pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteChannel",
                "description": "Deletes the specified channel.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataset",
                "description": "Deletes the specified dataset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDatasetContent",
                "description": "Deletes the content of the specified dataset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDatastore",
                "description": "Deletes the specified datastore.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datastore*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePipeline",
                "description": "Deletes the specified pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChannel",
                "description": "Describes the specified channel.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataset",
                "description": "Describes the specified dataset.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDatastore",
                "description": "Describes the specified datastore.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datastore*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoggingOptions",
                "description": "Describes logging options for the the account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePipeline",
                "description": "Describes the specified pipeline.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDatasetContent",
                "description": "Gets the content of the specified dataset.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChannels",
                "description": "Lists the channels for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasets",
                "description": "Lists the datasets for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatastores",
                "description": "Lists the datastores for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPipelines",
                "description": "Lists the pipelines for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the tags (metadata) which you have assigned to the resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dataset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datastore",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLoggingOptions",
                "description": "Puts logging options for the the account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RunPipelineActivity",
                "description": "Runs the specified pipeline activity.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SampleChannelData",
                "description": "Samples the specified channel's data.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartPipelineReprocessing",
                "description": "Starts reprocessing for the specified pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dataset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datastore",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the given tags (metadata) from the resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dataset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datastore",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pipeline",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateChannel",
                "description": "Updates the specified channel.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDataset",
                "description": "Updates the specified dataset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDatastore",
                "description": "Updates the specified datastore.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datastore*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePipeline",
                "description": "Updates the specified pipeline.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pipeline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "channel",
                "arn": "arn:${Partition}:iotanalytics:${Region}:${Account}:channel/${ChannelName}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "iotanalytics:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dataset",
                "arn": "arn:${Partition}:iotanalytics:${Region}:${Account}:dataset/${DatasetName}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "iotanalytics:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "datastore",
                "arn": "arn:${Partition}:iotanalytics:${Region}:${Account}:datastore/${DatastoreName}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "iotanalytics:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "pipeline",
                "arn": "arn:${Partition}:iotanalytics:${Region}:${Account}:pipeline/${PipelineName}",
                "condition_keys": [
                    "aws:RequestTag/${TagKey}",
                    "aws:TagKeys",
                    "iotanalytics:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A tag key that is present in the request that the user makes to IoT Analytics.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the IoT Analytics resource in the request.",
                "type": "String"
            },
            {
                "condition": "iotanalytics:ResourceTag/${TagKey}",
                "description": "The preface string for a tag key and value pair attached to an IoT Analytics resource.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IoT Events",
        "prefix": "iotevents",
        "privileges": [
            {
                "privilege": "BatchPutMessage",
                "description": "Sends a set of messages to the AWS IoT Events system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchUpdateDetector",
                "description": "Update an detector within the AWS IoT Events system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDetectorModel",
                "description": "Creates a detector model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInput",
                "description": "Creates an input.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDetectorModel",
                "description": "Deletes a detector model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInput",
                "description": "Deletes an input.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDetector",
                "description": "Returns information about the specified detector (instance).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDetectorModel",
                "description": "Describes a detector model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInput",
                "description": "Describes an input.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoggingOptions",
                "description": "Retrieves the current settings of the AWS IoT Events logging options.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDetectorModelVersions",
                "description": "Lists all the versions of a detector model. Only the metadata associated with each detector model version is returned.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDetectorModels",
                "description": "Lists the detector models you have created. Only the metadata associated with each detector model is returned.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDetectors",
                "description": "Lists detectors (the instances of a detector model).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInputs",
                "description": "Lists the inputs you have created.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the tags (metadata) which you have assigned to the resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "detectorModel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLoggingOptions",
                "description": "Sets or updates the AWS IoT Events logging options.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "detectorModel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes the given tags (metadata) from the resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "detectorModel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDetectorModel",
                "description": "Updates a detector model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "detectorModel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInput",
                "description": "Updates an input.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInputRouting",
                "description": "Updates input routing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "detectorModel",
                "arn": "arn:${Partition}:iotevents:${Region}:${Account}:detectorModel/${DetectorModelName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "input",
                "arn": "arn:${Partition}:iotevents:${Region}:${Account}:input/${inputName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A tag key that is present in the request that the user makes to IoT Events.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "The tag key by which a tag value is attached to an IoT Events resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the IoT Events resource in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IoT SiteWise",
        "prefix": "iotsitewise",
        "privileges": [
            {
                "privilege": "AssociateAssets",
                "description": "Associate child assets to the parent via specified model hiearchy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateViewEntities",
                "description": "Associates the specified entities within a view for the specified group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "asset",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchAssociateProjectAssets",
                "description": "Grants permission to associate assets to a specified project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDisassociateProjectAssets",
                "description": "Grants permission to disassociate assets from a specified project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchPutAssetPropertyValue",
                "description": "Puts batch of property values for the specified properties.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccessPolicy",
                "description": "Grants permission to create access policy for a specified portal or a project.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "portal",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAsset",
                "description": "Creates an asset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset-model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAssetModel",
                "description": "Creates an asset model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAssetTemplate",
                "description": "Creates an asset template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDashboard",
                "description": "Grants permission to create a dashboard within a specified project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Creates a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMeasurementDataStore",
                "description": "Registers a measurement data store.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMetricType",
                "description": "Creates a metric type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePortal",
                "description": "Grants permission to create a portal.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sso:CreateManagedApplicationInstance"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Grants permission to create a project within a specified portal.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "portal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateView",
                "description": "Creates a view.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccessPolicy",
                "description": "Grants permission to delete a specified access policy.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "access-policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAsset",
                "description": "Deletes the specified asset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAssetModel",
                "description": "Deletes the specified asset model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset-model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAssetTemplate",
                "description": "Deletes the specified asset template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset-template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDashboard",
                "description": "Grants permission to delete a specified dashboard.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Deletes the specified group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMeasurementDataStore",
                "description": "Deregisters the specified measurement data store.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "measurement-data-store*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMetricType",
                "description": "Deletes the specified metric type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "metric-type*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePortal",
                "description": "Grants permission to delete a specified portal.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "portal*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sso:DeleteManagedApplicationInstance"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Grants permission to delete a specified project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteView",
                "description": "Deletes the specified view.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterViewEntities",
                "description": "Deregisters the specified assets and groups from the specified view.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "asset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccessPolicy",
                "description": "Grants permission to describe a specified access policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "access-policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAsset",
                "description": "Describes the specified asset.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssetModel",
                "description": "Describes the specified asset model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset-model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssetProperty",
                "description": "Describes the specified asset property.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssetTemplates",
                "description": "Describes the specified asset templates.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset-template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssets",
                "description": "Describes the specified assets.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDashboard",
                "description": "Grants permission to describe a specified dashboard.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGroups",
                "description": "Describes the groups for the account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoggingOptions",
                "description": "Describes the logging options for the account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMeasurementDataStores",
                "description": "Describes the specified measurement data stores.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "measurement-data-store*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMetricTypes",
                "description": "Describes the metric types for the account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "metric-type*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePortal",
                "description": "Grants permission to describe a specified portal.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "portal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProject",
                "description": "Grants permission to describe a specified project.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeViews",
                "description": "Describes the specified views.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateAssets",
                "description": "Disassociate child assets from the parent for specified model hiearchy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateViewEntities",
                "description": "Disassociates the specified entities within a view for the specified group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "asset",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssetPropertyAggregates",
                "description": "Fetches the aggregated property values for the specified property.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssetPropertyValue",
                "description": "Fetches the latest property value for the specified property.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssetPropertyValueHistory",
                "description": "Fetches the property value history for the specified property.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMeasurementData",
                "description": "Fetches the measurement data for the specified measurement and time interval.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "measurement*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMetricData",
                "description": "Fetches the metric data for the specified metric and time interval.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "metric*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccessPolicies",
                "description": "Grants permission to list access policies for a specified portal or a project.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "portal",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "project",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssetModels",
                "description": "Lists the asset models for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssetTemplates",
                "description": "Lists the asset templates for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssets",
                "description": "Lists the assets for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "asset-model",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociatedAssets",
                "description": "Lists the assets associated to the parent via specified model hiearchy.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDashboards",
                "description": "Grants permission to list dashboards within a specified project.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Lists the groups for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeasurementDataStores",
                "description": "Lists the measurement data stores for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMeasurementDataStreams",
                "description": "Lists the measurement data streams for the specified measurement data store.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "measurement-data-store*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMetricTypes",
                "description": "Lists the metric types for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPortals",
                "description": "Grants permission to list portals in the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjectAssets",
                "description": "Grants permission to list assets associated with a specified project.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "Grants permission to list projects within a specified portal.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "portal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListViewEntities",
                "description": "Lists the assets and groups for the specified view.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "asset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListViews",
                "description": "Lists the views for the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLoggingOptions",
                "description": "Sets the logging options.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterViewEntities",
                "description": "Registers the specified assets and groups with the specified view.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "asset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "group",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccessPolicy",
                "description": "Grants permission to update a specified access policy.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "access-policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAsset",
                "description": "Updates the specified asset.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssetModel",
                "description": "Updates the specified asset model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset-model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssetProperty",
                "description": "Updates the specified asset property.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssetTemplate",
                "description": "Updates the specified asset template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "asset-template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDashboard",
                "description": "Grants permission to update a specified dashboard.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Updates the specified group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMeasurementDataStore",
                "description": "Updates metadata about the measurement data store.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "measurement-data-store*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePortal",
                "description": "Grants permission to update a specified portal.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "portal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Grants permission to update a specified project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateView",
                "description": "Updates the specified view.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "view*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "asset",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:asset/${AssetId}",
                "condition_keys": []
            },
            {
                "resource": "asset-template",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:asset-template/${AssetTemplateId}",
                "condition_keys": []
            },
            {
                "resource": "asset-model",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:asset-model/${AssetModelId}",
                "condition_keys": []
            },
            {
                "resource": "gateway",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:gateway/${GatewayId}",
                "condition_keys": []
            },
            {
                "resource": "group",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:group/${GroupId}",
                "condition_keys": []
            },
            {
                "resource": "measurement",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:measurement/${MeasurementId}",
                "condition_keys": []
            },
            {
                "resource": "measurement-data-store",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:measurement-data-store/${MeasurementDataStoreId}",
                "condition_keys": []
            },
            {
                "resource": "metric",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:metric/${MetricId}",
                "condition_keys": []
            },
            {
                "resource": "metric-type",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:metric-type/${MetricTypeId}",
                "condition_keys": []
            },
            {
                "resource": "view",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:view/${ViewId}",
                "condition_keys": []
            },
            {
                "resource": "portal",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:portal/${PortalId}",
                "condition_keys": []
            },
            {
                "resource": "project",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:project/${ProjectId}",
                "condition_keys": []
            },
            {
                "resource": "dashboard",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:dashboard/${DashboardId}",
                "condition_keys": []
            },
            {
                "resource": "access-policy",
                "arn": "arn:${Partition}:iotsitewise:${Region}:${Account}:access-policy/${AccessPolicyId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "iotsitewise:assetHierarchyPath",
                "description": "String of asset IDs in the asset hierarchy separated by forward slash.",
                "type": "String"
            },
            {
                "condition": "iotsitewise:childAssetId",
                "description": "ID of an asset being associated as a child to another asset.",
                "type": "String"
            },
            {
                "condition": "iotsitewise:group",
                "description": "Group ID.",
                "type": "String"
            },
            {
                "condition": "iotsitewise:portal",
                "description": "Portal ID.",
                "type": "String"
            },
            {
                "condition": "iotsitewise:project",
                "description": "Project ID.",
                "type": "String"
            },
            {
                "condition": "iotsitewise:propertyId",
                "description": "Property ID.",
                "type": "String"
            },
            {
                "condition": "iotsitewise:user",
                "description": "User ID.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IoT Things Graph",
        "prefix": "iotthingsgraph",
        "privileges": [
            {
                "privilege": "AssociateEntityToThing",
                "description": "Associates a device with a concrete thing that is in the user's registry. A thing can be associated with only one device at a time. If you associate a thing with a new device id, its previous association will be removed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iot:DescribeThing",
                            "iot:DescribeThingGroup"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateFlowTemplate",
                "description": "Creates a workflow template. Workflows can be created only in the user's namespace. (The public namespace contains only entities.) The workflow can contain only entities in the specified namespace. The workflow is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSystemInstance",
                "description": "Creates an instance of a system with specified configurations and Things.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSystemTemplate",
                "description": "Creates a system. The system is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFlowTemplate",
                "description": "Deletes a workflow. Any new system or system instance that contains this workflow will fail to update or deploy. Existing system instances that contain the workflow will continue to run (since they use a snapshot of the workflow taken at the time of deploying the system instance).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Workflow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNamespace",
                "description": "Deletes the specified namespace. This action deletes all of the entities in the namespace. Delete the systems and flows in the namespace before performing this action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSystemInstance",
                "description": "Deletes a system instance. Only instances that have never been deployed, or that have been undeployed from the target can be deleted. Users can create a new system instance that has the same ID as a deleted system instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSystemTemplate",
                "description": "Deletes a system. New system instances can't contain the system after its deletion. Existing system instances that contain the system will continue to work because they use a snapshot of the system that is taken when it is deployed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "System*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeploySystemInstance",
                "description": "Deploys the system instance to the target specified in CreateSystemInstance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprecateFlowTemplate",
                "description": "Deprecates the specified workflow. This action marks the workflow for deletion. Deprecated flows can't be deployed, but existing system instances that use the flow will continue to run.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Workflow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprecateSystemTemplate",
                "description": "Deprecates the specified system.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "System*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNamespace",
                "description": "Gets the latest version of the user's namespace and the public version that it is tracking.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DissociateEntityFromThing",
                "description": "Dissociates a device entity from a concrete thing. The action takes only the type of the entity that you need to dissociate because only one entity of a particular type can be associated with a thing.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iot:DescribeThing",
                            "iot:DescribeThingGroup"
                        ]
                    }
                ]
            },
            {
                "privilege": "GetEntities",
                "description": "Gets descriptions of the specified entities. Uses the latest version of the user's namespace by default.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFlowTemplate",
                "description": "Gets the latest version of the DefinitionDocument and FlowTemplateSummary for the specified workflow.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Workflow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFlowTemplateRevisions",
                "description": "Gets revisions of the specified workflow. Only the last 100 revisions are stored. If the workflow has been deprecated, this action will return revisions that occurred before the deprecation. This action won't work for workflows that have been deleted.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Workflow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNamespaceDeletionStatus",
                "description": "Gets the status of a namespace deletion task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSystemInstance",
                "description": "Gets a system instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSystemTemplate",
                "description": "Gets a system.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "System*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSystemTemplateRevisions",
                "description": "Gets revisions made to the specified system template. Only the previous 100 revisions are stored. If the system has been deprecated, this action will return the revisions that occurred before its deprecation. This action won't work with systems that have been deleted.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "System*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUploadStatus",
                "description": "Gets the status of the specified upload.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFlowExecutionMessages",
                "description": "Lists details of a single workflow execution",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists all tags for a given resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchEntities",
                "description": "Searches for entities of the specified type. You can search for entities in your namespace and the public namespace that you're tracking.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchFlowExecutions",
                "description": "Searches for workflow executions of a system instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchFlowTemplates",
                "description": "Searches for summary information about workflows.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchSystemInstances",
                "description": "Searches for system instances in the user's account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchSystemTemplates",
                "description": "Searches for summary information about systems in the user's account. You can filter by the ID of a workflow to return only systems that use the specified workflow.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchThings",
                "description": "Searches for things associated with the specified entity. You can search by both device and device model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tag a specified resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UndeploySystemInstance",
                "description": "Removes the system instance and associated triggers from the target.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untag a specified resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "SystemInstance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFlowTemplate",
                "description": "Updates the specified workflow. All deployed systems and system instances that use the workflow will see the changes in the flow when it is redeployed. The workflow can contain only entities in the specified namespace.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Workflow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSystemTemplate",
                "description": "Updates the specified system. You don't need to run this action after updating a workflow. Any system instance that uses the system will see the changes in the system when it is redeployed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "System*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UploadEntityDefinitions",
                "description": "Asynchronously uploads one or more entity definitions to the user's namespace.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Workflow",
                "arn": "arn:${Partition}:iotthingsgraph:${Region}:${Account}:Workflow/${NamespacePath}",
                "condition_keys": []
            },
            {
                "resource": "System",
                "arn": "arn:${Partition}:iotthingsgraph:${Region}:${Account}:System/${NamespacePath}",
                "condition_keys": []
            },
            {
                "resource": "SystemInstance",
                "arn": "arn:${Partition}:iotthingsgraph:${Region}:${Account}:Deployment/${NamespacePath}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access by a key that is present in the request the user makes to the thingsgraph service.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access by a tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by the list of all the tag key names present in the request the user makes to the thingsgraph service.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS IQ",
        "prefix": "iq",
        "privileges": [
            {
                "privilege": "CreateProject",
                "description": "Grants permission to submit new project requests",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS IQ Permissions",
        "prefix": "iq-permission",
        "privileges": [
            {
                "privilege": "ApproveAccessGrant",
                "description": "Grants permission to approve an access grant",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Managed Streaming for Kafka",
        "prefix": "kafka",
        "privileges": [
            {
                "privilege": "CreateCluster",
                "description": "Grants permission to create a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": [
                            "ec2:DescribeSecurityGroups",
                            "ec2:DescribeSubnets",
                            "ec2:DescribeVpcs",
                            "iam:AttachRolePolicy",
                            "iam:CreateServiceLinkedRole",
                            "iam:PutRolePolicy",
                            "kms:CreateGrant",
                            "kms:DescribeKey"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateConfiguration",
                "description": "Grants permission to create a configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCluster",
                "description": "Grants permission to delete a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCluster",
                "description": "Grants permission to describe a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterOperation",
                "description": "Returns a description of the cluster operation specified by the ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfiguration",
                "description": "Grants permission to describe a configuration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationRevision",
                "description": "Grants permission to describe a configuration revision.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBootstrapBrokers",
                "description": "Grants permission to get connection details for the broker nodes in a cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusterOperations",
                "description": "Returns a list of all the operations that have been performed on the specified MSK cluster.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusters",
                "description": "Grants permission to return a list of all clusters in the current account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurations",
                "description": "Grants permission to return a list of all configurations in the current account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNodes",
                "description": "Grants permission to return a list of nodes in a cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags of a MSK resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag a MSK resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from a MSK resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "cluster",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBrokerStorage",
                "description": "Updates the storage size of the broker nodes of the cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateClusterConfiguration",
                "description": "Update Kafka configuration running on a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:kafka:${Region}:${Account}:cluster/${ClusterName}/${UUID}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filter requests based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filter actions based on tag-value associated with a MSK resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filter requests based on the presence of mandatory tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Kendra",
        "prefix": "kendra",
        "privileges": [
            {
                "privilege": "BatchDeleteDocument",
                "description": "Batch Delete document",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchPutDocument",
                "description": "Batch put document",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataSource",
                "description": "Create a data source",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFaq",
                "description": "Create an Faq",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIndex",
                "description": "Create an Index",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFaq",
                "description": "Delete an Faq",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "faq*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIndex",
                "description": "Delete an Index",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataSource",
                "description": "Describe a data source",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "data-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFaq",
                "description": "Describe an Faq",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "faq*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIndex",
                "description": "Describe an Index",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDataSourceSyncJobs",
                "description": "Get Data Source sync job history",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "data-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDataSources",
                "description": "List the data sources",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFaqs",
                "description": "List the Faqs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIndices",
                "description": "List the indexes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Query",
                "description": "Query documents and Faqs",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDataSourceSyncJob",
                "description": "Start Data Source sync job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "data-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDataSourceSyncJob",
                "description": "Stop Data Source sync job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "data-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubmitFeedback",
                "description": "Send feedback about a query results",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDataSource",
                "description": "Update a data source",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "data-source*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIndex",
                "description": "Update an Index",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "index*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "index",
                "arn": "arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}",
                "condition_keys": []
            },
            {
                "resource": "data-source",
                "arn": "arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/data-source/${DataSourceId}",
                "condition_keys": []
            },
            {
                "resource": "faq",
                "arn": "arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/faq/${FaqId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Kinesis",
        "prefix": "kinesis",
        "privileges": [
            {
                "privilege": "AddTagsToStream",
                "description": "Adds or updates tags for the specified Amazon Kinesis stream. Each stream can have up to 10 tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStream",
                "description": "Creates a Amazon Kinesis stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DecreaseStreamRetentionPeriod",
                "description": "Decreases the stream's retention period, which is the length of time data records are accessible after they are added to the stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStream",
                "description": "Deletes a stream and all its shards and data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterStreamConsumer",
                "description": "Deregisters a stream consumer with a Kinesis data stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "consumer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLimits",
                "description": "Describes the shard limits and usage for the account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStream",
                "description": "Describes the specified stream.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStreamConsumer",
                "description": "Gets the description of a registered stream consumer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "consumer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStreamSummary",
                "description": "Provides a summarized description of the specified Kinesis data stream without the shard list.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableEnhancedMonitoring",
                "description": "Disables enhanced monitoring.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableEnhancedMonitoring",
                "description": "API_EnableEnhancedMonitoring.html",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecords",
                "description": "Gets data records from a shard.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetShardIterator",
                "description": "Gets a shard iterator. A shard iterator expires five minutes after it is returned to the requester.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IncreaseStreamRetentionPeriod",
                "description": "Increases the stream's retention period, which is the length of time data records are accessible after they are added to the stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListShards",
                "description": "Lists the shards in a stream and provides information about each shard.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreamConsumers",
                "description": "Lists the stream consumers registered to receive data from a Kinesis stream using enhanced fan-out, and provides information about each consumer.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreams",
                "description": "Lists your streams.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForStream",
                "description": "Lists the tags for the specified Amazon Kinesis stream.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MergeShards",
                "description": "Merges two adjacent shards in a stream and combines them into a single shard to reduce the stream's capacity to ingest and transport data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRecord",
                "description": "Writes a single data record from a producer into an Amazon Kinesis stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRecords",
                "description": "Writes multiple data records from a producer into an Amazon Kinesis stream in a single call (also referred to as a PutRecords request).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterStreamConsumer",
                "description": "Registers a stream consumer with a Kinesis data stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "consumer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromStream",
                "description": "Description for SplitShard",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SplitShard",
                "description": "Description for SplitShard",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SubscribeToShard",
                "description": "Listening to a specific shard with enhanced fan-out.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "consumer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateShardCount",
                "description": "Updates the shard count of the specified stream to the specified number of shards.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "stream",
                "arn": "arn:${Partition}:kinesis:${Region}:${Account}:stream/${StreamName}",
                "condition_keys": []
            },
            {
                "resource": "consumer",
                "arn": "arn:${Partition}:kinesis:${Region}:${Account}:${StreamType}/${StreamName}/consumer/${ConsumerName}:${ConsumerCreationTimpstamp}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Kinesis Analytics",
        "prefix": "kinesisanalytics",
        "privileges": [
            {
                "privilege": "AddApplicationInput",
                "description": "Adds input to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationOutput",
                "description": "Adds output to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationReferenceDataSource",
                "description": "Adds reference data source to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplication",
                "description": "Creates an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Deletes the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationOutput",
                "description": "Deletes the specified output of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationReferenceDataSource",
                "description": "Deletes the specified reference data source of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplication",
                "description": "Describes the specified application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DiscoverInputSchema",
                "description": "Discovers the input schema for the application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplicationState",
                "description": "Grant permission to Kinesis Data Analytics console to display stream results for Kinesis Data Analytics SQL runtime applications.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "List applications for the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Fetch the tags associated with the application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartApplication",
                "description": "Starts the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopApplication",
                "description": "Stops the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to the application.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove the specified tags from the application.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Updates the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "application",
                "arn": "arn:${Partition}:kinesisanalytics:${Region}:${Account}:application/${ApplicationName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Kinesis Analytics V2",
        "prefix": "kinesisanalytics",
        "privileges": [
            {
                "privilege": "AddApplicationCloudWatchLoggingOption",
                "description": "Adds cloudwatch logging option to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationInput",
                "description": "Adds input to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationInputProcessingConfiguration",
                "description": "Adds input processing configuration to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationOutput",
                "description": "Adds output to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationReferenceDataSource",
                "description": "Adds reference data source to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddApplicationVpcConfiguration",
                "description": "Adds VPC configuration to the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplication",
                "description": "Creates an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplicationSnapshot",
                "description": "Creates a snapshot for an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Deletes the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationCloudWatchLoggingOption",
                "description": "Deletes the specified cloudwatch logging option of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationInputProcessingConfiguration",
                "description": "Deletes the specified input processing configuration of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationOutput",
                "description": "Deletes the specified output of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationReferenceDataSource",
                "description": "Deletes the specified reference data source of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationSnapshot",
                "description": "Deletes a snapshot for an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationVpcConfiguration",
                "description": "Deletes the specified VPC configuration of the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplication",
                "description": "Describes the specified application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplicationSnapshot",
                "description": "Describes an application snapshot.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DiscoverInputSchema",
                "description": "Discovers the input schema for the application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplicationSnapshots",
                "description": "Lists the snapshots for an application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "List applications for the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Fetch the tags associated with the application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartApplication",
                "description": "Starts the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopApplication",
                "description": "Stops the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to the application.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove the specified tags from the application.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Updates the application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "application*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "application",
                "arn": "arn:${Partition}:kinesisanalytics:${Region}:${Account}:application/${ApplicationName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Kinesis Video Streams",
        "prefix": "kinesisvideo",
        "privileges": [
            {
                "privilege": "ConnectAsMaster",
                "description": "Grants permission to connect as a master to the signaling channel specified by the endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConnectAsViewer",
                "description": "Grants permission to connect as a viewer to the signaling channel specified by the endpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSignalingChannel",
                "description": "Grants permission to create a signaling channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStream",
                "description": "Grants permission to create a Kinesis video stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSignalingChannel",
                "description": "Grants permission to delete an existing signaling channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStream",
                "description": "Grants permission to delete an existing Kinesis video stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSignalingChannel",
                "description": "Grants permission to describe the specified signaling channel",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStream",
                "description": "Grants permission to describe the specified Kinesis video stream",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDASHStreamingSessionURL",
                "description": "Grants permission to create a URL for MPEG-DASH video streaming",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataEndpoint",
                "description": "Grants permission to get an endpoint for a specified stream for either reading or writing media data to Kinesis Video Streams",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHLSStreamingSessionURL",
                "description": "Grants permission to create a URL for HLS video streaming",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIceServerConfig",
                "description": "Grants permission to get the ICE server configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMedia",
                "description": "Grants permission to return media content of a Kinesis video stream",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMediaForFragmentList",
                "description": "Grants permission to read and return media data only from persisted storage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSignalingChannelEndpoint",
                "description": "Grants permission to get endpoints for a specified combination of protocol and role for a signaling channel",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFragments",
                "description": "Grants permission to list the fragments from archival storage based on the pagination token or selector type with range specified",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSignalingChannels",
                "description": "Grants permission to list your signaling channels",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreams",
                "description": "Grants permission to list your Kinesis video streams",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to fetch the tags associated with your resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForStream",
                "description": "Grants permission to fetch the tags associated with Kinesis video stream",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMedia",
                "description": "Grants permission to send media data to a Kinesis video stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendAlexaOfferToMaster",
                "description": "Grants permission to send the Alexa SDP offer to the master",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to attach set of tags to your resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagStream",
                "description": "Grants permission to attach set of tags to your Kinesis video streams",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove one or more tags from your resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "stream",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagStream",
                "description": "Grants permission to remove one or more tags from your Kinesis video streams",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDataRetention",
                "description": "Grants permission to update the data retention period of your Kinesis video stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSignalingChannel",
                "description": "Grants permission to update an existing signaling channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStream",
                "description": "Grants permission to update an existing Kinesis video stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "stream",
                "arn": "arn:${Partition}:kinesisvideo:${Region}:${Account}:stream/${StreamName}/${CreationTime}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "channel",
                "arn": "arn:${Partition}:kinesisvideo:${Region}:${Account}:channel/${ChannelName}/${CreationTime}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters requests based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the stream.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters requests based on the presence of mandatory tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Key Management Service",
        "prefix": "kms",
        "privileges": [
            {
                "privilege": "CancelKeyDeletion",
                "description": "Controls permission to cancel the scheduled deletion of a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConnectCustomKeyStore",
                "description": "Controls permission to connect or reconnect a custom key store to its associated AWS CloudHSM cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAlias",
                "description": "Controls permission to create an alias for a customer master key (CMK). Aliases are optional friendly names that you can associate with customer master keys.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCustomKeyStore",
                "description": "Controls permission to create a custom key store that is associated with an AWS CloudHSM cluster that you own and manage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "cloudhsm:DescribeClusters"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateGrant",
                "description": "Controls permission to add a grant to a customer master key. You can use grants to add permissions without changing the key policy or IAM policy.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:GrantConstraintType",
                            "kms:GrantIsForAWSResource",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateKey",
                "description": "Controls permission to create a customer master key that can be used to protect data keys and other sensitive information.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:BypassPolicyLockoutSafetyCheck",
                            "kms:CustomerMasterKeySpec",
                            "kms:CustomerMasterKeyUsage",
                            "kms:KeyOrigin"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Decrypt",
                "description": "Controls permission to decrypt ciphertext that was encrypted under a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAlias",
                "description": "Controls permission to delete an alias. Aliases are optional friendly names that you can associate with customer master keys.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCustomKeyStore",
                "description": "Controls permission to delete a custom key store.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteImportedKeyMaterial",
                "description": "Controls permission to delete cryptographic material that you imported into a customer master key. This action makes the key unusable.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCustomKeyStores",
                "description": "Controls permission to view detailed information about custom key stores in the account and region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeKey",
                "description": "Controls permission to view detailed information about a customer master key.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableKey",
                "description": "Controls permission to disable a customer master key, which prevents it from being used in cryptographic operations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableKeyRotation",
                "description": "Controls permission to disable automatic rotation of a customer managed customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisconnectCustomKeyStore",
                "description": "Controls permission to disconnect the custom key store from its associated AWS CloudHSM cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableKey",
                "description": "Controls permission to change the state of a customer master key (CMK) to enabled. This allows the CMK to be used in cryptographic operations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableKeyRotation",
                "description": "Controls permission to enable automatic rotation of the cryptographic material in a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Encrypt",
                "description": "Controls permission to use the specified customer master key to encrypt data and data keys.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateDataKey",
                "description": "Controls permission to use the customer master key to generate data keys. You can use the data keys to encrypt data outside of AWS KMS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateDataKeyPair",
                "description": "Controls permission to use the customer master key to generate data key pairs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:DataKeyPairSpec",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateDataKeyPairWithoutPlaintext",
                "description": "Controls permission to use the customer master key to generate data key pairs. Unlike the GenerateDataKeyPair operation, this operation returns an encrypted private key without a plaintext copy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:DataKeyPairSpec",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateDataKeyWithoutPlaintext",
                "description": "Controls permission to use the customer master key to generate a data key. Unlike the GenerateDataKey operation, this operation returns an encrypted data key without a plaintext version of the data key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateRandom",
                "description": "Controls permission to get a cryptographically secure random byte string from AWS KMS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetKeyPolicy",
                "description": "Controls permission to view the key policy for the specified customer master key.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetKeyRotationStatus",
                "description": "Controls permission to determine whether automatic key rotation is enabled on the customer master key.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetParametersForImport",
                "description": "Controls permission to get data that is required to import cryptographic material into a customer managed key, including a public key and import token.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService",
                            "kms:WrappingAlgorithm",
                            "kms:WrappingKeySpec"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPublicKey",
                "description": "Controls permission to download the public key of an asymmetric customer master key.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportKeyMaterial",
                "description": "Controls permission to import cryptographic material into a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ExpirationModel",
                            "kms:ValidTo",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAliases",
                "description": "Controls permission to view the aliases that are defined in the account. Aliases are optional friendly names that you can associate with customer master keys.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGrants",
                "description": "Controls permission to view all grants for a customer master key.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:GrantIsForAWSResource",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListKeyPolicies",
                "description": "Controls permission to view the names of key policies for a customer master key.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListKeys",
                "description": "Controls permission to view the key ID and Amazon Resource Name (ARN) of all customer master keys in the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceTags",
                "description": "Controls permission to view all tags that are attached to a customer master key.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRetirableGrants",
                "description": "Controls permission to view grants in which the specified principal is the retiring principal. Other principals might be able to retire the grant and this principal might be able to retire other grants.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutKeyPolicy",
                "description": "Controls permission to replace the key policy for the specified customer master key.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:BypassPolicyLockoutSafetyCheck",
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReEncryptFrom",
                "description": "Controls permission to decrypt data as part of the process that decrypts and reencrypts the data within AWS KMS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ReEncryptOnSameKey",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReEncryptTo",
                "description": "Controls permission to encrypt data as part of the process that decrypts and reencrypts the data within AWS KMS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:EncryptionAlgorithm",
                            "kms:EncryptionContextKeys",
                            "kms:ReEncryptOnSameKey",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetireGrant",
                "description": "Controls permission to retire a grant. The RetireGrant operation is typically called by the grant user after they complete the tasks that the grant allowed them to perform.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeGrant",
                "description": "Controls permission to revoke a grant, which denies permission for all operations that depend on the grant.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:GrantIsForAWSResource",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ScheduleKeyDeletion",
                "description": "Controls permission to schedule deletion of a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Sign",
                "description": "Controls permission to produce a digital signature for a message.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:MessageType",
                            "kms:SigningAlgorithm",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Controls permission to create or update tags that are attached to a customer master key.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Controls permission to delete tags that are attached to a customer master key.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAlias",
                "description": "Controls permission to associate an alias with a different customer master key. An alias is an optional friendly name that you can associate with a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCustomKeyStore",
                "description": "Controls permission to change the properties of a custom key store.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateKeyDescription",
                "description": "Controls permission to delete or change the description of a customer master key.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Verify",
                "description": "Controls permission to use the specified customer master key to verify digital signatures.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "key*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "kms:CallerAccount",
                            "kms:MessageType",
                            "kms:SigningAlgorithm",
                            "kms:ViaService"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "alias",
                "arn": "arn:${Partition}:kms:${Region}:${Account}:alias/${Alias}",
                "condition_keys": []
            },
            {
                "resource": "key",
                "arn": "arn:${Partition}:kms:${Region}:${Account}:key/${KeyId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "kms:BypassPolicyLockoutSafetyCheck",
                "description": "Controls access to the CreateKey and PutKeyPolicy operations based on the value of the BypassPolicyLockoutSafetyCheck parameter in the request.",
                "type": "Bool"
            },
            {
                "condition": "kms:CallerAccount",
                "description": "Controls access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement.",
                "type": "String"
            },
            {
                "condition": "kms:CustomerMasterKeySpec",
                "description": "Controls access to an API operation based on the CustomerMasterKeySpec property of the CMK that is created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource.",
                "type": "String"
            },
            {
                "condition": "kms:CustomerMasterKeyUsage",
                "description": "Controls access to an API operation based on the KeyUsage property of the CMK created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource.",
                "type": "String"
            },
            {
                "condition": "kms:DataKeyPairSpec",
                "description": "Controls access to GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext operations based on the value of the DataKeyPairSpec parameter in the request.",
                "type": "String"
            },
            {
                "condition": "kms:EncryptionAlgorithm",
                "description": "Controls access to encryption operations based on the value of the encryption algorithm in the request.",
                "type": "String"
            },
            {
                "condition": "kms:EncryptionContextKeys",
                "description": "Controls access based on the presence of specified keys in the encryption context. The encryption context is an optional element in a cryptographic operation.",
                "type": "String"
            },
            {
                "condition": "kms:ExpirationModel",
                "description": "Controls access to the ImportKeyMaterial operation based on the value of the ExpirationModel parameter in the request.",
                "type": "String"
            },
            {
                "condition": "kms:GrantConstraintType",
                "description": "Controls access to the CreateGrant operation based on the grant constraint in the request.",
                "type": "String"
            },
            {
                "condition": "kms:GrantIsForAWSResource",
                "description": "Controls access to the CreateGrant operation when the request comes from a specified AWS service.",
                "type": "Bool"
            },
            {
                "condition": "kms:GrantOperations",
                "description": "Controls access to the CreateGrant operation based on the operations in the grant.",
                "type": "String"
            },
            {
                "condition": "kms:GranteePrincipal",
                "description": "Controls access to the CreateGrant operation based on the grantee principal in the grant.",
                "type": "String"
            },
            {
                "condition": "kms:KeyOrigin",
                "description": "Controls access to an API operation based on the Origin property of the CMK created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource.",
                "type": "String"
            },
            {
                "condition": "kms:MessageType",
                "description": "Controls access to the Sign and Verify operations based on the value of the MessageType parameter in the request.",
                "type": "String"
            },
            {
                "condition": "kms:ReEncryptOnSameKey",
                "description": "Controls access to the ReEncrypt operation when it uses the same customer master key that was used for the Encrypt operation.",
                "type": "Bool"
            },
            {
                "condition": "kms:RetiringPrincipal",
                "description": "Controls access to the CreateGrant operation based on the retiring principal in the grant.",
                "type": "String"
            },
            {
                "condition": "kms:SigningAlgorithm",
                "description": "Controls access to the Sign and Verify operations based on the signing algorithm in the request.",
                "type": "String"
            },
            {
                "condition": "kms:ValidTo",
                "description": "Controls access to the ImportKeyMaterial operation based on the value of the ValidTo parameter in the request. You can use this condition key to allow users to import key material only when it expires by the specified date.",
                "type": "Numeric"
            },
            {
                "condition": "kms:ViaService",
                "description": "Controls access when a request made on the principal's behalf comes from a specified AWS service.",
                "type": "String"
            },
            {
                "condition": "kms:WrappingAlgorithm",
                "description": "Controls access to the GetParametersForImport operation based on the value of the WrappingAlgorithm parameter in the request.",
                "type": "String"
            },
            {
                "condition": "kms:WrappingKeySpec",
                "description": "Controls access to the GetParametersForImport operation based on the value of the WrappingKeySpec parameter in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Lake Formation",
        "prefix": "lakeformation",
        "privileges": [
            {
                "privilege": "BatchGrantPermissions",
                "description": "Grants data lake permissions to one or more principals in a batch.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchRevokePermissions",
                "description": "Revokes data lake permissions from one or more principals in a batch.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterResource",
                "description": "Deregisters a registered location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResource",
                "description": "Describes a registered location.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataAccess",
                "description": "Grants virtual data lake access permissions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataLakeSettings",
                "description": "Retrieves data lake settings such as the list of data lake administrators and database and table default permissions.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEffectivePermissionsForPath",
                "description": "Retrieves permissions attached to resources in the given path.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GrantPermissions",
                "description": "Grants data lake permissions to a principal.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPermissions",
                "description": "Lists permissions filtered by principal or resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResources",
                "description": "Lists registered locations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDataLakeSettings",
                "description": "Overwrites data lake settings such as the list of data lake administrators and database and table default permissions.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterResource",
                "description": "Registers a new location to be managed by Lake Formation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokePermissions",
                "description": "Revokes data lake permissions from a principal.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResource",
                "description": "Updates a registered location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Lambda",
        "prefix": "lambda",
        "privileges": [
            {
                "privilege": "AddLayerVersionPermission",
                "description": "Adds a permission policy to a version of a function layer.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "layerVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddPermission",
                "description": "Adds a permission to the resource policy associated with the specified AWS Lambda function.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:Principal"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAlias",
                "description": "Creates an alias that points to the specified Lambda function version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEventSourceMapping",
                "description": "Identifies a stream as an event source for a Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:FunctionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFunction",
                "description": "Creates a new Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:Layer"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAlias",
                "description": "Deletes the specified Lambda function alias.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventSourceMapping",
                "description": "Removes an event source mapping.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventSourceMapping*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:FunctionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFunction",
                "description": "Deletes the specified Lambda function code and configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFunctionConcurrency",
                "description": "Remove concurrency limit set on a Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFunctionEventInvokeConfig",
                "description": "Deletes the event invoke configuration parameters for the specified Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLayerVersion",
                "description": "Deletes a version of a function layer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "layerVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProvisionedConcurrencyConfig",
                "description": "Deletes the provisioned concurrency configuration for a function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "function version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableReplication",
                "description": "Removes resource policy permission that allows Lambda replication service to retrieve function code and configuration.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableReplication",
                "description": "Adds a permission to resource policy that gives Lambda replication service permission to get function code and configuration.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountSettings",
                "description": "Returns account limits and usage statistics, such as concurrency and code storage.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAlias",
                "description": "Returns the specified alias information such as the alias ARN, description, and function version it is pointing to.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEventSourceMapping",
                "description": "Returns configuration information for the specified event source mapping.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "eventSourceMapping*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:FunctionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunction",
                "description": "Returns the configuration information of the Lambda function and a presigned URL link to the .zip file you uploaded with CreateFunction so you can download the .zip file.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunctionConcurrency",
                "description": "Returns details about the concurrency configuration for a function.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunctionConfiguration",
                "description": "Returns the configuration information of the Lambda function.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFunctionEventInvokeConfig",
                "description": "Returns the event invoke configuration parameters for the specified Lambda function.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLayerVersion",
                "description": "Returns information about a version of a function layer, with a link to download the layer archive that is valid for 10 minutes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "layerVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLayerVersionPolicy",
                "description": "Returns the permissions policy for a layer version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "layerVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPolicy",
                "description": "Returns the resource policy associated with the specified Lambda function.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProvisionedConcurrencyConfig",
                "description": "Retrieves the provisioned concurrency configuration for a function's alias or version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "function version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InvokeAsync",
                "description": "Submits an invocation request to AWS Lambda. Is deprecated",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InvokeFunction",
                "description": "Invokes a specific Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAliases",
                "description": "Returns list of aliases created for a Lambda function.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEventSourceMappings",
                "description": "Returns a list of event source mappings you created using the CreateEventSourceMapping.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFunctionEventInvokeConfigs",
                "description": "Returns a list of all event invoke configuration parameters for the Lambda function, its alias and versions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFunctions",
                "description": "Returns a list of your Lambda functions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLayerVersions",
                "description": "Returns a list of your Lambda layer versions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLayers",
                "description": "Lists function layers and shows information about the latest version of each.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisionedConcurrencyConfigs",
                "description": "Retrieves a list of provisioned concurrency configurations for a function.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Lists tags for a Lambda function.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVersionsByFunction",
                "description": "List all versions of a function.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PublishLayerVersion",
                "description": "Creates a function layer from a ZIP archive. Each time you call PublishLayerVersion with the same version name, a new version is created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "layer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PublishVersion",
                "description": "Publishes a version of your function from the current snapshot of $LATEST.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutFunctionConcurrency",
                "description": "Adds concurrency limit to a Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutFunctionEventInvokeConfig",
                "description": "Adds the event invoke configuration parameters for the specified Lambda function by using the values provided in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutProvisionedConcurrencyConfig",
                "description": "Adds a provisioned concurrency configuration to a function's alias or version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "function version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveLayerVersionPermission",
                "description": "Removes a statement from the permissions policy for a layer version.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "layerVersion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemovePermission",
                "description": "You can remove individual permissions from an resource policy associated with a Lambda function by providing a statement ID that you provided when you added the permission.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:Principal"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds tags to a Lambda function.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from a Lambda function.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAlias",
                "description": "Using this API you can update the function version to which the alias points and the alias description.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEventSourceMapping",
                "description": "You can update an event source mapping.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventSourceMapping*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:FunctionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFunctionCode",
                "description": "Updates the code for the specified Lambda function.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFunctionConfiguration",
                "description": "Updates the configuration parameters for the specified Lambda function by using the values provided in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "lambda:Layer"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFunctionEventInvokeConfig",
                "description": "Updates the event invoke configuration parameters for the specified Lambda function by using the values provided in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "function*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "function",
                "arn": "arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}",
                "condition_keys": []
            },
            {
                "resource": "function version",
                "arn": "arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}:${Version}",
                "condition_keys": []
            },
            {
                "resource": "function alias",
                "arn": "arn:${Partition}:lambda:${Region}:${Account}:function:${FunctionName}:${Alias}",
                "condition_keys": []
            },
            {
                "resource": "layer",
                "arn": "arn:${Partition}:lambda:${Region}:${Account}:layer:${LayerName}",
                "condition_keys": []
            },
            {
                "resource": "layerVersion",
                "arn": "arn:${Partition}:lambda:${Region}:${Account}:layer:${LayerName}:${LayerVersion}",
                "condition_keys": []
            },
            {
                "resource": "eventSourceMapping",
                "arn": "arn:${Partition}:lambda:${Region}:${Account}:event-source-mapping:${UUID}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "lambda:FunctionArn",
                "description": "The ARN of a lambda function.",
                "type": "ARN"
            },
            {
                "condition": "lambda:Layer",
                "description": "The ARN of a lambda layer.",
                "type": "String"
            },
            {
                "condition": "lambda:Principal",
                "description": "The AWS principal.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Launch Wizard",
        "prefix": "launchwizard",
        "privileges": [
            {
                "privilege": "DeleteApp",
                "description": "Delete an application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisionedApp",
                "description": "Describe provisioning applications",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisioningEvents",
                "description": "Describe provisioning events",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInfrastructureSuggestion",
                "description": "Get infrastructure suggestion",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIpAddress",
                "description": "Get customer's ip address",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceCostEstimate",
                "description": "Get resource cost estimate",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisionedApps",
                "description": "List provisioning applications",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartProvisioning",
                "description": "Start a provisioning",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Lex",
        "prefix": "lex",
        "privileges": [
            {
                "privilege": "CreateBotVersion",
                "description": "Creates a new version based on the $LATEST version of the specified bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIntentVersion",
                "description": "Creates a new version based on the $LATEST version of the specified intent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "intent version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSlotTypeVersion",
                "description": "Creates a new version based on the $LATEST version of the specified slot type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "slottype version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBot",
                "description": "Deletes all versions of a bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBotAlias",
                "description": "Deletes an alias for a specific bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBotChannelAssociation",
                "description": "Deletes the association between a Amazon Lex bot alias and a messaging platform.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBotVersion",
                "description": "Deletes a specific version of a bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIntent",
                "description": "Deletes all versions of an intent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "intent version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIntentVersion",
                "description": "Deletes a specific version of an intent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "intent version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSession",
                "description": "Removes session information for a specified bot, alias, and user ID.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSlotType",
                "description": "Deletes all versions of a slot type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "slottype version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSlotTypeVersion",
                "description": "Deletes a specific version of a slot type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "slottype version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUtterances",
                "description": "Deletes the information Amazon Lex maintains for utterances on a specific bot and userId.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBot",
                "description": "Returns information for a specific bot. In addition to the bot name, the bot version or alias is required.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBotAlias",
                "description": "Returns information about a Amazon Lex bot alias.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bot alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBotAliases",
                "description": "Returns a list of aliases for a given Amazon Lex bot.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBotChannelAssociation",
                "description": "Returns information about the association between a Amazon Lex bot and a messaging platform.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBotChannelAssociations",
                "description": "Returns a list of all of the channels associated with a single bot.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBotVersions",
                "description": "Returns information for all versions of a specific bot.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBots",
                "description": "Returns information for the $LATEST version of all bots, subject to filters provided by the client.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBuiltinIntent",
                "description": "Returns information about a built-in intent.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBuiltinIntents",
                "description": "Gets a list of built-in intents that meet the specified criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBuiltinSlotTypes",
                "description": "Gets a list of built-in slot types that meet the specified criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExport",
                "description": "Exports Amazon Lex Resource in a requested format.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImport",
                "description": "Gets information about an import job started with StartImport.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIntent",
                "description": "Returns information for a specific intent. In addition to the intent name, you must also specify the intent version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "intent version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIntentVersions",
                "description": "Returns information for all versions of a specific intent.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "intent version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIntents",
                "description": "Returns information for the $LATEST version of all intents, subject to filters provided by the client.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSession",
                "description": "Returns session information for a specified bot, alias, and user ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSlotType",
                "description": "Returns information about a specific version of a slot type. In addition to specifying the slot type name, you must also specify the slot type version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "slottype version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSlotTypeVersions",
                "description": "Returns information for all versions of a specific slot type.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "slottype version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSlotTypes",
                "description": "Returns information for the $LATEST version of all slot types, subject to filters provided by the client.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUtterancesView",
                "description": "Returns a view of aggregate utterance data for versions of a bot for a recent time period.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists tags for a Lex resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PostContent",
                "description": "Sends user input (text or speech) to Amazon Lex.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PostText",
                "description": "Sends user input (text-only) to Amazon Lex.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBot",
                "description": "Creates or updates the $LATEST version of a Amazon Lex conversational bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBotAlias",
                "description": "Creates or updates an alias for the specific bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot alias*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutIntent",
                "description": "Creates or updates the $LATEST version of an intent.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "intent version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSession",
                "description": "Creates a new session or modifies an existing session with an Amazon Lex bot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot version",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSlotType",
                "description": "Creates or updates the $LATEST version of a slot type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "slottype version*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartImport",
                "description": "Starts a job to import a resource to Amazon Lex.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds or overwrites tags to a Lex resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "bot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from a Lex resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "bot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "bot alias",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "bot",
                "arn": "arn:${Partition}:lex:${Region}:${Account}:bot:${BotName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "bot version",
                "arn": "arn:${Partition}:lex:${Region}:${Account}:bot:${BotName}:${BotVersion}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "bot alias",
                "arn": "arn:${Partition}:lex:${Region}:${Account}:bot:${BotName}:${BotAlias}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "channel",
                "arn": "arn:${Partition}:lex:${Region}:${Account}:bot-channel:${BotName}:${BotAlias}:${ChannelName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "intent version",
                "arn": "arn:${Partition}:lex:${Region}:${Account}:intent:${IntentName}:${IntentVersion}",
                "condition_keys": []
            },
            {
                "resource": "slottype version",
                "arn": "arn:${Partition}:lex:${Region}:${Account}:slottype:${SlotName}:${SlotVersion}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access based on the tags in the request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access by the tags attached to a Lex resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access based on the set of tag keys in the request.",
                "type": "String"
            },
            {
                "condition": "lex:associatedIntents",
                "description": "Enables you to control access based on the intents included in the request.",
                "type": "String"
            },
            {
                "condition": "lex:associatedSlotTypes",
                "description": "Enables you to control access based on the slot types included in the request.",
                "type": "String"
            },
            {
                "condition": "lex:channelType",
                "description": "Enables you to control access based on the channel type included in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS License Manager",
        "prefix": "license-manager",
        "privileges": [
            {
                "privilege": "CreateLicenseConfiguration",
                "description": "Creates a new license configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLicenseConfiguration",
                "description": "Permanently deletes a license configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLicenseConfiguration",
                "description": "Gets a license configuration",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceSettings",
                "description": "Gets service settings",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociationsForLicenseConfiguration",
                "description": "Lists associations for a selected license configuration",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLicenseConfigurations",
                "description": "Lists license configurations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLicenseSpecificationsForResource",
                "description": "Lists license specifications associated with a selected resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceInventory",
                "description": "Lists resource inventory",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists tags for a selected resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsageForLicenseConfiguration",
                "description": "Lists usage records for selected license configuration",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags a selected resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untags a selected resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLicenseConfiguration",
                "description": "Updates an existing license configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLicenseSpecificationsForResource",
                "description": "Updates license specifications for a selected resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "license-configuration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServiceSettings",
                "description": "Updates service settings",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "license-configuration",
                "arn": "arn:${Partition}:license-manager:${Region}:${Account}:license-configuration/${LicenseConfigurationId}",
                "condition_keys": [
                    "license-manager:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on allowed set of values for each of the mandatory tags",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Enforce tag keys that are used in the request",
                "type": "String"
            },
            {
                "condition": "license-manager:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Lightsail",
        "prefix": "lightsail",
        "privileges": [
            {
                "privilege": "AllocateStaticIp",
                "description": "Creates a static IP address that can be attached to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "StaticIp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachDisk",
                "description": "Attaches a disk to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachInstancesToLoadBalancer",
                "description": "Attaches one or more instances to a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachLoadBalancerTlsCertificate",
                "description": "Attaches a TLS certificate to a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachStaticIp",
                "description": "Attaches a static IP address to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "StaticIp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CloseInstancePublicPorts",
                "description": "Closes a public port of an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopySnapshot",
                "description": "Copies a snapshot from one AWS Region to another in Amazon Lightsail.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCloudFormationStack",
                "description": "Creates a new Amazon EC2 instance from an exported Amazon Lightsail snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ExportSnapshotRecord*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDisk",
                "description": "Creates a disk.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDiskFromSnapshot",
                "description": "Creates a disk from snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDiskSnapshot",
                "description": "Creates a disk snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDomain",
                "description": "Creates a domain resource for the specified domain name.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDomainEntry",
                "description": "Creates one or more DNS record entries for a domain resource: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstanceSnapshot",
                "description": "Creates an instance snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "InstanceSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstances",
                "description": "Creates one or more instances.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstancesFromSnapshot",
                "description": "Creates one or more instances based on an instance snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "InstanceSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateKeyPair",
                "description": "Creates a key pair used to authenticate and connect to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoadBalancer",
                "description": "Creates a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLoadBalancerTlsCertificate",
                "description": "Creates a load balancer TLS certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRelationalDatabase",
                "description": "Creates a new relational database.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRelationalDatabaseFromSnapshot",
                "description": "Creates a new relational database from a snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRelationalDatabaseSnapshot",
                "description": "Creates a relational database snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabaseSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDisk",
                "description": "Deletes a disk.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDiskSnapshot",
                "description": "Deletes a disk snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomain",
                "description": "Deletes a domain resource and all of its DNS records.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomainEntry",
                "description": "Deletes a DNS record entry for a domain resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInstance",
                "description": "Deletes an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInstanceSnapshot",
                "description": "Deletes an instance snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "InstanceSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteKeyPair",
                "description": "Deletes a key pair used to authenticate and connect to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteKnownHostKeys",
                "description": "Deletes the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoadBalancer",
                "description": "Deletes a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoadBalancerTlsCertificate",
                "description": "Deletes a load balancer TLS certificate.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRelationalDatabase",
                "description": "Deletes a relational database.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRelationalDatabaseSnapshot",
                "description": "Deletes relational database snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabaseSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachDisk",
                "description": "Detaches a disk from an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachInstancesFromLoadBalancer",
                "description": "Detaches one or more instances from a load balancer.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachStaticIp",
                "description": "Detaches a static IP from an instance to which it is attached.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "StaticIp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DownloadDefaultKeyPair",
                "description": "Downloads the default key pair used to authenticate and connect to instances in a specific AWS Region.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportSnapshot",
                "description": "Exports an Amazon Lightsail snapshot to Amazon EC2.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetActiveNames",
                "description": "Returns the names of all active (not deleted) resources.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBlueprints",
                "description": "Returns a list of instance images, or blueprints. You can use a blueprint to create a new instance already running a specific operating system, as well as a pre-installed application or development stack. The software that runs on your instance depends on the blueprint you define when creating the instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBundles",
                "description": "Returns a list of instance bundles. You can use a bundle to create a new instance with a set of performance specifications, such as CPU count, disk size, RAM size, and network transfer allowance. The cost of your instance depends on the bundle you define when creating the instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCloudFormationStackRecords",
                "description": "Returns information about all CloudFormation stacks used to create Amazon EC2 resources from exported Amazon Lightsail snapshots.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "CloudFormationStackRecord*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDisk",
                "description": "Returns information about a disk.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDiskSnapshot",
                "description": "Returns information about a disk snapshot.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDiskSnapshots",
                "description": "Returns information about all disk snapshots.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Disk*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDisks",
                "description": "Returns information about all disks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDomain",
                "description": "Returns DNS records for a domain resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDomains",
                "description": "Returns DNS records for all domain resources.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExportSnapshotRecords",
                "description": "Returns information about all records to export Amazon Lightsail snapshots to Amazon EC2.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ExportSnapshotRecord*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstance",
                "description": "Returns information about an instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceAccessDetails",
                "description": "Returns temporary keys you can use to authenticate and connect to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceMetricData",
                "description": "Returns the data points for the specified metric of an instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstancePortStates",
                "description": "Returns the port states of an instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceSnapshot",
                "description": "Returns information about an instance snapshot.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "InstanceSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceSnapshots",
                "description": "Returns information about all instance snapshots.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "InstanceSnapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstanceState",
                "description": "Returns the state of an instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstances",
                "description": "Returns information about all instances.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetKeyPair",
                "description": "Returns information about a key pair.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetKeyPairs",
                "description": "Returns information about all key pairs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoadBalancer",
                "description": "Returns information about a load balancer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoadBalancerMetricData",
                "description": "Returns the data points for the specified metric of a load balancer.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoadBalancerTlsCertificates",
                "description": "Returns information about a load balancer TLS certificate.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoadBalancers",
                "description": "Returns information about load balancers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOperation",
                "description": "Returns information about an operation. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOperations",
                "description": "Returns information about all operations. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOperationsForResource",
                "description": "Returns operations for a resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "InstanceSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "KeyPair",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "StaticIp",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegions",
                "description": "Returns a list of all valid AWS Regions for Amazon Lightsail.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabase",
                "description": "Returns information about a relational database.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseBlueprints",
                "description": "Returns a list of relational database images, or blueprints. You can use a blueprint to create a new database running a specific database engine. The database engine that runs on your database depends on the blueprint you define when creating the relational database.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseBundles",
                "description": "Returns a list of relational database bundles. You can use a bundle to create a new database with a set of performance specifications, such as CPU count, disk size, RAM size, network transfer allowance, and standard of high availability. The cost of your database depends on the bundle you define when creating the relational database.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseEvents",
                "description": "Returns events for a relational database.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseLogEvents",
                "description": "Returns events for the specified log stream of a relational database.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseLogStreams",
                "description": "Returns the log streams available for a relational database.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseMasterUserPassword",
                "description": "Returns the master user password of a relational database.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseMetricData",
                "description": "Returns the data points for the specified metric of a relational database.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseParameters",
                "description": "Returns the parameters of a relational database.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseSnapshot",
                "description": "Returns information about a relational database snapshot.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabaseSnapshots",
                "description": "Returns information about all relational database snapshots.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRelationalDatabases",
                "description": "Return information about all relational databases.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStaticIp",
                "description": "Returns information about a static IP.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "StaticIp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetStaticIps",
                "description": "Returns information about all static IPs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "StaticIp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportKeyPair",
                "description": "Imports a public key from a key pair.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "KeyPair*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IsVpcPeered",
                "description": "Returns a boolean value indicating whether the Amazon Lightsail virtual private cloud (VPC) is peered.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OpenInstancePublicPorts",
                "description": "Adds, or opens a public port of an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PeerVpc",
                "description": "Tries to peer the Amazon Lightsail virtual private cloud (VPC) with the default VPC.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutInstancePublicPorts",
                "description": "Sets the specified open ports for an instance, and closes all ports for every protocol not included in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootInstance",
                "description": "Reboots an instance that is in a running state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootRelationalDatabase",
                "description": "Reboots a relational database that is in a running state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReleaseStaticIp",
                "description": "Deletes a static IP.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "StaticIp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartInstance",
                "description": "Starts an instance that is in a stopped state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartRelationalDatabase",
                "description": "Starts a relational database that is in a stopped state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopInstance",
                "description": "Stops an instance that is in a running state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopRelationalDatabase",
                "description": "Stops a relational database that is in a running state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tags a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Disk",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "DiskSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "InstanceSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "KeyPair",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "LoadBalancer",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "RelationalDatabase",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "RelationalDatabaseSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "StaticIp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnpeerVpc",
                "description": "Attempts to unpeer the Amazon Lightsail virtual private cloud (VPC) from the default VPC.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untags a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Disk",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "DiskSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "InstanceSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "KeyPair",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "LoadBalancer",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "RelationalDatabase",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "RelationalDatabaseSnapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "StaticIp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainEntry",
                "description": "Updates a domain recordset after it is created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLoadBalancerAttribute",
                "description": "Updates a load balancer attribute, such as the health check path and session stickiness.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "LoadBalancer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRelationalDatabase",
                "description": "Updates a relational database.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "RelationalDatabase*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRelationalDatabaseParameters",
                "description": "Updates the parameters of a relational database.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Domain",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:Domain/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "Instance",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:Instance/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "InstanceSnapshot",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:InstanceSnapshot/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "KeyPair",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:KeyPair/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "StaticIp",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:StaticIp/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "Disk",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:Disk/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "DiskSnapshot",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:DiskSnapshot/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "LoadBalancer",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:LoadBalancer/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "PeeredVpc",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:PeeredVpc/${Id}",
                "condition_keys": []
            },
            {
                "resource": "LoadBalancerTlsCertificate",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:LoadBalancerTlsCertificate/${Id}",
                "condition_keys": []
            },
            {
                "resource": "ExportSnapshotRecord",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:ExportSnapshotRecord/${Id}",
                "condition_keys": []
            },
            {
                "resource": "CloudFormationStackRecord",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:CloudFormationStackRecord/${Id}",
                "condition_keys": []
            },
            {
                "resource": "RelationalDatabase",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:RelationalDatabase/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "RelationalDatabaseSnapshot",
                "arn": "arn:${Partition}:lightsail:${Region}:${Account}:RelationalDatabaseSnapshot/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon CloudWatch Logs",
        "prefix": "logs",
        "privileges": [
            {
                "privilege": "AssociateKmsKey",
                "description": "Associates the specified AWS Key Management Service (AWS KMS) customer master key (CMK) with the specified log group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelExportTask",
                "description": "Cancels an export task if it is in PENDING or RUNNING state",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateExportTask",
                "description": "Creates an ExportTask which allows you to efficiently export data from a Log Group to your Amazon S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLogDelivery",
                "description": "Creates the log delivery",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLogGroup",
                "description": "Creates a new log group with the specified name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLogStream",
                "description": "Creates a new log stream with the specified name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDestination",
                "description": "Deletes the destination with the specified name and eventually disables all the subscription filters that publish to it",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLogDelivery",
                "description": "Deletes the log delivery information for specified log delivery",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLogGroup",
                "description": "Deletes the log group with the specified name and permanently deletes all the archived log events associated with it",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLogStream",
                "description": "Deletes a log stream and permanently deletes all the archived log events associated with it",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMetricFilter",
                "description": "Deletes a metric filter associated with the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourcePolicy",
                "description": "Deletes a resource policy from this account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRetentionPolicy",
                "description": "Deletes the retention policy of the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSubscriptionFilter",
                "description": "Deletes a subscription filter associated with the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDestinations",
                "description": "Returns all the destinations that are associated with the AWS account making the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExportTasks",
                "description": "Returns all the export tasks that are associated with the AWS account making the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLogGroups",
                "description": "Returns all the log groups that are associated with the AWS account making the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLogStreams",
                "description": "Returns all the log streams that are associated with the specified log group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMetricFilters",
                "description": "Returns all the metrics filters associated with the specified log group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeQueries",
                "description": "Returns a list of CloudWatch Logs Insights queries that are scheduled, executing, or have been executed recently in this account. You can request all queries, or limit it to queries of a specific log group or queries with a certain status.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResourcePolicies",
                "description": "Return all the resource policies in this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSubscriptionFilters",
                "description": "Returns all the subscription filters associated with the specified log group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateKmsKey",
                "description": "Disassociates the associated AWS Key Management Service (AWS KMS) customer master key (CMK) from the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "FilterLogEvents",
                "description": "Retrieves log events, optionally filtered by a filter pattern from the specified log group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLogDelivery",
                "description": "Gets the log delivery information for specified log delivery",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLogEvents",
                "description": "Retrieves log events from the specified log stream",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "log-stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLogGroupFields",
                "description": "Returns a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field. The search is limited to a time period that you specify.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLogRecord",
                "description": "Retrieves all the fields and values of a single log event. All fields are retrieved, even if the original query that produced the logRecordPointer retrieved only a subset of fields. Fields are returned as field name/field value pairs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryResults",
                "description": "Returns the results from the specified query. If the query is in progress, partial results of that current execution are returned. Only the fields requested in the query are returned.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLogDeliveries",
                "description": "Lists all the log deliveries for specified account and/or log source",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsLogGroup",
                "description": "Lists the tags for the specified log group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDestination",
                "description": "Creates or updates a Destination",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDestinationPolicy",
                "description": "Creates or updates an access policy associated with an existing Destination",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLogEvents",
                "description": "Uploads a batch of log events to the specified log stream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-stream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMetricFilter",
                "description": "Creates or updates a metric filter and associates it with the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutResourcePolicy",
                "description": "Creates or updates a resource policy allowing other AWS services to put log events to this account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutRetentionPolicy",
                "description": "Sets the retention of the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSubscriptionFilter",
                "description": "Creates or updates a subscription filter and associates it with the specified log group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartQuery",
                "description": "Schedules a query of a log group using CloudWatch Logs Insights. You specify the log group and time range to query, and the query string to use.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopQuery",
                "description": "Stops a CloudWatch Logs Insights query that is in progress. If the query has already ended, the operation returns an error indicating that the specified query is not running.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagLogGroup",
                "description": "Adds or updates the specified tags for the specified log group",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestMetricFilter",
                "description": "Tests the filter pattern of a metric filter against a sample of log event messages",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagLogGroup",
                "description": "Removes the specified tags from the specified log group",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "log-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLogDelivery",
                "description": "Updates the log delivery information for specified log delivery",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "log-group",
                "arn": "arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}",
                "condition_keys": []
            },
            {
                "resource": "log-stream",
                "arn": "arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}:log-stream:${LogStreamName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Machine Learning",
        "prefix": "machinelearning",
        "privileges": [
            {
                "privilege": "AddTags",
                "description": "Adds one or more tags to an object, up to a limit of 10. Each tag consists of a key and an optional value",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "batchprediction",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datasource",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "evaluation",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "mlmodel",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBatchPrediction",
                "description": "Generates predictions for a group of observations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "batchprediction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataSourceFromRDS",
                "description": "Creates a DataSource object from an Amazon RDS",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataSourceFromRedshift",
                "description": "Creates a DataSource from a database hosted on an Amazon Redshift cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataSourceFromS3",
                "description": "Creates a DataSource object from S3",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEvaluation",
                "description": "Creates a new Evaluation of an MLModel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "evaluation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMLModel",
                "description": "Creates a new MLModel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRealtimeEndpoint",
                "description": "Creates a real-time endpoint for the MLModel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBatchPrediction",
                "description": "Assigns the DELETED status to a BatchPrediction, rendering it unusable",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "batchprediction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataSource",
                "description": "Assigns the DELETED status to a DataSource, rendering it unusable",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEvaluation",
                "description": "Assigns the DELETED status to an Evaluation, rendering it unusable",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "evaluation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMLModel",
                "description": "Assigns the DELETED status to an MLModel, rendering it unusable",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRealtimeEndpoint",
                "description": "Deletes a real time endpoint of an MLModel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Deletes the specified tags associated with an ML object. After this operation is complete, you can't recover deleted tags",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "batchprediction",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datasource",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "evaluation",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "mlmodel",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBatchPredictions",
                "description": "Returns a list of BatchPrediction operations that match the search criteria in the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataSources",
                "description": "Returns a list of DataSource that match the search criteria in the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvaluations",
                "description": "Returns a list of DescribeEvaluations that match the search criteria in the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMLModels",
                "description": "Returns a list of MLModel that match the search criteria in the request",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Describes one or more of the tags for your Amazon ML object",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "batchprediction",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "datasource",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "evaluation",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "mlmodel",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBatchPrediction",
                "description": "Returns a BatchPrediction that includes detailed metadata, status, and data file information",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "batchprediction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDataSource",
                "description": "Returns a DataSource that includes metadata and data file information, as well as the current status of the DataSource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEvaluation",
                "description": "Returns an Evaluation that includes metadata as well as the current status of the Evaluation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMLModel",
                "description": "Returns an MLModel that includes detailed metadata, and data source information as well as the current status of the MLModel",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Predict",
                "description": "Generates a prediction for the observation using the specified ML Model",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBatchPrediction",
                "description": "Updates the BatchPredictionName of a BatchPrediction",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "batchprediction*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDataSource",
                "description": "Updates the DataSourceName of a DataSource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEvaluation",
                "description": "Updates the EvaluationName of an Evaluation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "evaluation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMLModel",
                "description": "Updates the MLModelName and the ScoreThreshold of an MLModel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "mlmodel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "batchprediction",
                "arn": "arn:${Partition}:machinelearning:${Region}:${Account}:batchprediction/${BatchPredictionId}",
                "condition_keys": []
            },
            {
                "resource": "datasource",
                "arn": "arn:${Partition}:machinelearning:${Region}:${Account}:datasource/${DatasourceId}",
                "condition_keys": []
            },
            {
                "resource": "evaluation",
                "arn": "arn:${Partition}:machinelearning:${Region}:${Account}:evaluation/${EvaluationId}",
                "condition_keys": []
            },
            {
                "resource": "mlmodel",
                "arn": "arn:${Partition}:machinelearning:${Region}:${Account}:mlmodel/${MlModelId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Macie",
        "prefix": "macie",
        "privileges": [
            {
                "privilege": "AssociateMemberAccount",
                "description": "Enables the user to associate a specified AWS account with Amazon Macie as a member account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateS3Resources",
                "description": "Enables the user to associate specified S3 resources with Amazon Macie for monitoring and data classification.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:SourceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateMemberAccount",
                "description": "Enables the user to remove the specified member account from Amazon Macie.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateS3Resources",
                "description": "Enables the user to remove specified S3 resources from being monitored by Amazon Macie.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:SourceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMemberAccounts",
                "description": "Enables the user to list all Amazon Macie member accounts for the current Macie master account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListS3Resources",
                "description": "Enables the user to list all the S3 resources associated with Amazon Macie.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateS3Resources",
                "description": "Enables the user to update the classification types for the specified S3 resources.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:SourceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": [
            {
                "condition": "aws:SourceArn",
                "description": "Allow access to the specified actions only when the request operates on the specified aws resource",
                "type": "Arn"
            }
        ]
    },
    {
        "service_name": "Amazon Managed Blockchain",
        "prefix": "managedblockchain",
        "privileges": [
            {
                "privilege": "CreateMember",
                "description": "Grants permission to create a member of an Amazon Managed Blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNetwork",
                "description": "Grants permission to create an Amazon Managed Blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNode",
                "description": "Grants permission to create a node within a member of an Amazon Managed Blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "member*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProposal",
                "description": "Grants permission to create a proposal that other blockchain network members can vote on to add or remove a member in an Amazon Managed Blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMember",
                "description": "Grants permission to delete a member and all associated resources from an Amazon Managed Blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "member*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNode",
                "description": "Grants permission to delete a node from a member of an Amazon Managed Blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "node*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMember",
                "description": "Grants permission to return detailed information about a member of an Amazon Managed Blockchain network.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "member*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNetwork",
                "description": "Grants permission to return detailed information about an Amazon Managed Blockchain network.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNode",
                "description": "Grants permission to return detailed information about a node within a member of an Amazon Managed Blockchain network.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "node*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProposal",
                "description": "Grants permission to return detailed information about a proposal of an Amazon Managed Blockchain network.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "proposal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInvitations",
                "description": "Grants permission to list the invitations extended to the active AWS account from any Managed Blockchain network.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMembers",
                "description": "Grants permission to list the members of an Amazon Managed Blockchain network and the properties of their memberships.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNetworks",
                "description": "Grants permission to return information about the Amazon Managed Blockchain networks in which the current AWS account has members.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNodes",
                "description": "Grants permission to list the nodes within a member of an Amazon Managed Blockchain network.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "member*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProposalVotes",
                "description": "Grants permission to list all votes for a proposal, including the value of the vote and the unique identifier of the member that cast the vote for the given Amazon Managed Blockchain network.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "proposal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProposals",
                "description": "Grants permission to list proposals for the given Amazon Managed Blockchain network.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectInvitation",
                "description": "Grants permission to reject the invitation to join the blockchain network.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "invitation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VoteOnProposal",
                "description": "Grants permission to cast a vote for a proposal on behalf of the blockchain network member specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "proposal*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "network",
                "arn": "arn:${Partition}:managedblockchain:${Region}::networks/${NetworkId}",
                "condition_keys": []
            },
            {
                "resource": "member",
                "arn": "arn:${Partition}:managedblockchain:${Region}:${Account}:members/${MemberId}",
                "condition_keys": []
            },
            {
                "resource": "node",
                "arn": "arn:${Partition}:managedblockchain:${Region}:${Account}:nodes/${NodeId}",
                "condition_keys": []
            },
            {
                "resource": "proposal",
                "arn": "arn:${Partition}:managedblockchain:${Region}::proposals/${ProposalId}",
                "condition_keys": []
            },
            {
                "resource": "invitation",
                "arn": "arn:${Partition}:managedblockchain:${Region}:${Account}:invitations/${InvitationId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Mechanical Turk",
        "prefix": "mechanicalturk",
        "privileges": [
            {
                "privilege": "AcceptQualificationRequest",
                "description": "The AcceptQualificationRequest operation grants a Worker's request for a Qualification",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApproveAssignment",
                "description": "The ApproveAssignment operation approves the results of a completed assignment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateQualificationWithWorker",
                "description": "The AssociateQualificationWithWorker operation gives a Worker a Qualification",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAdditionalAssignmentsForHIT",
                "description": "The CreateAdditionalAssignmentsForHIT operation increases the maximum number of assignments of an existing HIT",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHIT",
                "description": "The CreateHIT operation creates a new HIT (Human Intelligence Task)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHITType",
                "description": "The CreateHITType operation creates a new HIT type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHITWithHITType",
                "description": "The CreateHITWithHITType operation creates a new Human Intelligence Task (HIT) using an existing HITTypeID generated by the CreateHITType operation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateQualificationType",
                "description": "The CreateQualificationType operation creates a new Qualification type, which is represented by a QualificationType data structure",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWorkerBlock",
                "description": "The CreateWorkerBlock operation allows you to prevent a Worker from working on your HITs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHIT",
                "description": "The DeleteHIT operation disposes of a HIT that is no longer needed",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteQualificationType",
                "description": "The DeleteQualificationType disposes a Qualification type and disposes any HIT types that are associated with the Qualification type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWorkerBlock",
                "description": "The DeleteWorkerBlock operation allows you to reinstate a blocked Worker to work on your HITs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateQualificationFromWorker",
                "description": "The DisassociateQualificationFromWorker revokes a previously granted Qualification from a user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountBalance",
                "description": "The GetAccountBalance operation retrieves the amount of money in your Amazon Mechanical Turk account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssignment",
                "description": "The GetAssignment retrieves an assignment with an AssignmentStatus value of Submitted, Approved, or Rejected, using the assignment's ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFileUploadURL",
                "description": "The GetFileUploadURL operation generates and returns a temporary URL",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHIT",
                "description": "The GetHIT operation retrieves the details of the specified HIT",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQualificationScore",
                "description": "The GetQualificationScore operation returns the value of a Worker's Qualification for a given Qualification type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQualificationType",
                "description": "The GetQualificationType operation retrieves information about a Qualification type using its ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssignmentsForHIT",
                "description": "The ListAssignmentsForHIT operation retrieves completed assignments for a HIT",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBonusPayments",
                "description": "The ListBonusPayments operation retrieves the amounts of bonuses you have paid to Workers for a given HIT or assignment",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHITs",
                "description": "The ListHITs operation returns all of a Requester's HITs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHITsForQualificationType",
                "description": "The ListHITsForQualificationType operation returns the HITs that use the given QualififcationType for a QualificationRequirement",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQualificationRequests",
                "description": "The ListQualificationRequests operation retrieves requests for Qualifications of a particular Qualification type",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQualificationTypes",
                "description": "The ListQualificationTypes operation searches for Qualification types using the specified search query, and returns a list of Qualification types",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReviewPolicyResultsForHIT",
                "description": "The ListReviewPolicyResultsForHIT operation retrieves the computed results and the actions taken in the course of executing your Review Policies during a CreateHIT operation",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReviewableHITs",
                "description": "The ListReviewableHITs operation returns all of a Requester's HITs that have not been approved or rejected",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkerBlocks",
                "description": "The ListWorkersBlocks operation retrieves a list of Workers who are blocked from working on your HITs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkersWithQualificationType",
                "description": "The ListWorkersWithQualificationType operation returns all of the Workers with a given Qualification type",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "NotifyWorkers",
                "description": "The NotifyWorkers operation sends an email to one or more Workers that you specify with the Worker ID",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectAssignment",
                "description": "The RejectAssignment operation rejects the results of a completed assignment",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectQualificationRequest",
                "description": "The RejectQualificationRequest operation rejects a user's request for a Qualification",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendBonus",
                "description": "The SendBonus operation issues a payment of money from your account to a Worker",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendTestEventNotification",
                "description": "The SendTestEventNotification operation causes Amazon Mechanical Turk to send a notification message as if a HIT event occurred, according to the provided notification specification",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateExpirationForHIT",
                "description": "The UpdateExpirationForHIT operation allows you extend the expiration time of a HIT beyond is current expiration or expire a HIT immediately",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateHITReviewStatus",
                "description": "The UpdateHITReviewStatus operation toggles the status of a HIT",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateHITTypeOfHIT",
                "description": "The UpdateHITTypeOfHIT operation allows you to change the HITType properties of a HIT",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNotificationSettings",
                "description": "The UpdateNotificationSettings operation creates, updates, disables or re-enables notifications for a HIT type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateQualificationType",
                "description": "The UpdateQualificationType operation modifies the attributes of an existing Qualification type, which is represented by a QualificationType data structure",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Elemental MediaConnect",
        "prefix": "mediaconnect",
        "privileges": [
            {
                "privilege": "AddFlowOutputs",
                "description": "Grants permission to add outputs to any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFlow",
                "description": "Grants permission to create flows.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFlow",
                "description": "Grants permission to delete flows.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFlow",
                "description": "Grants permission to display the details of a flow including the flow ARN, name, and Availability Zone, as well as details about the source, outputs, and entitlements.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GrantFlowEntitlements",
                "description": "Grants permission to grant entitlements on any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEntitlements",
                "description": "Grants permission to display a list of all entitlements that have been granted to the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFlows",
                "description": "Grants permission to display a list of flows that are associated with this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveFlowOutput",
                "description": "Grants permission to remove outputs from any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeFlowEntitlement",
                "description": "Grants permission to revoke entitlements on any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartFlow",
                "description": "Grants permission to start flows.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopFlow",
                "description": "Grants permission to stop flows.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFlowEntitlement",
                "description": "Grants permission to update entitlements on any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFlowOutput",
                "description": "Grants permission to update outputs on any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFlowSource",
                "description": "Grants permission to update the source of any flow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Entitlement",
                "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:entitlement:${FlowId}:${EntitlementName}",
                "condition_keys": []
            },
            {
                "resource": "Flow",
                "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:flow:${FlowId}:${FlowName}",
                "condition_keys": []
            },
            {
                "resource": "Output",
                "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:output:${OutputId}:${OutputName}",
                "condition_keys": []
            },
            {
                "resource": "Source",
                "arn": "arn:${Partition}:mediaconnect:${Region}:${Account}:source:${SourceId}:${SourceName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Elemental MediaConvert",
        "prefix": "mediaconvert",
        "privileges": [
            {
                "privilege": "AssociateCertificate",
                "description": "Grants permission to associate an AWS Certificate Manager (ACM) Amazon Resource Name (ARN) with AWS Elemental MediaConvert.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelJob",
                "description": "Grants permission to cancel an AWS Elemental MediaConvert job that is waiting in queue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Grants permission to create and submit an AWS Elemental MediaConvert job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Preset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJobTemplate",
                "description": "Grants permission to create an AWS Elemental MediaConvert custom job template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Preset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePreset",
                "description": "Grants permission to create an AWS Elemental MediaConvert custom output preset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateQueue",
                "description": "Grants permission to create an AWS Elemental MediaConvert job queue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJobTemplate",
                "description": "Grants permission to delete an AWS Elemental MediaConvert custom job template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePreset",
                "description": "Grants permission to delete an AWS Elemental MediaConvert custom output preset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteQueue",
                "description": "Grants permission to delete an AWS Elemental MediaConvert job queue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpoints",
                "description": "Grants permission to subscribe to the AWS Elemental MediaConvert service, by sending a request for an account-specific endpoint. All transcoding requests must be sent to the endpoint that the service returns.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateCertificate",
                "description": "Grants permission to remove an association between the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate and an AWS Elemental MediaConvert resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJob",
                "description": "Grants permission to get an AWS Elemental MediaConvert job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobTemplate",
                "description": "Grants permission to get an AWS Elemental MediaConvert job template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPreset",
                "description": "Grants permission to get an AWS Elemental MediaConvert output preset",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueue",
                "description": "Grants permission to get an AWS Elemental MediaConvert job queue",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobTemplates",
                "description": "Grants permission to list AWS Elemental MediaConvert job templates",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Grants permission to list AWS Elemental MediaConvert jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPresets",
                "description": "Grants permission to list AWS Elemental MediaConvert output presets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQueues",
                "description": "Grants permission to list AWS Elemental MediaConvert job queues",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to retrieve the tags for a MediaConvert queue, preset, or job template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Preset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to a MediaConvert queue, preset, or job template",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Preset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from a MediaConvert queue, preset, or job template",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Preset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJobTemplate",
                "description": "Grants permission to update an AWS Elemental MediaConvert custom job template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "JobTemplate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Preset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Queue",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePreset",
                "description": "Grants permission to update an AWS Elemental MediaConvert custom output preset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Preset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateQueue",
                "description": "Grants permission to update an AWS Elemental MediaConvert job queue",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Job",
                "arn": "arn:${Partition}:mediaconvert:${Region}:${Account}:jobs/${JobId}",
                "condition_keys": []
            },
            {
                "resource": "Queue",
                "arn": "arn:${Partition}:mediaconvert:${Region}:${Account}:queues/${QueueName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "Preset",
                "arn": "arn:${Partition}:mediaconvert:${Region}:${Account}:presets/${PresetName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "JobTemplate",
                "arn": "arn:${Partition}:mediaconvert:${Region}:${Account}:jobTemplates/${JobTemplateName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "CertificateAssociation",
                "arn": "arn:${Partition}:mediaconvert:${Region}:${Account}:certificates/${CertificateArn}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Elemental MediaLive",
        "prefix": "medialive",
        "privileges": [
            {
                "privilege": "BatchUpdateSchedule",
                "description": "Grants permission to add and remove actions from a channel's schedule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateChannel",
                "description": "Grants permission to create a channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInput",
                "description": "Grants permission to create an input",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input-security-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInputSecurityGroup",
                "description": "Grants permission to create an input security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input-security-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMultiplex",
                "description": "Grants permission to create a multiplex",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "multiplex*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Grants permission to create tags for channels, inputs, input security groups, multiplexes, and reservations.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input-security-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "multiplex",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reservation",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteChannel",
                "description": "Grants permission to delete a channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInput",
                "description": "Grants permission to delete an input",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInputSecurityGroup",
                "description": "Grants permission to delete an input security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input-security-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMultiplex",
                "description": "Grants permission to delete a multiplex",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "multiplex*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReservation",
                "description": "Grants permission to delete an expired reservation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "reservation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Grants permission to delete tags from channels, inputs, input security groups, multiplexes, and reservations.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input-security-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "multiplex",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reservation",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChannel",
                "description": "Grants permission to get details about a channel",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInput",
                "description": "Grants permission to describe an input",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInputSecurityGroup",
                "description": "Grants permission to describe an input security group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "input-security-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMultiplex",
                "description": "Grants permission to describe a multiplex",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "multiplex*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOffering",
                "description": "Grants permission to get details about a reservation offering",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "offering*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservation",
                "description": "Grants permission to get details about a reservation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "reservation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSchedule",
                "description": "Grants permission to view a list of actions scheduled on a channel.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChannels",
                "description": "Grants permission to list channels",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInputSecurityGroups",
                "description": "Grants permission to list input security groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInputs",
                "description": "Grants permission to list inputs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMultiplexes",
                "description": "Grants permission to list multiplexes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOfferings",
                "description": "Grants permission to list reservation offerings",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReservations",
                "description": "Grants permission to list reservations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags for channels, inputs, input security groups, multiplexes, and reservations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "channel",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "input-security-group",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "multiplex",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reservation",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseOffering",
                "description": "Grants permission to purchase a reservation offering",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "offering*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "reservation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartChannel",
                "description": "Grants permission to start a channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMultiplex",
                "description": "Grants permission to start a multiplex",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "multiplex*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopChannel",
                "description": "Grants permission to stop a channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopMultiplex",
                "description": "Grants permission to stop a multiplex",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "multiplex*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateChannel",
                "description": "Grants permission to update a channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateChannelClass",
                "description": "Grants permission to update the class of a channel",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channel*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInput",
                "description": "Grants permission to update an input",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInputSecurityGroup",
                "description": "Grants permission to update an input security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "input-security-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMultiplex",
                "description": "Grants permission to update a multiplex",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "multiplex*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateReservation",
                "description": "Grants permission to update a reservation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "reservation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "channel",
                "arn": "arn:${Partition}:medialive:${Region}:${Account}:channel:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "input",
                "arn": "arn:${Partition}:medialive:${Region}:${Account}:input:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "input-security-group",
                "arn": "arn:${Partition}:medialive:${Region}:${Account}:inputSecurityGroup:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "multiplex",
                "arn": "arn:${Partition}:medialive:${Region}:${Account}:multiplex:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "reservation",
                "arn": "arn:${Partition}:medialive:${Region}:${Account}:reservation:*",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "offering",
                "arn": "arn:${Partition}:medialive:${Region}:${Account}:offering:*",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "The tag for a MediaLive request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "The tag for a MediaLive resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The tag keys for a MediaLive resource or request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Elemental MediaPackage",
        "prefix": "mediapackage",
        "privileges": [
            {
                "privilege": "CreateChannel",
                "description": "Grants permission to create a channel in AWS Elemental MediaPackage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOriginEndpoint",
                "description": "Grants permission to create an endpoint in AWS Elemental MediaPackage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteChannel",
                "description": "Grants permission to delete a channel in AWS Elemental MediaPackage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channels*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOriginEndpoint",
                "description": "Grants permission to delete an endpoint in AWS Elemental MediaPackage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "origin_endpoints*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChannel",
                "description": "Grants permission to view the details of a channel in AWS Elemental MediaPackage.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channels*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOriginEndpoint",
                "description": "Grants permission to view the details of an endpoint in AWS Elemental MediaPackage.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "origin_endpoints*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChannels",
                "description": "Grants permission to view a list of channels in AWS Elemental MediaPackage.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOriginEndpoints",
                "description": "Grants permission to view a list of endpoints in AWS Elemental MediaPackage.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags assigned to a Channel or OriginEndpoint.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "channels",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "origin_endpoints",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RotateIngestEndpointCredentials",
                "description": "Grants permission to rotate IngestEndpoint credentials for a Channel in AWS Elemental MediaPackage.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "channels*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to assign tags to a Channel or OriginEndpoint.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channels",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "origin_endpoints",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to delete tags to a Channel or OriginEndpoint.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "channels",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "origin_endpoints",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateChannel",
                "description": "Grants permission to make changes to a channel in AWS Elemental MediaPackage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "channels*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateOriginEndpoint",
                "description": "Grants permission to make changes to an endpoint in AWS Elemental MediaPackage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "origin_endpoints*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "channels",
                "arn": "arn:${Partition}:mediapackage:${Region}:${Account}:channels/${ChannelIdentifier}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "origin_endpoints",
                "arn": "arn:${Partition}:mediapackage:${Region}:${Account}:origin_endpoints/${OriginEndpointIdentifier}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Elemental MediaPackage VOD",
        "prefix": "mediapackage-vod",
        "privileges": [
            {
                "privilege": "CreateAsset",
                "description": "Grants permission to create an asset in AWS Elemental MediaPackage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePackagingConfiguration",
                "description": "Grants permission to create a packaging configuration in AWS Elemental MediaPackage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePackagingGroup",
                "description": "Grants permission to create a packaging group in AWS Elemental MediaPackage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAsset",
                "description": "Grants permission to delete an asset in AWS Elemental MediaPackage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "assets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePackagingConfiguration",
                "description": "Grants permission to delete a packaging configuration in AWS Elemental MediaPackage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "packaging-configurations*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePackagingGroup",
                "description": "Grants permission to delete a packaging group in AWS Elemental MediaPackage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "packaging-groups*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAsset",
                "description": "Grants permission to view the details of an asset in AWS Elemental MediaPackage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "assets*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePackagingConfiguration",
                "description": "Grants permission to view the details of a packaging configuration in AWS Elemental MediaPackage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "packaging-configurations*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePackagingGroup",
                "description": "Grants permission to view the details of a packaging group in AWS Elemental MediaPackage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "packaging-groups*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssets",
                "description": "Grants permission to view a list of assets in AWS Elemental MediaPackage",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPackagingConfigurations",
                "description": "Grants permission to view a list of packaging configurations in AWS Elemental MediaPackage",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPackagingGroups",
                "description": "Grants permission to view a list of packaging groups in AWS Elemental MediaPackage",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "assets",
                "arn": "arn:${Partition}:mediapackage-vod:${Region}:${Account}:assets/${AssetIdentifier}",
                "condition_keys": []
            },
            {
                "resource": "packaging-configurations",
                "arn": "arn:${Partition}:mediapackage-vod:${Region}:${Account}:packaging-configurations/${PackagingConfigurationIdentifier}",
                "condition_keys": []
            },
            {
                "resource": "packaging-groups",
                "arn": "arn:${Partition}:mediapackage-vod:${Region}:${Account}:packaging-groups/${PackagingGroupIdentifier}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Elemental MediaStore",
        "prefix": "mediastore",
        "privileges": [
            {
                "privilege": "CreateContainer",
                "description": "Grants permission to create containers.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteContainer",
                "description": "Grants permission to delete any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteContainerPolicy",
                "description": "Grants permission to delete the access policy of any container in the current account.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCorsPolicy",
                "description": "Grants permission to delete the CORS policy from any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLifecyclePolicy",
                "description": "Grants permission to delete the lifecycle policy from any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMetricPolicy",
                "description": "Grants permission to delete the metric policy from any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteObject",
                "description": "Grants permission to delete objects.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeContainer",
                "description": "Grants permission to retrieve details on any container in the current account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeObject",
                "description": "Grants permission to retrieve object metadata.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContainerPolicy",
                "description": "Grants permission to retrieve the access policy of any container in the current account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCorsPolicy",
                "description": "Grants permission to retrieve the CORS policy of any container in the current account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLifecyclePolicy",
                "description": "Grants permission to retrieve the lifecycle policy that is assigned to any container in the current account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMetricPolicy",
                "description": "Grants permission to retrieve the metric policy that is assigned to any container in the current account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObject",
                "description": "Grants permission to retrieve objects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListContainers",
                "description": "Grants permission to retrieve a list of containers in the current account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListItems",
                "description": "Grants permission to retrieve a list of objects and folders in the current account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags on any container in the current account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutContainerPolicy",
                "description": "Grants permission to create or replace the access policy of any container in the current account.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutCorsPolicy",
                "description": "Grants permission to add or modify the CORS policy of any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLifecyclePolicy",
                "description": "Grants permission to add or modify the lifecycle policy that is assigned to any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMetricPolicy",
                "description": "Grants permission to add or modify the metric policy that is assigned to any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObject",
                "description": "Grants permission to upload objects.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartAccessLogging",
                "description": "Grants permission to enable access logging on any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopAccessLogging",
                "description": "Grants permission to disable access logging on any container in the current account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to any container in the current account.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from any container in the current account.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "container",
                "arn": "arn:${Partition}:mediastore:${Region}:${Account}:container/${ContainerName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Elemental MediaTailor",
        "prefix": "mediatailor",
        "privileges": [
            {
                "privilege": "DeletePlaybackConfiguration",
                "description": "Deletes the playback configuration for the specified name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "playbackConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPlaybackConfiguration",
                "description": "Grants permission to retrieve the configuration for the specified name",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "playbackConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPlaybackConfigurations",
                "description": "Grants permission to retrieve the list of available configurations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Returns a list of the tags assigned to the specified playback configuration resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPlaybackConfiguration",
                "description": "Grants permission to add a new configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "playbackConfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds tags to the specified playback configuration resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from the specified playback configuration resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "playbackConfiguration",
                "arn": "arn:${Partition}:mediatailor:${Region}:${Account}:playbackConfiguration/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Migration Hub",
        "prefix": "mgh",
        "privileges": [
            {
                "privilege": "AssociateCreatedArtifact",
                "description": "Associate a given AWS artifact to a MigrationTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateDiscoveredResource",
                "description": "Associate a given ADS resource to a MigrationTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHomeRegionControl",
                "description": "Create a Migration Hub Home Region Control",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProgressUpdateStream",
                "description": "Create a ProgressUpdateStream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "progressUpdateStream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProgressUpdateStream",
                "description": "Delete a ProgressUpdateStream",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "progressUpdateStream*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApplicationState",
                "description": "Get an Application Discovery Service Application's state",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHomeRegionControls",
                "description": "List Home Region Controls",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMigrationTask",
                "description": "Describe a MigrationTask",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateCreatedArtifact",
                "description": "Disassociate a given AWS artifact from a MigrationTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDiscoveredResource",
                "description": "Disassociate a given ADS resource from a MigrationTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHomeRegion",
                "description": "Get the Migration Hub Home Region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportMigrationTask",
                "description": "Import a MigrationTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCreatedArtifacts",
                "description": "List associated created artifacts for a MigrationTask",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDiscoveredResources",
                "description": "List associated ADS resources from MigrationTask",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMigrationTasks",
                "description": "List MigrationTasks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProgressUpdateStreams",
                "description": "List ProgressUpdateStreams",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "NotifyApplicationState",
                "description": "Update an Application Discovery Service Application's state",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "NotifyMigrationTaskState",
                "description": "Notify latest MigrationTask state",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutResourceAttributes",
                "description": "Put ResourceAttributes",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "migrationTask*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "progressUpdateStream",
                "arn": "arn:${Partition}:mgh:${Region}:${Account}:progressUpdateStream/${Stream}",
                "condition_keys": []
            },
            {
                "resource": "migrationTask",
                "arn": "arn:${Partition}:mgh:${Region}:${Account}:progressUpdateStream/${Stream}/migrationTask/${Task}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Mobile Analytics",
        "prefix": "mobileanalytics",
        "privileges": [
            {
                "privilege": "GetFinancialReports",
                "description": "Grant access to financial metrics for an app",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReports",
                "description": "Grant access to standard metrics for an app",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEvents",
                "description": "The PutEvents operation records one or more events",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Mobile Hub",
        "prefix": "mobilehub",
        "privileges": [
            {
                "privilege": "CreateProject",
                "description": "Create a project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateServiceRole",
                "description": "Enable AWS Mobile Hub in the account by creating the required service role",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Delete the specified project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProjectSnapshot",
                "description": "Delete a saved snapshot of project configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeployToStage",
                "description": "Deploy changes to the specified stage",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBundle",
                "description": "Describe the download bundle",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportBundle",
                "description": "Export the download bundle",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportProject",
                "description": "Export the project configuration",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateProjectParameters",
                "description": "Generate project parameters required for code generation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProject",
                "description": "Get project configuration and resources",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProjectSnapshot",
                "description": "Fetch the previously exported project configuration snapshot",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportProject",
                "description": "Create a new project from the previously exported project configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InstallBundle",
                "description": "Install a bundle in the project deployments S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableConnectors",
                "description": "List the available SaaS (Software as a Service) connectors",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableFeatures",
                "description": "List available features",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableRegions",
                "description": "List available regions for projects",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBundles",
                "description": "List the available download bundles",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjectSnapshots",
                "description": "List saved snapshots of project configuration",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProjects",
                "description": "List projects",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SynchronizeProject",
                "description": "Synchronize state of resources into project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProject",
                "description": "Update project",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ValidateProject",
                "description": "Validate a mobile hub project.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyServiceRole",
                "description": "Verify AWS Mobile Hub is enabled in the account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "project",
                "arn": "arn:${Partition}:mobilehub:${Region}:${Account}:project/${ProjectId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Pinpoint",
        "prefix": "mobiletargeting",
        "privileges": [
            {
                "privilege": "CreateApp",
                "description": "Create an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCampaign",
                "description": "Create a campaign for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEmailTemplate",
                "description": "Create an email template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateExportJob",
                "description": "Create an export job that exports endpoint definitions to Amazon S3.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateImportJob",
                "description": "Import endpoint definitions from to create a segment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJourney",
                "description": "Create a Journey for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePushTemplate",
                "description": "Create a push notification template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRecommenderConfiguration",
                "description": "Create an Amazon Pinpoint configuration for a recommender model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSegment",
                "description": "Create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSmsTemplate",
                "description": "Create an sms message template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVoiceTemplate",
                "description": "Create a voice message template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAdmChannel",
                "description": "Delete the ADM channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApnsChannel",
                "description": "Delete the APNs channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApnsSandboxChannel",
                "description": "Delete the APNs sandbox channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApnsVoipChannel",
                "description": "Delete the APNs VoIP channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApnsVoipSandboxChannel",
                "description": "Delete the APNs VoIP sandbox channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApp",
                "description": "Delete a specific campaign.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBaiduChannel",
                "description": "Delete the Baidu channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCampaign",
                "description": "Delete a specific campaign.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEmailChannel",
                "description": "Delete the email channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEmailTemplate",
                "description": "Delete an email template or an email template version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpoint",
                "description": "Delete an endpoint.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventStream",
                "description": "Delete the event stream for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGcmChannel",
                "description": "Delete the GCM channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteJourney",
                "description": "Delete a specific journey.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "journeys*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePushTemplate",
                "description": "Delete a push notification template or a push notification template version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRecommenderConfiguration",
                "description": "Delete an Amazon Pinpoint configuration for a recommender model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "recommenders*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSegment",
                "description": "Delete a specific segment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSmsChannel",
                "description": "Delete the SMS channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSmsTemplate",
                "description": "Delete an sms message template or an sms message template version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserEndpoints",
                "description": "Delete all of the endpoints that are associated with a user ID.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceChannel",
                "description": "Delete the Voice channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVoiceTemplate",
                "description": "Delete a voice message template or a voice message template version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAdmChannel",
                "description": "Retrieve information about the Amazon Device Messaging (ADM) channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApnsChannel",
                "description": "Retrieve information about the APNs channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApnsSandboxChannel",
                "description": "Retrieve information about the APNs sandbox channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApnsVoipChannel",
                "description": "Retrieve information about the APNs VoIP channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApnsVoipSandboxChannel",
                "description": "Retrieve information about the APNs VoIP sandbox channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApp",
                "description": "Retrieve information about a specific app in your Amazon Pinpoint account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplicationSettings",
                "description": "Retrieve the default settings for an app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApps",
                "description": "Retrieve a list of apps in your Amazon Pinpoint account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBaiduChannel",
                "description": "Retrieve information about the Baidu channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCampaign",
                "description": "Retrieve information about a specific campaign.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCampaignActivities",
                "description": "Retrieve information about the activities performed by a campaign.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCampaignVersion",
                "description": "Retrieve information about a specific campaign version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCampaignVersions",
                "description": "Retrieve information about the current and prior versions of a campaign.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCampaigns",
                "description": "Retrieve information about all campaigns for an app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetChannels",
                "description": "Get all channels information for your app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEmailChannel",
                "description": "Obtain information about the email channel in an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEmailTemplate",
                "description": "Retrieve information about a specific or the active version of an email template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEndpoint",
                "description": "Retrieve information about a specific endpoint.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEventStream",
                "description": "Retrieve information about the event stream for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExportJob",
                "description": "Obtain information about a specific export job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExportJobs",
                "description": "Retrieve a list of all of the export jobs for an app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGcmChannel",
                "description": "Retrieve information about the GCM channel for an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImportJob",
                "description": "Retrieve information about a specific import job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetImportJobs",
                "description": "Retrieve information about all import jobs for an app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJourney",
                "description": "Retrieve information about a specific journey.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "journeys*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPushTemplate",
                "description": "Retrieve information about a specific or the active version of an push notification template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecommenderConfiguration",
                "description": "Retrieve information about an Amazon Pinpoint configuration for a recommender model.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "recommenders*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecommenderConfigurations",
                "description": "Retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSegment",
                "description": "Retrieve information about a specific segment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSegmentExportJobs",
                "description": "Retrieve information about jobs that export endpoint definitions from segments to Amazon S3.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSegmentImportJobs",
                "description": "Retrieve information about jobs that create segments by importing endpoint definitions from .",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSegmentVersion",
                "description": "Retrieve information about a specific segment version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSegmentVersions",
                "description": "Retrieve information about the current and prior versions of a segment.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSegments",
                "description": "Retrieve information about the segments for an app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSmsChannel",
                "description": "Obtain information about the SMS channel in an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSmsTemplate",
                "description": "Retrieve information about a specific or the active version of an sms message template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetUserEndpoints",
                "description": "Retrieve information about the endpoints that are associated with a user ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceChannel",
                "description": "Obtain information about the Voice channel in an app.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVoiceTemplate",
                "description": "Retrieve information about a specific or the active version of a voice message template.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJourneys",
                "description": "Retrieve information about all journeys for an app.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags for a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "apps",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTemplateVersions",
                "description": "Retrieve all versions about a specific template.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTemplates",
                "description": "Retrieve metadata about the queried templates.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PhoneNumberValidate",
                "description": "Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEventStream",
                "description": "Create or update an event stream for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEvents",
                "description": "Create or update events for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveAttributes",
                "description": "Used to remove the attributes for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendMessages",
                "description": "Send an SMS message or push notification to specific endpoints.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendUsersMessages",
                "description": "Send an SMS message or push notification to all endpoints that are associated with a specific user ID.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds tags to a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "apps",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "apps",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAdmChannel",
                "description": "Update the Amazon Device Messaging (ADM) channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApnsChannel",
                "description": "Update the Apple Push Notification service (APNs) channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApnsSandboxChannel",
                "description": "Update the Apple Push Notification service (APNs) sandbox channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApnsVoipChannel",
                "description": "Update the Apple Push Notification service (APNs) VoIP channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApnsVoipSandboxChannel",
                "description": "Update the Apple Push Notification service (APNs) VoIP sandbox channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationSettings",
                "description": "Update the default settings for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBaiduChannel",
                "description": "Update the Baidu channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCampaign",
                "description": "Update a specific campaign.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "campaigns*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEmailChannel",
                "description": "Update the email channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEmailTemplate",
                "description": "Update a specific email template under the same version or generate a new version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEndpoint",
                "description": "Create an endpoint or update the information for an endpoint.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEndpointsBatch",
                "description": "Create or update endpoints as a batch operation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGcmChannel",
                "description": "Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJourney",
                "description": "Update a specific journey.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "journeys*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJourneyState",
                "description": "Update a specific journey state.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "journeys*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePushTemplate",
                "description": "Update a specific push notification template under the same version or generate a new version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRecommenderConfiguration",
                "description": "Update an Amazon Pinpoint configuration for a recommender model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "recommenders*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSegment",
                "description": "Update a specific segment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "segments*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSmsChannel",
                "description": "Update the SMS channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSmsTemplate",
                "description": "Update a specific sms message template under the same version or generate a new version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTemplateActiveVersion",
                "description": "Upate the active version parameter of a specific template.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVoiceChannel",
                "description": "Update the Voice channel for an app.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apps*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVoiceTemplate",
                "description": "Update a specific voice message template under the same version or generate a new version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "templates*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "apps",
                "arn": "arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "campaigns",
                "arn": "arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "journeys",
                "arn": "arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "segments",
                "arn": "arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "templates",
                "arn": "arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${ChannelType}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "recommenders",
                "arn": "arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters access by a key that is present in the request the user makes to the pinpoint service.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access by a tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon MQ",
        "prefix": "mq",
        "privileges": [
            {
                "privilege": "CreateBroker",
                "description": "Grants permission to create a broker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfiguration",
                "description": "Grants permission to create a new configuration for the specified configuration name. Amazon MQ uses the default configuration (the engine type and engine version).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Grants permission to create tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "brokers",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurations",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Grants permission to create an ActiveMQ user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBroker",
                "description": "Grants permission to delete a broker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Grants permission to delete tags.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "brokers",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurations",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Grants permission to delete an ActiveMQ user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBroker",
                "description": "Grants permission to return information about the specified broker.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBrokerEngineTypes",
                "description": "Grants permission to return information about broker engines.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBrokerInstanceOptions",
                "description": "Grants permission to return information about the broker instance options",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfiguration",
                "description": "Grants permission to return information about the specified configuration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configurations*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationRevision",
                "description": "Grants permission to return the specified configuration revision for the specified configuration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configurations*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUser",
                "description": "Grants permission to return information about an ActiveMQ user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBrokers",
                "description": "Grants permission to return a list of all brokers.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurationRevisions",
                "description": "Grants permission to return a list of all existing revisions for the specified configuration.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "configurations*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurations",
                "description": "Grants permission to return a list of all configurations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Grants permission to return a list of tags.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "brokers",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "configurations",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Grants permission to return a list of all ActiveMQ users.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootBroker",
                "description": "Grants permission to reboot a broker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBroker",
                "description": "Grants permission to add a pending configuration change to a broker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfiguration",
                "description": "Grants permission to update the specified configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configurations*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Grants permission to update the information for an ActiveMQ user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "brokers*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "brokers",
                "arn": "arn:${Partition}:mq:${Region}:${Account}:broker:${broker-id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "configurations",
                "arn": "arn:${Partition}:mq:${Region}:${Account}:configuration:${configuration-id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Neptune",
        "prefix": "neptune-db",
        "privileges": [
            {
                "privilege": "connect",
                "description": "Connect to database",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "database*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "database",
                "arn": "arn:${Partition}:neptune-db:${Region}:${Account}:${RelativeId}/database",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Network Manager",
        "prefix": "networkmanager",
        "privileges": [
            {
                "privilege": "AssociateCustomerGateway",
                "description": "Grants permission to associate a customer gateway to a device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "networkmanager:cgwArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateLink",
                "description": "Grants permission to associate a link to a device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDevice",
                "description": "Grants permission to create a new device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGlobalNetwork",
                "description": "Grants permission to create a new global network",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateLink",
                "description": "Grants permission to create a new link",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSite",
                "description": "Grants permission to create a new site",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDevice",
                "description": "Grants permission to delete a device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGlobalNetwork",
                "description": "Grants permission to delete a global network",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLink",
                "description": "Grants permission to delete a link",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSite",
                "description": "Grants permission to delete a site",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTransitGateway",
                "description": "Grants permission to deregister a transit gateway from a global network",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "networkmanager:tgwArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGlobalNetworks",
                "description": "Grants permission to describe global networks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateCustomerGateway",
                "description": "Grants permission to disassociate a customer gateway from a device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "networkmanager:cgwArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateLink",
                "description": "Grants permission to disassociate a link from a device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCustomerGatewayAssociations",
                "description": "Grants permission to describe customer gateway associations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDevices",
                "description": "Grants permission to describe devices",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLinkAssociations",
                "description": "Grants permission to describe link associations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLinks",
                "description": "Grants permission to describe links",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSites",
                "description": "Grants permission to describe global networks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTransitGatewayRegistrations",
                "description": "Grants permission to describe transit gateway registrations",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to lists tag for a Network Manager resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTransitGateway",
                "description": "Grants permission to register a transit gateway to a global network",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "networkmanager:tgwArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag a Network Manager resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag a Network Manager resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "device",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDevice",
                "description": "Grants permission to update a device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGlobalNetwork",
                "description": "Grants permission to update a global network",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLink",
                "description": "Grants permission to update a link",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "link*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSite",
                "description": "Grants permission to update a site",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-network*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "site*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "global-network",
                "arn": "arn:${Partition}:networkmanager::${Account}:global-network/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "site",
                "arn": "arn:${Partition}:networkmanager::${Account}:site/${GlobalNetworkId}/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "link",
                "arn": "arn:${Partition}:networkmanager::${Account}:link/${GlobalNetworkId}/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "device",
                "arn": "arn:${Partition}:networkmanager::${Account}:device/${GlobalNetworkId}/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "networkmanager:cgwArn",
                "description": "Controls which customer gateways can be associated or disassociated",
                "type": "String"
            },
            {
                "condition": "networkmanager:tgwArn",
                "description": "Controls which transit gateways can be registered or deregistered",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS OpsWorks",
        "prefix": "opsworks",
        "privileges": [
            {
                "privilege": "AssignInstance",
                "description": "Assign a registered instance to a layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssignVolume",
                "description": "Assigns one of the stack's registered Amazon EBS volumes to a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateElasticIp",
                "description": "Associates one of the stack's registered Elastic IP addresses with a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachElasticLoadBalancer",
                "description": "Attaches an Elastic Load Balancing load balancer to a specified layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CloneStack",
                "description": "Creates a clone of a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApp",
                "description": "Creates an app for a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeployment",
                "description": "Runs deployment or stack commands",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstance",
                "description": "Creates an instance in a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLayer",
                "description": "Creates a layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStack",
                "description": "Creates a new stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserProfile",
                "description": "Creates a new user profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApp",
                "description": "Deletes a specified app",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInstance",
                "description": "Deletes a specified instance, which terminates the associated Amazon EC2 instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLayer",
                "description": "Deletes a specified layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStack",
                "description": "Deletes a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserProfile",
                "description": "Deletes a user profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterEcsCluster",
                "description": "Deletes a user profile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterElasticIp",
                "description": "Deregisters a specified Elastic IP address",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterInstance",
                "description": "Deregister a registered Amazon EC2 or on-premises instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterRdsDbInstance",
                "description": "Deregisters an Amazon RDS instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterVolume",
                "description": "Deregisters an Amazon EBS volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAgentVersions",
                "description": "Describes the available AWS OpsWorks agent versions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApps",
                "description": "Requests a description of a specified set of apps",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCommands",
                "description": "Describes the results of specified commands",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDeployments",
                "description": "Requests a description of a specified set of deployments",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEcsClusters",
                "description": "Describes Amazon ECS clusters that are registered with a stack",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticIps",
                "description": "Describes Elastic IP addresses",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeElasticLoadBalancers",
                "description": "Describes a stack's Elastic Load Balancing instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstances",
                "description": "Requests a description of a set of instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLayers",
                "description": "Requests a description of one or more layers in a specified stack",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoadBasedAutoScaling",
                "description": "Describes load-based auto scaling configurations for specified layers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMyUserProfile",
                "description": "Describes a user's SSH information",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePermissions",
                "description": "Describes the permissions for a specified stack",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRaidArrays",
                "description": "Describe an instance's RAID arrays",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRdsDbInstances",
                "description": "Describes Amazon RDS instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServiceErrors",
                "description": "Describes AWS OpsWorks service errors",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackProvisioningParameters",
                "description": "Requests a description of a stack's provisioning parameters",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStackSummary",
                "description": "Describes the number of layers and apps in a specified stack, and the number of instances in each state, such as running_setup or online",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStacks",
                "description": "Requests a description of one or more stacks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTimeBasedAutoScaling",
                "description": "Describes time-based auto scaling configurations for specified instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserProfiles",
                "description": "Describe specified users",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVolumes",
                "description": "Describes an instance's Amazon EBS volumes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachElasticLoadBalancer",
                "description": "Detaches a specified Elastic Load Balancing instance from its layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateElasticIp",
                "description": "Disassociates an Elastic IP address from its instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHostnameSuggestion",
                "description": "Gets a generated host name for the specified layer, based on the current host name theme",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GrantAccess",
                "description": "Grants RDP access to a Windows instance for a specified time period",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Returns a list of tags that are applied to the specified stack or layer",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootInstance",
                "description": "Reboots a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterEcsCluster",
                "description": "Registers a specified Amazon ECS cluster with a stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterElasticIp",
                "description": "Registers an Elastic IP address with a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterInstance",
                "description": "Registers instances with a specified stack that were created outside of AWS OpsWorks",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterRdsDbInstance",
                "description": "Registers an Amazon RDS instance with a stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterVolume",
                "description": "Registers an Amazon EBS volume with a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetLoadBasedAutoScaling",
                "description": "Specify the load-based auto scaling configuration for a specified layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetPermission",
                "description": "Specifies a user's permissions",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetTimeBasedAutoScaling",
                "description": "Specify the time-based auto scaling configuration for a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartInstance",
                "description": "Starts a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartStack",
                "description": "Starts a stack's instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopInstance",
                "description": "Stops a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopStack",
                "description": "Stops a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Apply tags to a specified stack or layer",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnassignInstance",
                "description": "Unassigns a registered instance from all of it's layers",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnassignVolume",
                "description": "Unassigns an assigned Amazon EBS volume",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes tags from a specified stack or layer",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApp",
                "description": "Updates a specified app",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateElasticIp",
                "description": "Updates a registered Elastic IP address's name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInstance",
                "description": "Updates a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLayer",
                "description": "Updates a specified layer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMyUserProfile",
                "description": "Updates a user's SSH public key",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRdsDbInstance",
                "description": "Updates an Amazon RDS instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStack",
                "description": "Updates a specified stack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserProfile",
                "description": "Updates a specified user profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVolume",
                "description": "Updates an Amazon EBS volume's name or mount point",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "stack",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "stack",
                "arn": "arn:${Partition}:opsworks:${Region}:${Account}:stack/${StackId}/",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS OpsWorks Configuration Management",
        "prefix": "opsworks-cm",
        "privileges": [
            {
                "privilege": "AssociateNode",
                "description": "Associate a node to a configuration management server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBackup",
                "description": "Create a backup for the specified server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateServer",
                "description": "Create a new server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBackup",
                "description": "Delete the specified backup and possibly its S3 bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServer",
                "description": "Deletes the specified server with his corresponding CF stack and possibly the S3 bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAttributes",
                "description": "Describe the service limits for the user's account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBackups",
                "description": "Describe a single backup, all backups of a specified server or all backups of the user's account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "Describe all events of the specified server.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNodeAssociationStatus",
                "description": "Describe the association status for the specified node token and the specified server.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServers",
                "description": "Describes the specified server or all servers of the user's account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateNode",
                "description": "Disassociates a specified node from a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreServer",
                "description": "Applies a backup to specified server. Possibly swaps out the ec2-instance if specified.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMaintenance",
                "description": "Start the server maintenance immediately.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServer",
                "description": "Update general server settings.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServerEngineAttributes",
                "description": "Update server settings specific to the configuration management type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Organizations",
        "prefix": "organizations",
        "privileges": [
            {
                "privilege": "AcceptHandshake",
                "description": "Grants permission to send a response to the originator of a handshake agreeing to the action proposed by the handshake request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "handshake*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachPolicy",
                "description": "Grants permission to attach a policy to a root, an organizational unit, or an individual account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "account",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelHandshake",
                "description": "Grants permission to cancel a handshake.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "handshake*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccount",
                "description": "Grants permission to create an AWS account that is automatically a member of the organization with the credentials that made the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGovCloudAccount",
                "description": "Grants permission to create an AWS GovCloud (US) account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOrganization",
                "description": "Grants permission to create an organization. The account with the credentials that calls the CreateOrganization operation automatically becomes the master account of the new organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOrganizationalUnit",
                "description": "Grants permission to create an organizational unit (OU) within a root or parent OU.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePolicy",
                "description": "Grants permission to create a policy that you can attach to a root, an organizational unit (OU), or an individual AWS account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeclineHandshake",
                "description": "Grants permission to decline a handshake request. This sets the handshake state to DECLINED and effectively deactivates the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "handshake*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOrganization",
                "description": "Grants permission to delete the organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOrganizationalUnit",
                "description": "Grants permission to delete an organizational unit from a root or another OU.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePolicy",
                "description": "Grants permission to delete a policy from your organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccount",
                "description": "Grants permission to retrieve Organizations-related details about the specified account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "account*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCreateAccountStatus",
                "description": "Grants permission to retrieve the current status of an asynchronous request to create an account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEffectivePolicy",
                "description": "Grants permission to retrieve the effective policy for an account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "account*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHandshake",
                "description": "Grants permission to retrieve details about a previously requested handshake.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "handshake*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganization",
                "description": "Grants permission to retrieves details about the organization that the calling credentials belong to.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganizationalUnit",
                "description": "Grants permission to retrieve details about an organizational unit (OU).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePolicy",
                "description": "Grants permission to retrieves details about a policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachPolicy",
                "description": "Grants permission to detach a policy from a target root, organizational unit, or account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "account",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableAWSServiceAccess",
                "description": "Grants permission to disable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:ServicePrincipal"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisablePolicyType",
                "description": "Grants permission to disable an organization policy type in a root.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "root*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableAWSServiceAccess",
                "description": "Grants permission to enable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:ServicePrincipal"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableAllFeatures",
                "description": "Grants permission to start the process to enable all features in an organization, upgrading it from supporting only Consolidated Billing features.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnablePolicyType",
                "description": "Grants permission to enable a policy type in a root.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "root*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InviteAccountToOrganization",
                "description": "Grants permission to send an invitation to another AWS account, asking it to join your organization as a member account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "account",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LeaveOrganization",
                "description": "Grants permission to remove a member account from its parent organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAWSServiceAccessForOrganization",
                "description": "Grants permission to retrieve the list of the AWS services for which you enabled integration with your organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccounts",
                "description": "Grants permission to list all of the the accounts in the organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccountsForParent",
                "description": "Grants permission to list the accounts in an organization that are contained by a root or organizational unit (OU).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListChildren",
                "description": "Grants permission to list all of the OUs or accounts that are contained in a parent OU or root.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCreateAccountStatus",
                "description": "Grants permission to list the asynchronous account creation requests that are currently being tracked for the organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHandshakesForAccount",
                "description": "Grants permission to list all of the handshakes that are associated with an account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHandshakesForOrganization",
                "description": "Grants permission to list the handshakes that are associated with the organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOrganizationalUnitsForParent",
                "description": "Grants permission to lists all of the organizational units (OUs) in a parent organizational unit or root.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListParents",
                "description": "Grants permission to list the root or organizational units (OUs) that serve as the immediate parent of a child OU or account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "account",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPolicies",
                "description": "Grants permission to list all of the policies in an organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPoliciesForTarget",
                "description": "Grants permission to list all of the policies that are directly attached to a root, organizational unit (OU), or account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "account",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRoots",
                "description": "Grants permission to list all of the roots that are defined in the organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list all tags for the specified resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTargetsForPolicy",
                "description": "Grants permission to list all the roots, OUs, and accounts to which a policy is attached.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "MoveAccount",
                "description": "Grants permission to move an account from its current root or OU to another parent root or OU.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "account*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "organizationalunit",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "root",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveAccountFromOrganization",
                "description": "Grants permission to removes the specified account from the organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "account*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add one or more tags to the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove one or more tags from the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateOrganizationalUnit",
                "description": "Grants permission to rename an organizational unit (OU).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organizationalunit*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePolicy",
                "description": "Grants permission to update an existing policy with a new name, description, or content.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "policy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "organizations:PolicyType"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "account",
                "arn": "arn:${Partition}:organizations::${MasterAccountId}:account/o-${OrganizationId}/${AccountId}",
                "condition_keys": []
            },
            {
                "resource": "handshake",
                "arn": "arn:${Partition}:organizations::${MasterAccountId}:handshake/o-${OrganizationId}/${HandshakeType}/h-${HandshakeId}",
                "condition_keys": []
            },
            {
                "resource": "organization",
                "arn": "arn:${Partition}:organizations::${MasterAccountId}:organization/o-${OrganizationId}",
                "condition_keys": []
            },
            {
                "resource": "organizationalunit",
                "arn": "arn:${Partition}:organizations::${MasterAccountId}:ou/o-${OrganizationId}/ou-${OrganizationalUnitId}",
                "condition_keys": []
            },
            {
                "resource": "policy",
                "arn": "arn:${Partition}:organizations::${MasterAccountId}:policy/o-${OrganizationId}/${PolicyType}/p-${PolicyId}",
                "condition_keys": []
            },
            {
                "resource": "awspolicy",
                "arn": "arn:${Partition}:organizations::aws:policy/${PolicyType}/p-${PolicyId}",
                "condition_keys": []
            },
            {
                "resource": "root",
                "arn": "arn:${Partition}:organizations::${MasterAccountId}:root/o-${OrganizationId}/r-${RootId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "organizations:PolicyType",
                "description": "Enables you to filter the request to only the specified policy type names.",
                "type": "String"
            },
            {
                "condition": "organizations:ServicePrincipal",
                "description": "Enables you to filter the request to only the specified service principal names.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Outposts",
        "prefix": "outposts",
        "privileges": [
            {
                "privilege": "CreateOutpost",
                "description": "Creates an Outpost",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOutpost",
                "description": "Gets information about the specified Outpost",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOutpostInstanceTypes",
                "description": "Lists the instance types for the specified Outpost",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOutposts",
                "description": "List the Outposts for your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSites",
                "description": "Lists the sites for the specified AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Outpost",
                "arn": "arn:${Partition}:outposts:${Region}:${Account}:outpost/${OutpostId}",
                "condition_keys": []
            },
            {
                "resource": "Site",
                "arn": "arn:${Partition}:outposts:${Region}:${Account}:site/${SiteId}",
                "condition_keys": []
            },
            {
                "resource": "Order",
                "arn": "arn:${Partition}:outposts:${Region}:${Account}:order/${OrderId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Personalize",
        "prefix": "personalize",
        "privileges": [
            {
                "privilege": "CreateCampaign",
                "description": "Creates a campaign",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "campaign*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataset",
                "description": "Creates a dataset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatasetGroup",
                "description": "Creates a dataset group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDatasetImportJob",
                "description": "Creates a dataset import job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetImportJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEventTracker",
                "description": "Creates an event tracker",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventTracker*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSchema",
                "description": "Creates a schema",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSolution",
                "description": "Creates a solution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "solution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSolutionVersion",
                "description": "Creates a solution version",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "solution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCampaign",
                "description": "Deletes a campaign",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "campaign*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDataset",
                "description": "Deletes a dataset",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDatasetGroup",
                "description": "Deletes a dataset group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventTracker",
                "description": "Deletes an event tracker",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventTracker*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSchema",
                "description": "Deletes a schema",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSolution",
                "description": "Deletes a solution including all versions of the solution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "solution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAlgorithm",
                "description": "Describes an algorithm",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "algorithm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCampaign",
                "description": "Describes a campaign",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "campaign*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDataset",
                "description": "Describes a dataset",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dataset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDatasetGroup",
                "description": "Describes a dataset group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datasetGroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDatasetImportJob",
                "description": "Describes a dataset import job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "datasetImportJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventTracker",
                "description": "Describes an event tracker",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "eventTracker*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFeatureTransformation",
                "description": "Describes a feature transformation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "featureTransformation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRecipe",
                "description": "Describes a recipe",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "recipe*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSchema",
                "description": "Describes a schema",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSolution",
                "description": "Describes a solution",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "solution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSolutionVersion",
                "description": "Describes a version of a solution",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "solution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPersonalizedRanking",
                "description": "Gets a re-ranked list of recommendations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "campaign*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRecommendations",
                "description": "Gets a list of recommendations from a campaign",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "campaign*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSolutionMetrics",
                "description": "Gets metrics for a solution version",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "solution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCampaigns",
                "description": "Lists campaigns",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasetGroups",
                "description": "Lists dataset groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasetImportJobs",
                "description": "Lists dataset import jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatasets",
                "description": "Lists datasets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEventTrackers",
                "description": "Lists event trackers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRecipes",
                "description": "Lists recipes",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSchemas",
                "description": "Lists schemas",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSolutionVersions",
                "description": "Lists versions of a solution",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSolutions",
                "description": "Lists solutions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEvents",
                "description": "Records real time event data",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventTracker*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCampaign",
                "description": "Updates a campaign",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "campaign*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "schema",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:schema/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "featureTransformation",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:feature-transformation/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "dataset",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:dataset/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "datasetGroup",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:dataset-group/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "datasetImportJob",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:dataset-import-job/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "solution",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:solution/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "campaign",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:campaign/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "eventTracker",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:event-tracker/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "recipe",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:recipe/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "algorithm",
                "arn": "arn:${Partition}:personalize:${Region}:${Account}:algorithm/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Performance Insights",
        "prefix": "pi",
        "privileges": [
            {
                "privilege": "DescribeDimensionKeys",
                "description": "For a specific time period, retrieve the top N dimension keys for a metric.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "metric-resource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceMetrics",
                "description": "Retrieve PI metrics for a set of data sources, over a time period.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "metric-resource*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "metric-resource",
                "arn": "arn:${Partition}:pi:${Region}:${Account}:metrics/${ServiceType}/${Identifier}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Polly",
        "prefix": "polly",
        "privileges": [
            {
                "privilege": "DeleteLexicon",
                "description": "Deletes the specified pronunciation lexicon stored in an AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "lexicon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVoices",
                "description": "Returns the list of voices that are available for use when requesting speech synthesis.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLexicon",
                "description": "Returns the content of the specified pronunciation lexicon stored in an AWS Region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "lexicon*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSpeechSynthesisTask",
                "description": "Enables the user to get information about specific speech synthesis task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLexicons",
                "description": "Returns a list of pronunciation lexicons stored in an AWS Region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSpeechSynthesisTasks",
                "description": "Enables the user to list requested speech synthesis tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLexicon",
                "description": "Stores a pronunciation lexicon in an AWS Region.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSpeechSynthesisTask",
                "description": "Enables the user to synthesize long inputs to provided S3 location.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "lexicon",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:PutObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "SynthesizeSpeech",
                "description": "Synthesizes UTF-8 input, plain text or SSML, to a stream of bytes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "lexicon",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "lexicon",
                "arn": "arn:${Partition}:polly:${Region}:${Account}:lexicon/${LexiconName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Price List",
        "prefix": "pricing",
        "privileges": [
            {
                "privilege": "DescribeServices",
                "description": "Returns the service details for all (paginated) services (if serviceCode is not set) or service detail for a particular service (if given serviceCode).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAttributeValues",
                "description": "Returns all (paginated) possible values for a given attribute.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetProducts",
                "description": "Returns all matching products with given search criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon QLDB",
        "prefix": "qldb",
        "privileges": [
            {
                "privilege": "CreateLedger",
                "description": "Grants permission to create a ledger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLedger",
                "description": "Grants permission to delete a ledger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJournalS3Export",
                "description": "Grants permission to describe information about a journal export job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLedger",
                "description": "Grants permission to describe a ledger",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecuteStatement",
                "description": "Grants permission to send commands to a ledger via the console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExportJournalToS3",
                "description": "Grants permission to export journal contents to an Amazon S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBlock",
                "description": "Grants permission to retrieve a block from a ledger for a given BlockAddress",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDigest",
                "description": "Grants permission to retrieve a digest from a ledger for a given BlockAddress",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRevision",
                "description": "Grants permission to retrieve a revision for a given document ID and a given BlockAddress",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InsertSampleData",
                "description": "Grants permission to insert sample application data via the console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJournalS3Exports",
                "description": "Grants permission to list journal export jobs for all ledgers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJournalS3ExportsForLedger",
                "description": "Grants permission to list journal export jobs for a specified ledger",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLedgers",
                "description": "Grants permission to list existing ledgers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags for a resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ledger",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendCommand",
                "description": "Grants permission to send commands to a ledger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ShowCatalog",
                "description": "Grants permission to view a ledger's catalog via the console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add one or more tags to a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ledger",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove one or more tags to a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ledger",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateLedger",
                "description": "Grants permission to update properties on a ledger",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ledger*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "ledger",
                "arn": "arn:${Partition}:qldb:${Region}:${Account}:ledger/${LedgerName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon QuickSight",
        "prefix": "quicksight",
        "privileges": [
            {
                "privilege": "CreateAdmin",
                "description": "CreateAdmin enables the user to provision Amazon QuickSight administrators, authors, and readers.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDashboard",
                "description": "Creates a dashboard from a template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Create a QuickSight group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroupMembership",
                "description": "Add a QuickSight user to a QuickSight group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [
                            "quicksight:UserName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIAMPolicyAssignment",
                "description": "Creates an assignment with one specified IAM Policy ARN that will be assigned to specified groups or users of QuickSight.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "assignment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReader",
                "description": "CreateReader enables the user to provision Amazon QuickSight readers.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTemplate",
                "description": "Creates a template from an existing QuickSight analysis or template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTemplateAlias",
                "description": "Creates a template alias for a template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "CreateUser enables the user to provision Amazon QuickSight authors and readers.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDashboard",
                "description": "Deletes a dashboard",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Remove a user group from QuickSight.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroupMembership",
                "description": "Remove a user from a group so that he/she is no longer a member of the group.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [
                            "quicksight:UserName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIAMPolicyAssignment",
                "description": "Update an existing assignment.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "assignment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTemplate",
                "description": "Deletes a template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTemplateAlias",
                "description": "Deletes the item that the specified template alias points to",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Delete the QuickSight user that is associated with the identity of the IAM user/role making the call. The IAM user is not deleted as a result of this call.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserByPrincipalId",
                "description": "Deletes a user identified by its principal ID.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDashboard",
                "description": "Provides a summary for a dashboard",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDashboardPermissions",
                "description": "Describes read and write permissions for a dashboard",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGroup",
                "description": "Return a QuickSight group\u2019s description and ARN.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIAMPolicyAssignment",
                "description": "Describe an existing assignment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "assignment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTemplate",
                "description": "Describes a template's metadata",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTemplateAlias",
                "description": "Describes the template alias for a template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTemplatePermissions",
                "description": "Describes read and write permissions on a template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUser",
                "description": "Return information about a user, given the user name.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAuthCode",
                "description": "Return an auth code representing a QuickSight user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDashboardEmbedUrl",
                "description": "Return a QuickSight dashboard embedding URL.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroupMapping",
                "description": "GetGroupMapping is used only in Amazon QuickSight Enterprise edition accounts. It enables the user to use Amazon QuickSight to identify and display the Microsoft Active Directory (Microsoft Active Directory) directory groups that are mapped to roles in Amazon QuickSight.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDashboardVersions",
                "description": "Lists all the versions of the dashboards in the QuickSight subscription",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDashboards",
                "description": "Lists dashboards in an AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupMemberships",
                "description": "Return a list of member users in a group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Get a list of all user groups in QuickSight.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIAMPolicyAssignments",
                "description": "List all assignments in the current Amazon QuickSight account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "assignment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIAMPolicyAssignmentsForUser",
                "description": "List all assignments assigned to a user and the groups it belongs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "assignment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags of a QuickSight resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "dashboard",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "template",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTemplateAliases",
                "description": "Lists all the aliases of a template",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTemplateVersions",
                "description": "Lists all the versions of the templates in the current Amazon QuickSight account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTemplates",
                "description": "Lists all the templates in the current Amazon QuickSight account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserGroups",
                "description": "Return a list of groups that a given user is a member of.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Return a list of all of the QuickSight users belonging to this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterUser",
                "description": "Create a QuickSight user, whose identity is associated with the IAM identity/role specified in the request.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [
                            "quicksight:IamArn",
                            "quicksight:SessionName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchDirectoryGroups",
                "description": "SearchDirectoryGroups is used only in Amazon QuickSight Enterprise edition accounts. It enables the user to use Amazon QuickSight to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetGroupMapping",
                "description": "SearchDirectoryGroups is used only in Amazon QuickSight Enterprise edition accounts. It enables the user to use Amazon QuickSight to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Subscribe",
                "description": "Subscribe enables the user to subscribe to Amazon QuickSight. Enabling this action also allows the user to upgrade the subscription to Enterprise edition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to a QuickSight resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "dashboard",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "template",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Unsubscribe",
                "description": "Unsubscribe enables the user to unsubscribe from Amazon QuickSight, which permanently deletes all users and their resources from Amazon QuickSight.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove tags from a QuickSight resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "dashboard",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "template",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDashboard",
                "description": "Updates a dashboard in an AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDashboardPermissions",
                "description": "Updates read and write permissions on a dashboard",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDashboardPublishedVersion",
                "description": "Updates the published version of a dashboard",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dashboard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Change group description.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIAMPolicyAssignment",
                "description": "Update an existing assignment.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "assignment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTemplate",
                "description": "Updates a template from an existing Amazon QuickSight analysis or another template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTemplateAlias",
                "description": "Updates the template alias of a template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTemplatePermissions",
                "description": "Updates the resource permissions for a template",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "template*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Updates an Amazon QuickSight user.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "user",
                "arn": "arn:${Partition}:quicksight:${Region}:${Account}:user/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "group",
                "arn": "arn:${Partition}:quicksight:${Region}:${Account}:group/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "dashboard",
                "arn": "arn:${Partition}:quicksight:${Region}:${Account}:dashboard/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "template",
                "arn": "arn:${Partition}:quicksight:${Region}:${Account}:template/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "assignment",
                "arn": "arn:${Partition}:quicksight::${Account}:assignment/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "quicksight:IamArn",
                "description": "IAM user ARN or role ARN.",
                "type": "String"
            },
            {
                "condition": "quicksight:SessionName",
                "description": "The session name.",
                "type": "String"
            },
            {
                "condition": "quicksight:UserName",
                "description": "The user name.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Resource Access Manager",
        "prefix": "ram",
        "privileges": [
            {
                "privilege": "AcceptResourceShareInvitation",
                "description": "Accept the specified resource share invitation",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resource-share-invitation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ram:ShareOwnerAccountId"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateResourceShare",
                "description": "Associates resource(s) and/or principal(s) to a resource share",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:ResourceShareName",
                            "ram:AllowsExternalPrincipals",
                            "ram:Principal",
                            "ram:RequestedResourceType",
                            "ram:ResourceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateResourceSharePermission",
                "description": "Associate a Permission with a Resource Share",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "permission*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:AllowsExternalPrincipals",
                            "ram:ResourceShareName",
                            "ram:PermissionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResourceShare",
                "description": "Create resource share with provided resource(s) and/or principal(s)",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "ram:RequestedResourceType",
                            "ram:ResourceArn",
                            "ram:RequestedAllowsExternalPrincipals",
                            "ram:Principal"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourceShare",
                "description": "Delete resource share",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:ResourceShareName",
                            "ram:AllowsExternalPrincipals"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateResourceShare",
                "description": "Disassociates resource(s) and/or principal(s) from a resource share",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:ResourceShareName",
                            "ram:AllowsExternalPrincipals",
                            "ram:Principal",
                            "ram:RequestedResourceType",
                            "ram:ResourceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateResourceSharePermission",
                "description": "Disassociate a Permission from a Resource Share",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "permission*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:AllowsExternalPrincipals",
                            "ram:ResourceShareName",
                            "ram:PermissionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableSharingWithAwsOrganization",
                "description": "Grants permission to access customer's organization and create a SLR in the customer's account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPermission",
                "description": "Gets the contents of an AWS RAM permission",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "permission*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ram:PermissionArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourcePolicies",
                "description": "Gets the policies for the specified resources that you own and have shared",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceShareAssociations",
                "description": "Get a set of resource share associations from a provided list or with a specified status of the specified type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceShareInvitations",
                "description": "Get resource share invitations by the specified invitation arn or those for the resource share",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourceShares",
                "description": "Get a set of resource shares from a provided list or with a specified status",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPendingInvitationResources",
                "description": "Lists the resources in a resource share that is shared with you but that the invitation is still pending for",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resource-share-invitation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPermissions",
                "description": "Lists the AWS RAM permissions",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPrincipals",
                "description": "Lists the principals that you have shared resources with or that have shared resources with you",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceSharePermissions",
                "description": "List the Permissions associated with a Resource Share",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:ResourceShareName",
                            "ram:AllowsExternalPrincipals"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResources",
                "description": "Lists the resources that you added to a resource shares or the resources that are shared with you",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectResourceShareInvitation",
                "description": "Reject the specified resource share invitation",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resource-share-invitation*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ram:ShareOwnerAccountId"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Tag the specified resources share",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Untag the specified resource share",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResourceShare",
                "description": "Update attributes of the resource share",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resource-share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ram:ResourceShareName",
                            "ram:AllowsExternalPrincipals",
                            "ram:RequestedAllowsExternalPrincipals"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "resource-share",
                "arn": "arn:${Partition}:ram:${Region}:${Account}:resource-share/${ResourcePath}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ram:AllowsExternalPrincipals",
                    "ram:ResourceShareName"
                ]
            },
            {
                "resource": "resource-share-invitation",
                "arn": "arn:${Partition}:ram:${Region}:${Account}:resource-share-invitation/${ResourcePath}",
                "condition_keys": []
            },
            {
                "resource": "permission",
                "arn": "arn:${Partition}:ram::${Account}:permission/${ResourcePath}",
                "condition_keys": [
                    "ram:PermissionArn"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Specifies a tag key and value pair that must be used when creating or tagging a resource share. If users don't pass these specific tags, or if they don't specify tags at all, the request fails.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Indicates that the action can only be performed on resources that have the specified tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Specifies the tag keys that can be used when creating or tagging a resource share",
                "type": "String"
            },
            {
                "condition": "ram:AllowsExternalPrincipals",
                "description": "Indicates that the action can only be performed on resource shares that allow or deny sharing with external principals. For example, specify true if the action can only be performed on resource shares that allow sharing with external principals. External principals are AWS accounts that are outside of its AWS organization",
                "type": "Bool"
            },
            {
                "condition": "ram:PermissionArn",
                "description": "Indicates that the action can only be performed on a resource using the specified Permission ARN.",
                "type": "Arn"
            },
            {
                "condition": "ram:Principal",
                "description": "Principals with the specified format can be associated to or disassociated from a resource share",
                "type": "String"
            },
            {
                "condition": "ram:RequestedAllowsExternalPrincipals",
                "description": "The request must have the specified value for 'allowExternalPrincipals'. External principals are AWS accounts that are outside of its AWS Organization",
                "type": "Bool"
            },
            {
                "condition": "ram:RequestedResourceType",
                "description": "Indicates that the action can only be performed on the specified resource type",
                "type": "String"
            },
            {
                "condition": "ram:ResourceArn",
                "description": "Indicates that the action can only be performed on a resource with the specified ARN.",
                "type": "Arn"
            },
            {
                "condition": "ram:ResourceShareName",
                "description": "Indicates that the action can only be performed on a resource share with the specified name.",
                "type": "String"
            },
            {
                "condition": "ram:ShareOwnerAccountId",
                "description": "Indicates that the action can only be performed on resource shares owned by a specific account. For example, you can use this condition key to specify which resource share invitations can be accepted or rejected based on the resource share owner\u2019s account ID.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon RDS",
        "prefix": "rds",
        "privileges": [
            {
                "privilege": "AddRoleToDBCluster",
                "description": "Associates an Identity and Access Management (IAM) role from an Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "AddRoleToDBInstance",
                "description": "Associates an AWS Identity and Access Management (IAM) role with a DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "AddSourceIdentifierToSubscription",
                "description": "Adds a source identifier to an existing RDS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTagsToResource",
                "description": "Adds metadata tags to an Amazon RDS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "db",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "es",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "og",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pg",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ri",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "secgrp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ApplyPendingMaintenanceAction",
                "description": "Applies a pending maintenance action to a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeDBSecurityGroupIngress",
                "description": "Enables ingress to a DBSecurityGroup using one of two forms of authorization.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BacktrackDBCluster",
                "description": "Backtracks a DB cluster to a specific time, without creating a new DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelExportTask",
                "description": "Cancels an export task in progress.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyDBClusterParameterGroup",
                "description": "Copies the specified DB cluster parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyDBClusterSnapshot",
                "description": "Creates a snapshot of a DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyDBParameterGroup",
                "description": "Copies the specified DB parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyDBSnapshot",
                "description": "Copies the specified DB snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyOptionGroup",
                "description": "Copies the specified option group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBCluster",
                "description": "Creates a new Amazon Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}",
                            "rds:DatabaseEngine",
                            "rds:DatabaseName",
                            "rds:StorageEncrypted"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBClusterEndpoint",
                "description": "Creates a new custom endpoint and associates it with an Amazon Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "cluster-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "rds:EndpointType",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBClusterParameterGroup",
                "description": "Create a new DB cluster parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBClusterSnapshot",
                "description": "Creates a snapshot of a DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBInstance",
                "description": "Creates a new DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBInstanceReadReplica",
                "description": "Creates a DB instance that acts as a Read Replica of a source DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBParameterGroup",
                "description": "Creates a new DB parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBProxy",
                "description": "Grants permission to create a database proxy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateDBSecurityGroup",
                "description": "Creates a new DB security group. DB security groups control access to a DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBSnapshot",
                "description": "Creates a DBSnapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDBSubnetGroup",
                "description": "Creates a new DB subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEventSubscription",
                "description": "Creates an RDS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGlobalCluster",
                "description": "Creates an Aurora global database spread across multiple regions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOptionGroup",
                "description": "Creates a new option group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBCluster",
                "description": "The DeleteDBCluster action deletes a previously provisioned DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBClusterEndpoint",
                "description": "Deletes a custom endpoint and removes it from an Amazon Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBClusterParameterGroup",
                "description": "Deletes a specified DB cluster parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBClusterSnapshot",
                "description": "Deletes a DB cluster snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBInstance",
                "description": "The DeleteDBInstance action deletes a previously provisioned DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBInstanceAutomatedBackup",
                "description": "Deletes automated backups based on the source instance's DbiResourceId value or the restorable instance's resource ID.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBParameterGroup",
                "description": "Deletes a specified DBParameterGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBProxy",
                "description": "Grants permission to delete a database proxy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "proxy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBSecurityGroup",
                "description": "Deletes a DB security group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBSnapshot",
                "description": "Deletes a DBSnapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDBSubnetGroup",
                "description": "Deletes a DB subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventSubscription",
                "description": "Deletes an RDS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGlobalCluster",
                "description": "Deletes a global database cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOptionGroup",
                "description": "Deletes an existing option group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterDBProxyTargets",
                "description": "Grants permission to remove targets from a database proxy target group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "proxy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "target-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAttributes",
                "description": "Lists all of the attributes for a customer account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCertificates",
                "description": "Lists the set of CA certificates provided by Amazon RDS for this AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusterBacktracks",
                "description": "Returns information about backtracks for a DB cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusterEndpoints",
                "description": "Returns information about endpoints for an Amazon Aurora DB cluster.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusterParameterGroups",
                "description": "Returns a list of DBClusterParameterGroup descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusterParameters",
                "description": "Returns the detailed parameter list for a particular DB cluster parameter group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusterSnapshotAttributes",
                "description": "Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusterSnapshots",
                "description": "Returns information about DB cluster snapshots.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBClusters",
                "description": "Returns information about provisioned Aurora DB clusters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBEngineVersions",
                "description": "Returns a list of the available DB engines.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBInstanceAutomatedBackups",
                "description": "Returns a list of automated backups for both current and deleted instances.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBInstances",
                "description": "Returns information about provisioned RDS instances.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBLogFiles",
                "description": "Returns a list of DB log files for the DB instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBParameterGroups",
                "description": "Returns a list of DBParameterGroup descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBParameters",
                "description": "Returns the detailed parameter list for a particular DB parameter group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBProxies",
                "description": "Grants permission to view proxies",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "proxy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBProxyTargetGroups",
                "description": "Grants permission to view database proxy target group details",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "proxy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBProxyTargets",
                "description": "Grants permission to view database proxy target details",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "proxy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "target-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBSecurityGroups",
                "description": "Returns a list of DBSecurityGroup descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBSnapshotAttributes",
                "description": "Returns a list of DB snapshot attribute names and values for a manual DB snapshot.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBSnapshots",
                "description": "Returns information about DB snapshots.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDBSubnetGroups",
                "description": "Returns a list of DBSubnetGroup descriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEngineDefaultClusterParameters",
                "description": "Returns the default engine and system parameter information for the cluster database engine.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEngineDefaultParameters",
                "description": "Returns the default engine and system parameter information for the specified database engine.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventCategories",
                "description": "Displays a list of categories for all event source types, or, if specified, for a specified source type.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventSubscriptions",
                "description": "Lists all the subscription descriptions for a customer account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "Returns events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExportTasks",
                "description": "Returns information about the export tasks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGlobalClusters",
                "description": "Returns information about Aurora global database clusters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOptionGroupOptions",
                "description": "Describes all available options.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOptionGroups",
                "description": "Describes the available option groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrderableDBInstanceOptions",
                "description": "Returns a list of orderable DB instance options for the specified engine.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePendingMaintenanceActions",
                "description": "Returns a list of resources (for example, DB instances) that have at least one pending maintenance action.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedDBInstances",
                "description": "Returns information about reserved DB instances for this account, or about a specified reserved DB instance.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "ri*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedDBInstancesOfferings",
                "description": "Lists available reserved DB instance offerings.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSourceRegions",
                "description": "Returns a list of the source AWS Regions where the current AWS Region can create a Read Replica or copy a DB snapshot from.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeValidDBInstanceModifications",
                "description": "Lists available modifications you can make to your DB instance",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DownloadCompleteDBLogFile",
                "description": "Downloads the contents of the specified database log file.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DownloadDBLogFilePortion",
                "description": "Downloads all or a portion of the specified log file, up to 1 MB in size.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "FailoverDBCluster",
                "description": "Forces a failover for a DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists all tags on an Amazon RDS resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "db",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "es",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "og",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pg",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ri",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "secgrp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCurrentDBClusterCapacity",
                "description": "Modify current cluster capacity for an Amazon Aurora Severless DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBCluster",
                "description": "Modify a setting for an Amazon Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBClusterEndpoint",
                "description": "Modifies the properties of an endpoint in an Amazon Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBClusterParameterGroup",
                "description": "Modifies the parameters of a DB cluster parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBClusterSnapshotAttribute",
                "description": "Adds an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBInstance",
                "description": "Modify settings for a DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBParameterGroup",
                "description": "Modifies the parameters of a DB parameter group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBProxy",
                "description": "Grants permission to modify database proxy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "proxy*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "ModifyDBProxyTargetGroup",
                "description": "Grants permission to modify target group for a database proxy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "target-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBSnapshot",
                "description": "Updates a manual DB snapshot, which can be encrypted or not encrypted, with a new engine version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBSnapshotAttribute",
                "description": "Adds an attribute and values to, or removes an attribute and values from, a manual DB snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDBSubnetGroup",
                "description": "Modifies an existing DB subnet group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyEventSubscription",
                "description": "Modifies an existing RDS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyGlobalCluster",
                "description": "Modify a setting for an Amazon Aurora global cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "global-cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyOptionGroup",
                "description": "Modifies an existing option group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "PromoteReadReplica",
                "description": "Promotes a Read Replica DB instance to a standalone DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PromoteReadReplicaDBCluster",
                "description": "Promotes a Read Replica DB cluster to a standalone DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseReservedDBInstancesOffering",
                "description": "Purchases a reserved DB instance offering.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ri*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootDBInstance",
                "description": "Rebooting a DB instance restarts the database engine service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDBProxyTargets",
                "description": "Grants permission to add targets to a database proxy target group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "target-group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveFromGlobalCluster",
                "description": "Detaches an Aurora secondary cluster from an Aurora global database cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "global-cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveRoleFromDBCluster",
                "description": "Disassociates an AWS Identity and Access Management (IAM) role from an Amazon Aurora DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "RemoveRoleFromDBInstance",
                "description": "Disassociates an AWS Identity and Access Management (IAM) role from a DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "RemoveSourceIdentifierFromSubscription",
                "description": "Removes a source identifier from an existing RDS event notification subscription.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "es*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "Removes metadata tags from an Amazon RDS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "db",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "es",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "og",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "pg",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "ri",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "secgrp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetDBClusterParameterGroup",
                "description": "Modifies the parameters of a DB cluster parameter group to the default value.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster-pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetDBParameterGroup",
                "description": "Modifies the parameters of a DB parameter group to the engine/system default value.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "pg*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDBClusterFromS3",
                "description": "Creates an Amazon Aurora DB cluster from data stored in an Amazon S3 bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}",
                            "rds:DatabaseEngine",
                            "rds:DatabaseName",
                            "rds:StorageEncrypted"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDBClusterFromSnapshot",
                "description": "Creates a new DB cluster from a DB cluster snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "cluster-snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDBClusterToPointInTime",
                "description": "Restores a DB cluster to an arbitrary point in time.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDBInstanceFromDBSnapshot",
                "description": "Creates a new DB instance from a DB snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDBInstanceFromS3",
                "description": "Creates a new DB instance from an Amazon S3 bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDBInstanceToPointInTime",
                "description": "Restores a DB instance to an arbitrary point in time.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "og*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "subgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "rds:req-tag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeDBSecurityGroupIngress",
                "description": "Revokes ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "secgrp*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartActivityStream",
                "description": "Enables the user to start Activity Stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDBCluster",
                "description": "Starts the DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDBInstance",
                "description": "Starts the DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartExportTask",
                "description": "Starts a new Export task for a DB snapshot.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "StopActivityStream",
                "description": "Enables the user to stop Activity Stream.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDBCluster",
                "description": "Stops the DB cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDBInstance",
                "description": "Stops the DB instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "db*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:cluster-tag/${TagKey}"
                ]
            },
            {
                "resource": "cluster-endpoint",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:cluster-endpoint:${DbClusterEndpoint}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "cluster-pg",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:cluster-pg-tag/${TagKey}"
                ]
            },
            {
                "resource": "cluster-snapshot",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:cluster-snapshot:${ClusterSnapshotName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:cluster-snapshot-tag/${TagKey}"
                ]
            },
            {
                "resource": "db",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:DatabaseClass",
                    "rds:DatabaseEngine",
                    "rds:DatabaseName",
                    "rds:MultiAz",
                    "rds:Piops",
                    "rds:StorageEncrypted",
                    "rds:StorageSize",
                    "rds:Vpc",
                    "rds:db-tag/${TagKey}"
                ]
            },
            {
                "resource": "es",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:es:${SubscriptionName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:es-tag/${TagKey}"
                ]
            },
            {
                "resource": "global-cluster",
                "arn": "arn:${Partition}:rds:${Account}:global-cluster:${GlobalCluster}",
                "condition_keys": []
            },
            {
                "resource": "og",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:og:${OptionGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:og-tag/${TagKey}"
                ]
            },
            {
                "resource": "pg",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:pg:${ParameterGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:pg-tag/${TagKey}"
                ]
            },
            {
                "resource": "proxy",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:db-proxy:${DbProxyId}",
                "condition_keys": []
            },
            {
                "resource": "ri",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:ri:${ReservedDbInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:ri-tag/${TagKey}"
                ]
            },
            {
                "resource": "secgrp",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:secgrp:${SecurityGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:secgrp-tag/${TagKey}"
                ]
            },
            {
                "resource": "snapshot",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:snapshot:${SnapshotName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:snapshot-tag/${TagKey}"
                ]
            },
            {
                "resource": "subgrp",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:subgrp:${SubnetGroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "rds:subgrp-tag/${TagKey}"
                ]
            },
            {
                "resource": "target",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:target:${TargetId}",
                "condition_keys": []
            },
            {
                "resource": "target-group",
                "arn": "arn:${Partition}:rds:${Region}:${Account}:target-group:${TargetGroupId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "rds:DatabaseClass",
                "description": "A type of DB instance class.",
                "type": "String"
            },
            {
                "condition": "rds:DatabaseEngine",
                "description": "A database engine, such as MySQL.",
                "type": "String"
            },
            {
                "condition": "rds:DatabaseName",
                "description": "The user-defined name of the database on the DB instance.",
                "type": "String"
            },
            {
                "condition": "rds:EndpointType",
                "description": "The type of the endpoint. One of: READER, WRITER, CUSTOM.",
                "type": "String"
            },
            {
                "condition": "rds:MultiAz",
                "description": "A value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true.",
                "type": "Boolean"
            },
            {
                "condition": "rds:Piops",
                "description": "A value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0.",
                "type": "Numeric"
            },
            {
                "condition": "rds:StorageEncrypted",
                "description": "A value that specifies whether the DB instance storage should be encrypted. To enforce storage encryption, specify true.",
                "type": "Boolean"
            },
            {
                "condition": "rds:StorageSize",
                "description": "The storage volume size (in GB).",
                "type": "Numeric"
            },
            {
                "condition": "rds:Vpc",
                "description": "A value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true.",
                "type": "Boolean"
            },
            {
                "condition": "rds:cluster-pg-tag/${TagKey}",
                "description": "A tag attached to a DB cluster parameter group.",
                "type": "String"
            },
            {
                "condition": "rds:cluster-snapshot-tag/${TagKey}",
                "description": "A tag attached to a DB cluster snapshot.",
                "type": "String"
            },
            {
                "condition": "rds:cluster-tag/${TagKey}",
                "description": "A tag attached to a DB cluster.",
                "type": "String"
            },
            {
                "condition": "rds:db-tag/${TagKey}",
                "description": "A tag attached to a DB instance.",
                "type": "String"
            },
            {
                "condition": "rds:es-tag/${TagKey}",
                "description": "A tag attached to an event subscription.",
                "type": "String"
            },
            {
                "condition": "rds:og-tag/${TagKey}",
                "description": "A tag attached to a DB option group.",
                "type": "String"
            },
            {
                "condition": "rds:pg-tag/${TagKey}",
                "description": "A tag attached to a DB parameter group.",
                "type": "String"
            },
            {
                "condition": "rds:req-tag/${TagKey}",
                "description": "Limits the set of tag keys and values that can be used to tag a resource.",
                "type": "String"
            },
            {
                "condition": "rds:ri-tag/${TagKey}",
                "description": "A tag attached to a reserved DB instance.",
                "type": "String"
            },
            {
                "condition": "rds:secgrp-tag/${TagKey}",
                "description": "A tag attached to a DB security group.",
                "type": "String"
            },
            {
                "condition": "rds:snapshot-tag/${TagKey}",
                "description": "A tag attached to a DB snapshot.",
                "type": "String"
            },
            {
                "condition": "rds:subgrp-tag/${TagKey}",
                "description": "A tag attached to a DB subnet group.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon RDS Data API",
        "prefix": "rds-data",
        "privileges": [
            {
                "privilege": "BatchExecuteStatement",
                "description": "Runs a batch SQL statement over an array of data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BeginTransaction",
                "description": "Starts a SQL transaction.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CommitTransaction",
                "description": "Ends a SQL transaction started with the BeginTransaction operation and commits the changes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "rds-data:BeginTransaction"
                        ]
                    }
                ]
            },
            {
                "privilege": "ExecuteSql",
                "description": "Runs one or more SQL statements. This operation is deprecated. Use the BatchExecuteStatement or ExecuteStatement operation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecuteStatement",
                "description": "Runs a SQL statement against a database.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RollbackTransaction",
                "description": "Performs a rollback of a transaction. Rolling back a transaction cancels its changes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "rds-data:BeginTransaction"
                        ]
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon RDS IAM Authentication",
        "prefix": "rds-db",
        "privileges": [
            {
                "privilege": "connect",
                "description": "Allows IAM role or user to connect to RDS database",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "db-user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "db-user",
                "arn": "arn:${Partition}:rds-db:${Region}:${Account}:dbuser:${DbiResourceId}/${DbUserName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Redshift",
        "prefix": "redshift",
        "privileges": [
            {
                "privilege": "AcceptReservedNodeExchange",
                "description": "Grants permission to exchange a DC1 reserved node for a DC2 reserved node with no changes to the configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeClusterSecurityGroupIngress",
                "description": "Grants permission to add an inbound (ingress) rule to an Amazon Redshift security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securitygroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "securitygroupingress-ec2securitygroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeSnapshotAccess",
                "description": "Grants permission to the specified AWS account to restore a snapshot",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDeleteClusterSnapshots",
                "description": "Grants permission to delete snapshots in a batch of size upto 100",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchModifyClusterSnapshots",
                "description": "Grants permission to modify settings for a list of snapshots",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelQuery",
                "description": "Grants permission to cancel a query through the Amazon Redshift console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelQuerySession",
                "description": "Grants permission to see queries in the Amazon Redshift console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelResize",
                "description": "Grants permission to cancel a resize operation",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyClusterSnapshot",
                "description": "Grants permission to copy a cluster snapshot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCluster",
                "description": "Grants permission to create a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClusterParameterGroup",
                "description": "Grants permission to create an Amazon Redshift parameter group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parametergroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClusterSecurityGroup",
                "description": "Grants permission to create an Amazon Redshift security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securitygroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClusterSnapshot",
                "description": "Grants permission to create a manual snapshot of the specified cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClusterSubnetGroup",
                "description": "Grants permission to create an Amazon Redshift subnet group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subnetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateClusterUser",
                "description": "Grants permission to automatically create the specified Amazon Redshift user if it does not exist",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "dbuser*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "redshift:DbUser"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEventSubscription",
                "description": "Grants permission to create an Amazon Redshift event notification subscription",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventsubscription*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHsmClientCertificate",
                "description": "Grants permission to create an HSM client certificate that a cluster uses to connect to an HSM",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hsmclientcertificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHsmConfiguration",
                "description": "Grants permission to create an HSM configuration that contains information required by a cluster to store and use database encryption keys in a hardware security module (HSM)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hsmconfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSavedQuery",
                "description": "Grants permission to create saved SQL queries through the Amazon Redshift console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateScheduledAction",
                "description": "Grants permission to create an Amazon Redshift scheduled action",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSnapshotCopyGrant",
                "description": "Grants permission to create a snapshot copy grant and encrypt copied snapshots in a destination AWS Region",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "snapshotcopygrant*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSnapshotSchedule",
                "description": "Grants permission to create a snapshot schedule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshotschedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Grants permission to add one or more tags to a specified resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCluster",
                "description": "Grants permission to delete a previously provisioned cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClusterParameterGroup",
                "description": "Grants permission to delete an Amazon Redshift parameter group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parametergroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClusterSecurityGroup",
                "description": "Grants permission to delete an Amazon Redshift security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securitygroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClusterSnapshot",
                "description": "Grants permission to delete a manual snapshot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteClusterSubnetGroup",
                "description": "Grants permission to delete a cluster subnet group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subnetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEventSubscription",
                "description": "Grants permission to delete an Amazon Redshift event notification subscription",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventsubscription*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHsmClientCertificate",
                "description": "Grants permission to delete an HSM client certificate",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hsmclientcertificate*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHsmConfiguration",
                "description": "Grants permission to delete an Amazon Redshift HSM configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hsmconfiguration*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSavedQueries",
                "description": "Grants permission to delete saved SQL queries through the Amazon Redshift console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteScheduledAction",
                "description": "Grants permission to delete an Amazon Redshift scheduled action",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSnapshotCopyGrant",
                "description": "Grants permission to delete a snapshot copy grant",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshotcopygrant*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSnapshotSchedule",
                "description": "Grants permission to delete a snapshot schedule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshotschedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Grants permission to delete a tag or tags from a resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAttributes",
                "description": "Grants permission to describe attributes attached to the specified AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterDbRevisions",
                "description": "Grants permission to describe database revisions for a cluster",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterParameterGroups",
                "description": "Grants permission to describe Amazon Redshift parameter groups, including parameter groups you created and the default parameter group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterParameters",
                "description": "Grants permission to describe parameters contained within an Amazon Redshift parameter group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "parametergroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterSecurityGroups",
                "description": "Grants permission to describe Amazon Redshift security groups",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterSnapshots",
                "description": "Grants permission to describe one or more snapshot objects, which contain metadata about your cluster snapshots",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterSubnetGroups",
                "description": "Grants permission to describe one or more cluster subnet group objects, which contain metadata about your cluster subnet groups",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterTracks",
                "description": "Grants permission to describe available maintenance tracks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusterVersions",
                "description": "Grants permission to describe available Amazon Redshift cluster versions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClusters",
                "description": "Grants permission to describe properties of provisioned clusters",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDefaultClusterParameters",
                "description": "Grants permission to describe parameter settings for a parameter group family",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventCategories",
                "description": "Grants permission to describe event categories for all event source types, or for a specified source type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEventSubscriptions",
                "description": "Grants permission to describe Amazon Redshift event notification subscriptions for the specified AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEvents",
                "description": "Grants permission to describe events related to clusters, security groups, snapshots, and parameter groups for the past 14 days",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHsmClientCertificates",
                "description": "Grants permission to describe HSM client certificates",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHsmConfigurations",
                "description": "Grants permission to describe Amazon Redshift HSM configurations",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLoggingStatus",
                "description": "Grants permission to describe whether information, such as queries and connection attempts, is being logged for a cluster",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNodeConfigurationOptions",
                "description": "Grants permission to describe properties of possible node configurations such as node type, number of nodes, and disk usage for the specified action type",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrderableClusterOptions",
                "description": "Grants permission to describe orderable cluster options",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeQuery",
                "description": "Grants permission to describe a query through the Amazon Redshift console",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedNodeOfferings",
                "description": "Grants permission to describe available reserved node offerings by Amazon Redshift",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReservedNodes",
                "description": "Grants permission to describe the reserved nodes",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResize",
                "description": "Grants permission to describe the last resize operation for a cluster",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSavedQueries",
                "description": "Grants permission to describe saved queries through the Amazon Redshift console",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeScheduledActions",
                "description": "Grants permission to describe created Amazon Redshift scheduled actions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshotCopyGrants",
                "description": "Grants permission to describe snapshot copy grants owned by the specified AWS account in the destination AWS Region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshotSchedules",
                "description": "Grants permission to describe snapshot schedules",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "snapshotschedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStorage",
                "description": "Grants permission to describe account level backups storage size and provisional storage",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTable",
                "description": "Grants permission to describe a table through the Amazon Redshift console",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTableRestoreStatus",
                "description": "Grants permission to describe status of one or more table restore requests made using the RestoreTableFromClusterSnapshot API action",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Grants permission to describe tags",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableLogging",
                "description": "Grants permission to disable logging information, such as queries and connection attempts, for a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableSnapshotCopy",
                "description": "Grants permission to disable the automatic copy of snapshots for a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableLogging",
                "description": "Grants permission to enable logging information, such as queries and connection attempts, for a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableSnapshotCopy",
                "description": "Grants permission to enable the automatic copy of snapshots for a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecuteQuery",
                "description": "Grants permission to execute a query through the Amazon Redshift console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "FetchResults",
                "description": "Grants permission to fetch query results through the Amazon Redshift console",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetClusterCredentials",
                "description": "Grants permission to get temporary credentials to access an Amazon Redshift database by the specified AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dbuser*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dbgroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dbname",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "redshift:DbName",
                            "redshift:DbUser",
                            "redshift:DurationSeconds"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReservedNodeExchangeOfferings",
                "description": "Grants permission to get an array of DC2 ReservedNodeOfferings that matches the payment type, term, and usage price of the given DC1 reserved node",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "JoinGroup",
                "description": "Grants permission to join the specified Amazon Redshift group",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "dbgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDatabases",
                "description": "Grants permission to list databases through the Amazon Redshift console",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSavedQueries",
                "description": "Grants permission to list saved queries through the Amazon Redshift console",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSchemas",
                "description": "Grants permission to list schemas through the Amazon Redshift console",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTables",
                "description": "Grants permission to list tables through the Amazon Redshift console",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyCluster",
                "description": "Grants permission to modify the settings of a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterDbRevision",
                "description": "Grants permission to modify the database revision of a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterIamRoles",
                "description": "Grants permission to modify the list of AWS Identity and Access Management (IAM) roles that can be used by a cluster to access other AWS services",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterMaintenance",
                "description": "Grants permission to modify the maintenance settings of a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterParameterGroup",
                "description": "Grants permission to modify the parameters of a parameter group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parametergroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterSnapshot",
                "description": "Grants permission to modify the settings of a snapshot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterSnapshotSchedule",
                "description": "Grants permission to modify a snapshot schedule for a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClusterSubnetGroup",
                "description": "Grants permission to modify a cluster subnet group to include the specified list of VPC subnets",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "subnetgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyEventSubscription",
                "description": "Grants permission to modify an existing Amazon Redshift event notification subscription",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "eventsubscription*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifySavedQuery",
                "description": "Grants permission to modify an existing saved query through the Amazon Redshift console",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyScheduledAction",
                "description": "Grants permission to modify an existing Amazon Redshift scheduled action",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifySnapshotCopyRetentionPeriod",
                "description": "Grants permission to modify the number of days to retain snapshots in the destination AWS Region after they are copied from the source AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifySnapshotSchedule",
                "description": "Grants permission to modify a snapshot schedule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshotschedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PauseCluster",
                "description": "Grants permission to pause a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurchaseReservedNodeOffering",
                "description": "Grants permission to purchase a reserved node",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootCluster",
                "description": "Grants permission to reboot a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetClusterParameterGroup",
                "description": "Grants permission to set one or more parameters of a parameter group to their default values and set the source values of the parameters to \"engine-default\"",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parametergroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResizeCluster",
                "description": "Grants permission to change the size of a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreFromClusterSnapshot",
                "description": "Grants permission to create a cluster from a snapshot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreTableFromClusterSnapshot",
                "description": "Grants permission to create a table from a table in an Amazon Redshift cluster snapshot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResumeCluster",
                "description": "Grants permission to resume a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeClusterSecurityGroupIngress",
                "description": "Grants permission to revoke an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "securitygroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "securitygroupingress-ec2securitygroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeSnapshotAccess",
                "description": "Grants permission to revoke access from the specified AWS account to restore a snapshot",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "snapshot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RotateEncryptionKey",
                "description": "Grants permission to rotate an encryption key for a cluster",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "cluster*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewQueriesFromConsole",
                "description": "Grants permission to view query results through the Amazon Redshift console",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewQueriesInConsole",
                "description": "Grants permission to terminate running queries and loads through the Amazon Redshift console",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "cluster",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:cluster:${ClusterName}",
                "condition_keys": []
            },
            {
                "resource": "dbgroup",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:dbgroup:${ClusterName}/${DbGroup}",
                "condition_keys": []
            },
            {
                "resource": "dbname",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:dbname:${ClusterName}/${DbName}",
                "condition_keys": []
            },
            {
                "resource": "dbuser",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:dbuser:${ClusterName}/${DbUser}",
                "condition_keys": []
            },
            {
                "resource": "eventsubscription",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:eventsubscription:${EventSubscriptionName}",
                "condition_keys": []
            },
            {
                "resource": "hsmclientcertificate",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:hsmclientcertificate:${HSMClientCertificateId}",
                "condition_keys": []
            },
            {
                "resource": "hsmconfiguration",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:hsmconfiguration:${HSMConfigurationId}",
                "condition_keys": []
            },
            {
                "resource": "parametergroup",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:parametergroup:${ParameterGroupName}",
                "condition_keys": []
            },
            {
                "resource": "securitygroup",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:securitygroup:${SecurityGroupName}/ec2securitygroup/${Owner}/${Ec2SecurityGroupId}",
                "condition_keys": []
            },
            {
                "resource": "securitygroupingress-cidr",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:securitygroupingress:${SecurityGroupName}/cidrip/${IpRange}",
                "condition_keys": []
            },
            {
                "resource": "securitygroupingress-ec2securitygroup",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:securitygroupingress:${SecurityGroupName}/ec2securitygroup/${Owner}/${Ece2SecuritygroupId}",
                "condition_keys": []
            },
            {
                "resource": "snapshot",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:snapshot:${ClusterName}/${SnapshotName}",
                "condition_keys": []
            },
            {
                "resource": "snapshotcopygrant",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:snapshotcopygrant:${SnapshotCopyGrantName}",
                "condition_keys": []
            },
            {
                "resource": "snapshotschedule",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:snapshotschedule:${ParameterGroupName}",
                "condition_keys": []
            },
            {
                "resource": "subnetgroup",
                "arn": "arn:${Partition}:redshift:${Region}:${Account}:subnetgroup:${SubnetGroupName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "redshift:DbName",
                "description": "Filters access by the database name",
                "type": "String"
            },
            {
                "condition": "redshift:DbUser",
                "description": "Filters access by the database user name",
                "type": "String"
            },
            {
                "condition": "redshift:DurationSeconds",
                "description": "Filters access by the number of seconds until a temporary credential set expires",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Rekognition",
        "prefix": "rekognition",
        "privileges": [
            {
                "privilege": "CompareFaces",
                "description": "Compares a face in source input image with each face detected in the target input image.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCollection",
                "description": "Creates a collection in an AWS region. You can then add faces to the collection using the IndexFaces API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProject",
                "description": "Creates a new Amazon Rekognition Custom Labels project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProjectVersion",
                "description": "Creates a new version of a model and begins training.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "projectversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStreamProcessor",
                "description": "Creates an Amazon Rekognition stream processor that you can use to detect and recognize faces in a streaming video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "streamprocessor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCollection",
                "description": "Deletes the specified collection. Note that this operation removes all faces in the collection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFaces",
                "description": "Deletes faces from a collection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProject",
                "description": "Deletes a project.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProjectVersion",
                "description": "Deletes a model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "projectversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStreamProcessor",
                "description": "Deletes the stream processor identified by Name.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streamprocessor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCollection",
                "description": "Describes the specified collection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProjectVersions",
                "description": "Lists and describes the model versions in an Amazon Rekognition Custom Labels project.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProjects",
                "description": "Lists and gets information about your Amazon Rekognition Custom Labels projects.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStreamProcessor",
                "description": "Provides information about a stream processor created by CreateStreamProcessor.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "streamprocessor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectCustomLabels",
                "description": "Detects custom labels in a supplied image by using an Amazon Rekognition Custom Labels model version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "projectversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectFaces",
                "description": "Detects human faces within an image (JPEG or PNG) provided as input.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectLabels",
                "description": "Detects instances of real-world labels within an image (JPEG or PNG) provided as input.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectModerationLabels",
                "description": "Detects moderation labels within input image.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetectText",
                "description": "Detects text in the input image and converts it into machine-readable text.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCelebrityInfo",
                "description": "Gets the name and additional information about a celebrity based on his or her Rekognition ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCelebrityRecognition",
                "description": "Gets the celebrity recognition results for a Rekognition Video analysis started by StartCelebrityRecognition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContentModeration",
                "description": "Gets the content moderation analysis results for a Rekognition Video analysis started by StartContentModeration.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFaceDetection",
                "description": "Gets face detection results for a Rekognition Video analysis started by StartFaceDetection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFaceSearch",
                "description": "Gets the face search results for Rekognition Video face search started by StartFaceSearch.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLabelDetection",
                "description": "Gets the label detection results of a Rekognition Video analysis started by StartLabelDetection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPersonTracking",
                "description": "Gets information about people detected within a video.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTextDetection",
                "description": "Gets text detection results for a Rekognition Video analysis started by StartTextDetection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IndexFaces",
                "description": "Detects faces in the input image and adds them to the specified collection.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCollections",
                "description": "Returns a list of collection IDs in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFaces",
                "description": "Returns metadata for faces in the specified collection.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStreamProcessors",
                "description": "Gets a list of stream processors that you have created with CreateStreamProcessor.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "streamprocessor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RecognizeCelebrities",
                "description": "Returns an array of celebrities recognized in the input image.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchFaces",
                "description": "For a given input face ID, searches the specified collection for matching faces.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchFacesByImage",
                "description": "For a given input image, first detects the largest face in the image, and then searches the specified collection for matching faces.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartCelebrityRecognition",
                "description": "Starts asynchronous recognition of celebrities in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartContentModeration",
                "description": "Starts asynchronous detection of explicit or suggestive adult content in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartFaceDetection",
                "description": "Starts asynchronous detection of faces in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartFaceSearch",
                "description": "Starts the asynchronous search for faces in a collection that match the faces of persons detected in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "collection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartLabelDetection",
                "description": "Starts asynchronous detection of labels in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartPersonTracking",
                "description": "Starts the asynchronous tracking of persons in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartProjectVersion",
                "description": "Starts the deployment of a model version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "projectversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartStreamProcessor",
                "description": "Starts processing a stream processor.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streamprocessor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTextDetection",
                "description": "Starts asynchronous detection of text in a video.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopProjectVersion",
                "description": "Stops a deployed model version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "projectversion*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopStreamProcessor",
                "description": "Stops a running stream processor that was created by CreateStreamProcessor.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "streamprocessor*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "collection",
                "arn": "arn:${Partition}:rekognition:${Region}:${Account}:collection/${CollectionId}",
                "condition_keys": []
            },
            {
                "resource": "streamprocessor",
                "arn": "arn:${Partition}:rekognition:${Region}:${Account}:streamprocessor/${StreamprocessorId}",
                "condition_keys": []
            },
            {
                "resource": "project",
                "arn": "arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/${CreationTimestamp}",
                "condition_keys": []
            },
            {
                "resource": "projectversion",
                "arn": "arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/version/${VersionName}/${CreationTimestamp}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Resource Groups",
        "prefix": "resource-groups",
        "privileges": [
            {
                "privilege": "CreateGroup",
                "description": "Creates a group with a specified name, description, and resource query.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Deletes a specified resource group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroup",
                "description": "Gets information of a specified resource group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroupQuery",
                "description": "Gets the query associated with a specified resource group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTags",
                "description": "Gets the tags associated with a specified resource group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupResources",
                "description": "Lists the resources that are member of a specified resource group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Lists all resource groups",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchResources",
                "description": "Returns a list of AWS resource identifiers matching the given query",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Tag",
                "description": "Tags a specified resource group",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Untag",
                "description": "Removes tags associated with a specified resource group",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Updates a specified resource group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroupQuery",
                "description": "Updates the query associated with a specified resource group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "group",
                "arn": "arn:${Partition}:resource-groups:${Region}:${Account}:group/${GroupName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS RoboMaker",
        "prefix": "robomaker",
        "privileges": [
            {
                "privilege": "BatchDescribeSimulationJob",
                "description": "Describe multiple simulation jobs",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelDeploymentJob",
                "description": "Cancel a deployment job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelSimulationJob",
                "description": "Cancel a simulation job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "simulationJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelSimulationJobBatch",
                "description": "Cancel a simulation job batch",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "simulationJobBatch*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeploymentJob",
                "description": "Create a deployment job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateFleet",
                "description": "Create a deployment fleet that represents a logical group of robots running the same robot application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRobot",
                "description": "Create a robot that can be registered to a fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateRobotApplication",
                "description": "Create a robot application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRobotApplicationVersion",
                "description": "Create a snapshot of a robot application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "robotApplication*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateSimulationApplication",
                "description": "Create a simulation application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSimulationApplicationVersion",
                "description": "Create a snapshot of a simulation application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "simulationApplication*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateSimulationJob",
                "description": "Create a simulation job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteFleet",
                "description": "Delete a deployment fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRobot",
                "description": "Delete a robot",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "robot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRobotApplication",
                "description": "Delete a robot application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "robotApplication*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSimulationApplication",
                "description": "Delete a simulation application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "simulationApplication*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterRobot",
                "description": "Deregister a robot from a fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDeploymentJob",
                "description": "Describe a deployment job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deploymentJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleet",
                "description": "Describe a deployment fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRobot",
                "description": "Describe a robot",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "robot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRobotApplication",
                "description": "Describe a robot application",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "robotApplication*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSimulationApplication",
                "description": "Describe a simulation application",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "simulationApplication*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSimulationJob",
                "description": "Describe a simulation job",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "simulationJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSimulationJobBatch",
                "description": "Describe a simulation job batch",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "simulationJobBatch*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeploymentJobs",
                "description": "List deployment jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFleets",
                "description": "List fleets",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRobotApplications",
                "description": "List robot applications",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRobots",
                "description": "List robots",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSimulationApplications",
                "description": "List simulation applications",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSimulationJobBatches",
                "description": "List simulation job batches",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSimulationJobs",
                "description": "List simulation jobs",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List tags for a RoboMaker resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentJob",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robotApplication",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationApplication",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationJob",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationJobBatch",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterRobot",
                "description": "Register a robot to a fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robot*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestartSimulationJob",
                "description": "Restart a running simulation job",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "simulationJob*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSimulationJobBatch",
                "description": "Create a simulation job batch",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "SyncDeploymentJob",
                "description": "Ensures the most recently deployed robot application is deployed to all robots in the fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to a RoboMaker resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentJob",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robotApplication",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationApplication",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationJob",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationJobBatch",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove tags from a RoboMaker resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "deploymentFleet",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deploymentJob",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robot",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "robotApplication",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationApplication",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationJob",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "simulationJobBatch",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRobotApplication",
                "description": "Update a robot application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "robotApplication*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSimulationApplication",
                "description": "Update a simulation application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "simulationApplication*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "robotApplication",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:robot-application/${ApplicationName}/${CreatedOnEpoch}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "simulationApplication",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:simulation-application/${ApplicationName}/${CreatedOnEpoch}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "simulationJob",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:simulation-job/${SimulationJobId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "simulationJobBatch",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:simulation-job-batch/${SimulationJobBatchId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deploymentJob",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:deployment-job/${DeploymentJobId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "robot",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:robot/${RobotName}/${CreatedOnEpoch}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deploymentFleet",
                "arn": "arn:${Partition}:robomaker:${Region}:${Account}:deployment-fleet/${FleetName}/${CreatedOnEpoch}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Route 53",
        "prefix": "route53",
        "privileges": [
            {
                "privilege": "AssociateVPCWithHostedZone",
                "description": "Grants permission to associate an additional Amazon VPC with a private hosted zone",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ChangeResourceRecordSets",
                "description": "Grants permission to create, update, or delete a record, which contains authoritative DNS information for a specified domain or subdomain name",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ChangeTagsForResource",
                "description": "Grants permission to add, edit, or delete tags for a health check or a hosted zone",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "healthcheck*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHealthCheck",
                "description": "Grants permission to create a new health check, which monitors the health and performance of your web applications, web servers, and other resources",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHostedZone",
                "description": "Grants permission to create a public hosted zone, which you use to specify how the Domain Name System (DNS) routes traffic on the Internet for a domain, such as example.com, and its subdomains",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateQueryLoggingConfig",
                "description": "Grants permission to create a configuration for DNS query logging",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReusableDelegationSet",
                "description": "Grants permission to create a delegation set (a group of four name servers) that can be reused by multiple hosted zones",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficPolicy",
                "description": "Grants permission to create a traffic policy, which you use to create multiple DNS records for one domain name (such as example.com) or one subdomain name (such as www.example.com)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficPolicyInstance",
                "description": "Grants permission to create records in a specified hosted zone based on the settings in a specified traffic policy version",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrafficPolicyVersion",
                "description": "Grants permission to create a new version of an existing traffic policy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateVPCAssociationAuthorization",
                "description": "Grants permission to authorize the AWS account that created a specified VPC to submit an AssociateVPCWithHostedZone request, which associates the VPC with a specified hosted zone that was created by a different account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHealthCheck",
                "description": "Grants permission to delete a health check",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "healthcheck*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHostedZone",
                "description": "Grants permission to delete a hosted zone",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteQueryLoggingConfig",
                "description": "Grants permission to delete a configuration for DNS query logging",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queryloggingconfig*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReusableDelegationSet",
                "description": "Grants permission to delete a reusable delegation set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "delegationset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrafficPolicy",
                "description": "Grants permission to delete a traffic policy",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrafficPolicyInstance",
                "description": "Grants permission to delete a traffic policy instance and all the records that Route 53 created when you created the instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicyinstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVPCAssociationAuthorization",
                "description": "Grants permission to remove authorization for associating an Amazon Virtual Private Cloud with a Route 53 private hosted zone",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateVPCFromHostedZone",
                "description": "Grants permission to disassociate an Amazon Virtual Private Cloud from a Route 53 private hosted zone",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountLimit",
                "description": "Grants permission to get the specified limit for the current account, for example, the maximum number of health checks that you can create using the account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetChange",
                "description": "Grants permission to get the current status of a request to create, update, or delete one or more records",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "change*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCheckerIpRanges",
                "description": "Grants permission to get a list of the IP ranges that are used by Route 53 health checkers to check the health of your resources",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGeoLocation",
                "description": "Grants permission to get information about whether a specified geographic location is supported for Route 53 geolocation records",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHealthCheck",
                "description": "Grants permission to get information about a specified health check",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "healthcheck*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHealthCheckCount",
                "description": "Grants permission to get the number of health checks that are associated with the current AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHealthCheckLastFailureReason",
                "description": "Grants permission to get the reason that a specified health check failed most recently",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "healthcheck*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHealthCheckStatus",
                "description": "Grants permission to get the status of a specified health check",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "healthcheck*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHostedZone",
                "description": "Grants permission to get information about a specified hosted zone including the four name servers that Route 53 assigned to the hosted zone",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHostedZoneCount",
                "description": "Grants permission to get the number of hosted zones that are associated with the current AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetHostedZoneLimit",
                "description": "Grants permission to get the specified limit for a specified hosted zone",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueryLoggingConfig",
                "description": "Grants permission to get information about a specified configuration for DNS query logging",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queryloggingconfig*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReusableDelegationSet",
                "description": "Grants permission to get information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "delegationset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReusableDelegationSetLimit",
                "description": "Grants permission to get the maximum number of hosted zones that you can associate with the specified reusable delegation set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "delegationset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrafficPolicy",
                "description": "Grants permission to get information about a specified traffic policy version",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrafficPolicyInstance",
                "description": "Grants permission to get information about a specified traffic policy instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicyinstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrafficPolicyInstanceCount",
                "description": "Grants permission to get the number of traffic policy instances that are associated with the current AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGeoLocations",
                "description": "Grants permission to get a list of geographic locations that Route 53 supports for geolocation",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHealthChecks",
                "description": "Grants permission to get a list of the health checks that are associated with the current AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHostedZones",
                "description": "Grants permission to get a list of the public and private hosted zones that are associated with the current AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHostedZonesByName",
                "description": "Grants permission to get a list of your hosted zones in lexicographic order. Hosted zones are sorted by name with the labels reversed, for example, com.example.www.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQueryLoggingConfigs",
                "description": "Grants permission to list the configurations for DNS query logging that are associated with the current AWS account or the configuration that is associated with a specified hosted zone.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "queryloggingconfig*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceRecordSets",
                "description": "Grants permission to list the records in a specified hosted zone",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReusableDelegationSets",
                "description": "Grants permission to list the reusable delegation sets that are associated with the current AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags for one health check or hosted zone",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "healthcheck",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hostedzone",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResources",
                "description": "Grants permission to list tags for up to 10 health checks or hosted zones",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "healthcheck",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hostedzone",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrafficPolicies",
                "description": "Grants permission to get information about the latest version for every traffic policy that is associated with the current AWS account. Policies are listed in the order in which they were created.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrafficPolicyInstances",
                "description": "Grants permission to get information about the traffic policy instances that you created by using the current AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrafficPolicyInstancesByHostedZone",
                "description": "Grants permission to get information about the traffic policy instances that you created in a specified hosted zone",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrafficPolicyInstancesByPolicy",
                "description": "Grants permission to get information about the traffic policy instances that you created using a specified traffic policy version",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrafficPolicyVersions",
                "description": "Grants permission to get information about all the versions for a specified traffic policy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVPCAssociationAuthorizations",
                "description": "Grants permission to get a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestDNSAnswer",
                "description": "Grants permission to get the value that Route 53 returns in response to a DNS query for a specified record name and type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateHealthCheck",
                "description": "Grants permission to update an existing health check",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "healthcheck*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateHostedZoneComment",
                "description": "Grants permission to update the comment for a specified hosted zone",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hostedzone*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrafficPolicyComment",
                "description": "Grants permission to update the comment for a specified traffic policy version",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicy*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrafficPolicyInstance",
                "description": "Grants permission to update the records in a specified hosted zone that were created based on the settings in a specified traffic policy version",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "trafficpolicyinstance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "change",
                "arn": "arn:${Partition}:route53:::change/${Id}",
                "condition_keys": []
            },
            {
                "resource": "delegationset",
                "arn": "arn:${Partition}:route53:::delegationset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "healthcheck",
                "arn": "arn:${Partition}:route53:::healthcheck/${Id}",
                "condition_keys": []
            },
            {
                "resource": "hostedzone",
                "arn": "arn:${Partition}:route53:::hostedzone/${Id}",
                "condition_keys": []
            },
            {
                "resource": "trafficpolicy",
                "arn": "arn:${Partition}:route53:::trafficpolicy/${Id}",
                "condition_keys": []
            },
            {
                "resource": "trafficpolicyinstance",
                "arn": "arn:${Partition}:route53:::trafficpolicyinstance/${Id}",
                "condition_keys": []
            },
            {
                "resource": "queryloggingconfig",
                "arn": "arn:${Partition}:route53:::queryloggingconfig/${Id}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Route53 Domains",
        "prefix": "route53domains",
        "privileges": [
            {
                "privilege": "CheckDomainAvailability",
                "description": "Grants permission to check the availability of one domain name",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTagsForDomain",
                "description": "Grants permission to delete the specified tags for a domain",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableDomainAutoRenew",
                "description": "Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableDomainTransferLock",
                "description": "Grants permission to remove the transfer lock on the domain (specifically the clientTransferProhibited status) to allow domain transfers",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableDomainAutoRenew",
                "description": "Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableDomainTransferLock",
                "description": "Grants permission to set the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetContactReachabilityStatus",
                "description": "For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, grants permission to get information about whether the registrant contact has responded",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDomainDetail",
                "description": "Grants permission to get detailed information about a domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDomainSuggestions",
                "description": "Grants permission to get a list of suggested domain names given a string, which can either be a domain name or simply a word or phrase (without spaces)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOperationDetail",
                "description": "Grants permission to get the current status of an operation that is not completed",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomains",
                "description": "Grants permission to list all the domain names registered with Amazon Route 53 for the current AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOperations",
                "description": "Grants permission to list the operation IDs of operations that are not yet complete",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForDomain",
                "description": "Grants permission to list all the tags that are associated with the specified domain",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDomain",
                "description": "Grants permission to register domains",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RenewDomain",
                "description": "Grants permission to renew domains for the specified number of years",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResendContactReachabilityEmail",
                "description": "For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, grants permission to resend the confirmation email to the current email address for the registrant contact",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetrieveDomainAuthCode",
                "description": "Grants permission to get the AuthCode for the domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TransferDomain",
                "description": "Grants permission to transfer a domain from another registrar to Amazon Route 53",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainContact",
                "description": "Grants permission to update the contact information for domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainContactPrivacy",
                "description": "Grants permission to update the domain contact privacy setting",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainNameservers",
                "description": "Grants permission to replace the current set of name servers for a domain with the specified set of name servers",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTagsForDomain",
                "description": "Grants permission to add or update tags for a specified domain",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewBilling",
                "description": "Grants permission to get all the domain-related billing records for the current AWS account for a specified period",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Route 53 Resolver",
        "prefix": "route53resolver",
        "privileges": [
            {
                "privilege": "AssociateResolverEndpointIpAddress",
                "description": "Grants permission to associate a specified IP address with a resolver endpoint. This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateResolverRule",
                "description": "Grants permission to associate a specified resolver rule with a specified VPC.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResolverEndpoint",
                "description": "Grants permission to create a resolver endpoint. There are two types of resolver endpoints, inbound and outbound.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResolverRule",
                "description": "For DNS queries that originate in your VPC, grants permission to define how to route the queries out of the VPC.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResolverEndpoint",
                "description": "Grants permission to delete a resolver endpoint. The effect of deleting a resolver endpoint depends on whether it's an inbound or an outbound resolver endpoint.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResolverRule",
                "description": "Grants permission to delete a resolver rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateResolverEndpointIpAddress",
                "description": "Grants permission to remove a specified IP address from a resolver endpoint. This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateResolverRule",
                "description": "Grants permission to remove the association between a specified resolver rule and a specified VPC.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResolverEndpoint",
                "description": "Grants permission to get information about a specified resolver endpoint, such as whether it's an inbound or an outbound resolver endpoint, and the IP addresses in your VPC that DNS queries are forwarded to on the way into or out of your VPC.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResolverRule",
                "description": "Grants permission to get information about a specified resolver rule, such as the domain name that the rule forwards DNS queries for and the IP address that queries are forwarded to.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResolverRuleAssociation",
                "description": "Grants permission to get information about an association between a specified resolver rule and a VPC.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResolverRulePolicy",
                "description": "Grants permission to get information about a resolver rule policy.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResolverEndpointIpAddresses",
                "description": "For a specified resolver endpoint, grants permission to list the IP addresses that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResolverEndpoints",
                "description": "Grants permission to list all the resolver endpoints that were created using the current AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResolverRuleAssociations",
                "description": "Grants permission to list the associations that were created between resolver rules and VPCs using the current AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResolverRules",
                "description": "Grants permission to list the resolver rules that were created using the current AWS account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags that you associated with the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resolver-rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutResolverRulePolicy",
                "description": "Grants permission to specify the Resolver operations and resources that you want to allow another AWS account to use.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add one or more tags to a specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resolver-rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove one or more tags from a specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "resolver-rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResolverEndpoint",
                "description": "Grants permission to update selected settings for an inbound or an outbound resolver endpoint.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResolverRule",
                "description": "Grants permission to update settings for a specified resolver rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resolver-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "resolver-rule",
                "arn": "arn:${Partition}:route53resolver:${Region}:${Account}:resolver-rule/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "resolver-endpoint",
                "arn": "arn:${Partition}:route53resolver:${Region}:${Account}:resolver-endpoint/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon S3",
        "prefix": "s3",
        "privileges": [
            {
                "privilege": "AbortMultipartUpload",
                "description": "Aborts a multipart upload.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointArn",
                            "s3:DataAccessPointAccount",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BypassGovernanceRetention",
                "description": "Allows circumvention of governance-mode object retention settings",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:RequestObjectTag/<key>",
                            "s3:RequestObjectTagKeys",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-copy-source",
                            "s3:x-amz-grant-full-control",
                            "s3:x-amz-grant-read",
                            "s3:x-amz-grant-read-acp",
                            "s3:x-amz-grant-write",
                            "s3:x-amz-grant-write-acp",
                            "s3:x-amz-metadata-directive",
                            "s3:x-amz-server-side-encryption",
                            "s3:x-amz-server-side-encryption-aws-kms-key-id",
                            "s3:x-amz-storage-class",
                            "s3:x-amz-website-redirect-location",
                            "s3:object-lock-mode",
                            "s3:object-lock-retain-until-date",
                            "s3:object-lock-remaining-retention-days",
                            "s3:object-lock-legal-hold"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAccessPoint",
                "description": "Creates a new access point.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accesspoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:locationconstraint",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBucket",
                "description": "Creates a new bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:locationconstraint",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-grant-full-control",
                            "s3:x-amz-grant-read",
                            "s3:x-amz-grant-read-acp",
                            "s3:x-amz-grant-write",
                            "s3:x-amz-grant-write-acp"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Creates a new Amazon S3 Batch Operations job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256",
                            "s3:RequestJobPriority",
                            "s3:RequestJobOperation"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccessPoint",
                "description": "Deletes the access point named in the URI",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "accesspoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointArn",
                            "s3:DataAccessPointAccount",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccessPointPolicy",
                "description": "Delete the policy on a specified access point",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "accesspoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointArn",
                            "s3:DataAccessPointAccount",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBucket",
                "description": "Deletes the bucket named in the URI",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBucketPolicy",
                "description": "Delete the policy on a specified bucket",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBucketWebsite",
                "description": "Removes the website configuration for a bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteObject",
                "description": "Removes the null version (if there is one) of an object and inserts a delete marker, which becomes the current version of the object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteObjectTagging",
                "description": "This implementation of the DELETE operation uses the tagging subresource to remove the entire tag set from the specified object.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteObjectVersion",
                "description": "To remove a specific version of a object, you must be the bucket owner and you must use the versionId subresource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteObjectVersionTagging",
                "description": "DELETE Object tagging (for a Specific Version of the Object)",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJob",
                "description": "Retrieves the configuration parameters and status for an Amazon S3 batch operations job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccelerateConfiguration",
                "description": "This implementation of the GET operation uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccessPoint",
                "description": "Retrieve access point metadata",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccessPointPolicy",
                "description": "Return the policy of a specified access point.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "accesspoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccessPointPolicyStatus",
                "description": "Retrieve the policy status for an specific access point's policy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "accesspoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountPublicAccessBlock",
                "description": "Retrieve the PublicAccessBlock configuration for an AWS account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAnalyticsConfiguration",
                "description": "This implementation of the GET operation returns an analytics configuration (identified by the analytics configuration ID) from the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketAcl",
                "description": "Return the access control list (ACL) of a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketCORS",
                "description": "Returns the CORS configuration information set for the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketLocation",
                "description": "Return a bucket's region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketLogging",
                "description": "Return the logging status of a bucket and the permissions users have to view and modify that status.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketNotification",
                "description": "Return the notification configuration of a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketObjectLockConfiguration",
                "description": "GET Object Lock configuration for a specific bucket",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketPolicy",
                "description": "Return the policy of a specified bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketPolicyStatus",
                "description": "Retrieve the policy status for an specific S3 bucket, indicating whether the bucket is public.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketPublicAccessBlock",
                "description": "Retrieve the PublicAccessBlock configuration for a specific S3 bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketRequestPayment",
                "description": "Return the request payment configuration of a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketTagging",
                "description": "Return the tag set associated with the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketVersioning",
                "description": "Return the versioning state of a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBucketWebsite",
                "description": "Returns the website configuration associated with a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEncryptionConfiguration",
                "description": "Returns the encryption configuration information set on the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInventoryConfiguration",
                "description": "This implementation of the GET operation returns an inventory configuration (identified by the inventory configuration ID) from the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLifecycleConfiguration",
                "description": "Returns the lifecycle configuration information set on the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMetricsConfiguration",
                "description": "Gets a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from the bucket. Note that this doesn't include the daily storage metrics.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObject",
                "description": "Retrieves objects from Amazon S3.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectAcl",
                "description": "Return the access control list (ACL) of an object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectLegalHold",
                "description": "GET Object Legal Hold for a specific object",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectRetention",
                "description": "GET Object Legal Hold for a specific object",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectTagging",
                "description": "This implementation of the GET operation returns the tags associated with an object. You send the GET request against the tagging subresource associated with the object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectTorrent",
                "description": "return torrent files from a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectVersion",
                "description": "To return a different version, use the versionId subresource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectVersionAcl",
                "description": "To return ACL information about a different version, use the versionId subresource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectVersionForReplication",
                "description": "Permission exercised by S3 replication",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectVersionTagging",
                "description": "GET Object tagging (for a Specific Version of the Object)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetObjectVersionTorrent",
                "description": "To return Torrent files about a different version, use the versionId subresource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReplicationConfiguration",
                "description": "Returns the replication configuration information set on the bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccessPoints",
                "description": "Lists access points.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAllMyBuckets",
                "description": "Returns a list of all buckets owned by the authenticated sender of the request.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBucket",
                "description": "Returns some or all (up to 1000) of the objects in a bucket.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:delimiter",
                            "s3:max-keys",
                            "s3:prefix",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBucketMultipartUploads",
                "description": "Lists in-progress multipart uploads.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBucketVersions",
                "description": "Use the versions subresource to list metadata about all of the versions of objects in a bucket.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:delimiter",
                            "s3:max-keys",
                            "s3:prefix",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Lists current jobs and jobs that have ended recently.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMultipartUploadParts",
                "description": "Lists the parts that have been uploaded for a specific multipart upload.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ObjectOwnerOverrideToBucketOwner",
                "description": "Permission exercised by S3 replication",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccelerateConfiguration",
                "description": "This implementation of the PUT operation uses the accelerate subresource to set the Transfer Acceleration state of an existing bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccessPointPolicy",
                "description": "Add to or replace a data policy on a access point.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "accesspoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccountPublicAccessBlock",
                "description": "Create or modify the PublicAccessBlock configuration for an AWS account.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAnalyticsConfiguration",
                "description": "This implementation of the PUT operation adds an analytics configuration (identified by the analytics ID) to the bucket. You can have up to 1,000 analytics configurations per bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketAcl",
                "description": "Set the permissions on an existing bucket using access control lists (ACL).",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-grant-full-control",
                            "s3:x-amz-grant-read",
                            "s3:x-amz-grant-read-acp",
                            "s3:x-amz-grant-write",
                            "s3:x-amz-grant-write-acp"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketCORS",
                "description": "Sets the CORS configuration for your bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketLogging",
                "description": "Set the logging parameters for a bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketNotification",
                "description": "Enables you to receive notifications when certain events happen in your bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketObjectLockConfiguration",
                "description": "PUT Object Lock configuration on a specific bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketPolicy",
                "description": "Add to or replace a policy on a bucket.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketPublicAccessBlock",
                "description": "Create or modify the PublicAccessBlock configuration for an specific S3 bucket.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketRequestPayment",
                "description": "Set the request payment configuration of a bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketTagging",
                "description": "Add a set of tags to an existing bucket.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketVersioning",
                "description": "Set the versioning state of an existing bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutBucketWebsite",
                "description": "Sets the configuration of the website that is specified in the website subresource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEncryptionConfiguration",
                "description": "Sets the encryption configuration for the bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutInventoryConfiguration",
                "description": "This implementation of the PUT operation adds an inventory configuration (identified by the inventory ID) to the bucket. You can have up to 1,000 inventory configurations per bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLifecycleConfiguration",
                "description": "Creates a new lifecycle configuration for the bucket or replaces an existing lifecycle configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMetricsConfiguration",
                "description": "Sets or updates a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from the bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObject",
                "description": "Adds an object to a bucket.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:RequestObjectTag/<key>",
                            "s3:RequestObjectTagKeys",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-copy-source",
                            "s3:x-amz-grant-full-control",
                            "s3:x-amz-grant-read",
                            "s3:x-amz-grant-read-acp",
                            "s3:x-amz-grant-write",
                            "s3:x-amz-grant-write-acp",
                            "s3:x-amz-metadata-directive",
                            "s3:x-amz-server-side-encryption",
                            "s3:x-amz-server-side-encryption-aws-kms-key-id",
                            "s3:x-amz-storage-class",
                            "s3:x-amz-website-redirect-location",
                            "s3:object-lock-mode",
                            "s3:object-lock-retain-until-date",
                            "s3:object-lock-remaining-retention-days",
                            "s3:object-lock-legal-hold"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObjectAcl",
                "description": "Set the access control list (ACL) permissions for an object that already exists in a bucket.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-grant-full-control",
                            "s3:x-amz-grant-read",
                            "s3:x-amz-grant-read-acp",
                            "s3:x-amz-grant-write",
                            "s3:x-amz-grant-write-acp",
                            "s3:x-amz-storage-class"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObjectLegalHold",
                "description": "PUT Object Legal Hold on a specific object",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256",
                            "s3:object-lock-legal-hold"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObjectRetention",
                "description": "PUT Object Retention on a specific object",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256",
                            "s3:object-lock-mode",
                            "s3:object-lock-retain-until-date",
                            "s3:object-lock-remaining-retention-days"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObjectTagging",
                "description": "This implementation of the PUT operation uses the tagging subresource to add a set of tags to an existing object.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:RequestObjectTag/<key>",
                            "s3:RequestObjectTagKeys",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObjectVersionAcl",
                "description": "The ACL of an object is set at the object version level.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-acl",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-grant-full-control",
                            "s3:x-amz-grant-read",
                            "s3:x-amz-grant-read-acp",
                            "s3:x-amz-grant-write",
                            "s3:x-amz-grant-write-acp",
                            "s3:x-amz-storage-class"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutObjectVersionTagging",
                "description": "PUT Object tagging (for a Specific Version of the Object)",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:ExistingObjectTag/<key>",
                            "s3:RequestObjectTag/<key>",
                            "s3:RequestObjectTagKeys",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:versionid",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutReplicationConfiguration",
                "description": "In a versioning-enabled bucket, this operation creates a new replication configuration (or replaces an existing one, if present).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bucket*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplicateDelete",
                "description": "Permission exercised by S3 replication",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplicateObject",
                "description": "Permission exercised by S3 replication",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256",
                            "s3:x-amz-server-side-encryption",
                            "s3:x-amz-server-side-encryption-aws-kms-key-id"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReplicateTags",
                "description": "Permission exercised by S3 replication",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreObject",
                "description": "Restores a temporary copy of an archived object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "object*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:DataAccessPointAccount",
                            "s3:DataAccessPointArn",
                            "s3:AccessPointNetworkOrigin",
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJobPriority",
                "description": "Updates an existing job's priority.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256",
                            "s3:RequestJobPriority",
                            "s3:ExistingJobPriority",
                            "s3:ExistingJobOperation"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJobStatus",
                "description": "Updates the status for the specified job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "s3:authtype",
                            "s3:signatureage",
                            "s3:signatureversion",
                            "s3:x-amz-content-sha256",
                            "s3:ExistingJobPriority",
                            "s3:ExistingJobOperation",
                            "s3:JobSuspendedCause"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "accesspoint",
                "arn": "arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}",
                "condition_keys": []
            },
            {
                "resource": "bucket",
                "arn": "arn:${Partition}:s3:::${BucketName}",
                "condition_keys": []
            },
            {
                "resource": "object",
                "arn": "arn:${Partition}:s3:::${BucketName}/${ObjectName}",
                "condition_keys": []
            },
            {
                "resource": "job",
                "arn": "arn:${Partition}:s3:${Region}:${Account}:job/${JobId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "s3:AccessPointNetworkOrigin",
                "description": "The network type from which traffic may be received by the access point involved in the request",
                "type": "String"
            },
            {
                "condition": "s3:DataAccessPointAccount",
                "description": "The AWS Account ID of the account that owns the data operations access point involved in the request",
                "type": "String"
            },
            {
                "condition": "s3:DataAccessPointArn",
                "description": "The ARN of the data operations access point involved in the request",
                "type": "String"
            },
            {
                "condition": "s3:ExistingJobOperation",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:ExistingJobPriority",
                "description": "",
                "type": "Numeric"
            },
            {
                "condition": "s3:ExistingObjectTag/<key>",
                "description": "Enables you to verify that an existing object tag has the specific tag key and value.",
                "type": "String"
            },
            {
                "condition": "s3:JobSuspendedCause",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:LocationConstraint",
                "description": "Enables you to restrict users to creating buckets in only a specific region.",
                "type": "String"
            },
            {
                "condition": "s3:RequestJobOperation",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:RequestJobPriority",
                "description": "",
                "type": "Numeric"
            },
            {
                "condition": "s3:RequestObjectTag/<key>",
                "description": "Restrict the tag keys and values that you want to allow on objects.",
                "type": "String"
            },
            {
                "condition": "s3:RequestObjectTagKeys",
                "description": "restrict the tag keys that you want to allow on objects.",
                "type": "String"
            },
            {
                "condition": "s3:VersionId",
                "description": "Enables you to limit the permission for the s3:PutObjectVersionTagging action to a specific object version.",
                "type": "String"
            },
            {
                "condition": "s3:authtype",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:delimiter",
                "description": "Enables you to require the user to specify the delimiter parameter in the GET Bucket Object versions request.",
                "type": "String"
            },
            {
                "condition": "s3:locationconstraint",
                "description": "Enables you to restrict the user to creating a bucket in only a specific region.",
                "type": "String"
            },
            {
                "condition": "s3:max-keys",
                "description": "Enables you to limit the number of keys Amazon S3 returns in response to ListBucket requests by requiring the user to specify the max-keys parameter.",
                "type": "Numeric"
            },
            {
                "condition": "s3:object-lock-legal-hold",
                "description": "Enables enforcement of the specified object legal hold status",
                "type": "String"
            },
            {
                "condition": "s3:object-lock-mode",
                "description": "Enables enforcement of the specified object retention mode",
                "type": "String"
            },
            {
                "condition": "s3:object-lock-remaining-retention-days",
                "description": "Enables enforcement of an object relative to the remaining retention days",
                "type": "String"
            },
            {
                "condition": "s3:object-lock-retain-until-date",
                "description": "Enables enforcement of a specific retain-until-date",
                "type": "String"
            },
            {
                "condition": "s3:prefix",
                "description": "Enables you to limit the response of the ListBucket API to key names with specific prefix.",
                "type": "String"
            },
            {
                "condition": "s3:signatureage",
                "description": "",
                "type": "Numeric"
            },
            {
                "condition": "s3:signatureversion",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:versionid",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-acl",
                "description": "Enables you to require specific access permissions when uploading an object.",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-content-sha256",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-copy-source",
                "description": "Enables you to restrict the copy source to a specific bucket, a specific folder in the bucket, or a specific object in a bucket.",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-grant-full-control",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-grant-read",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-grant-read-acp",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-grant-write",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-grant-write-acp",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-metadata-directive",
                "description": "Enables you to enforce certain behavior (COPY vs. REPLACE) when objects are uploaded.",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-server-side-encryption",
                "description": "Enables you to require the user to specify this header in the request to ensure that objects the user uploads are encrypted when they are saved.",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-server-side-encryption-aws-kms-key-id",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-storage-class",
                "description": "",
                "type": "String"
            },
            {
                "condition": "s3:x-amz-website-redirect-location",
                "description": "",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon SageMaker",
        "prefix": "sagemaker",
        "privileges": [
            {
                "privilege": "AddTags",
                "description": "Adds or overwrites one or more tags for the specified Amazon SageMaker resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "app",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "automl-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "endpoint-config",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial-component",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "flow-definition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "human-task-ui",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hyper-parameter-tuning-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "labeling-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "model",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "monitoring-schedule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "notebook-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "processing-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "training-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transform-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user-profile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workteam",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateTrialComponent",
                "description": "Associate a trial component with a trial.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial-component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchGetMetrics",
                "description": "Retrieve metrics associated with SageMaker Resources such as Training Jobs. This API is not publicly exposed at this point, however admins can control this action",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchPutMetrics",
                "description": "Publish metrics associated with a SageMaker Resource such as a Training Job. This API is not publicly exposed at this point, however admins can control this action",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAlgorithm",
                "description": "Create an algorithm.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "algorithm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApp",
                "description": "Grants permission to create an App for a SageMaker Studio UserProfile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:InstanceTypes"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAutoMLJob",
                "description": "Creates automl job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "automl-job*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:InterContainerTrafficEncryption",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCodeRepository",
                "description": "Create a code repository.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "code-repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCompilationJob",
                "description": "Create a compilation job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "compilation-job*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateDomain",
                "description": "Grants permission to create a Domain for SageMaker Studio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole",
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:AppNetworkAccess",
                            "sagemaker:InstanceTypes",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets",
                            "sagemaker:DomainSharingOutputKmsKey",
                            "sagemaker:HomeEfsFileSystemKmsKey"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEndpoint",
                "description": "Creates an endpoint using the endpoint configuration specified in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEndpointConfig",
                "description": "Creates an endpoint configuration that can be deployed using Amazon SageMaker hosting services.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpoint-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:AcceleratorTypes",
                            "sagemaker:InstanceTypes",
                            "sagemaker:ModelArn",
                            "sagemaker:VolumeKmsKey"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateExperiment",
                "description": "Create an experiment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFlowDefinition",
                "description": "Creates a flow definition, which defines settings for a human workflow.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "flow-definition*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "sagemaker:WorkteamArn",
                            "sagemaker:WorkteamType",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHumanTaskUi",
                "description": "Defines the settings you will use for the human review workflow user interface.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "human-task-ui*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateHyperParameterTuningJob",
                "description": "Creates hyper parameter tuning job that can be deployed using Amazon SageMaker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hyper-parameter-tuning-job*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:FileSystemAccessMode",
                            "sagemaker:FileSystemDirectoryPath",
                            "sagemaker:FileSystemId",
                            "sagemaker:FileSystemType",
                            "sagemaker:InstanceTypes",
                            "sagemaker:InterContainerTrafficEncryption",
                            "sagemaker:MaxRuntimeInSeconds",
                            "sagemaker:NetworkIsolation",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLabelingJob",
                "description": "Starts a labeling job. A labeling job takes unlabeled data in and produces labeled data as output, which can be used for training SageMaker models.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "labeling-job*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "sagemaker:WorkteamArn",
                            "sagemaker:WorkteamType",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:OutputKmsKey",
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateModel",
                "description": "Creates a model in Amazon SageMaker. In the request, you specify a name for the model and describe one or more containers.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:NetworkIsolation",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateModelPackage",
                "description": "Create a model package.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model-package*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMonitoringSchedule",
                "description": "Creates a monitoring schedule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "monitoring-schedule*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:InstanceTypes",
                            "sagemaker:MaxRuntimeInSeconds",
                            "sagemaker:NetworkIsolation",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNotebookInstance",
                "description": "Creates an Amazon SageMaker notebook instance. A notebook instance is an Amazon EC2 instance running on a Jupyter Notebook.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:AcceleratorTypes",
                            "sagemaker:DirectInternetAccess",
                            "sagemaker:InstanceTypes",
                            "sagemaker:RootAccess",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNotebookInstanceLifecycleConfig",
                "description": "Creates an notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance-lifecycle-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePresignedDomainUrl",
                "description": "Grants permission to return a URL that you can use from your browser to connect to the Domain as a specified UserProfile when AuthMode is 'IAM'",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePresignedNotebookInstanceUrl",
                "description": "Returns a URL that you can use from your browser to connect to the Notebook Instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProcessingJob",
                "description": "Starts a processing job. After processing completes, Amazon SageMaker saves the resulting artifacts and other optional output to an Amazon S3 location that you specify.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "processing-job*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:InstanceTypes",
                            "sagemaker:MaxRuntimeInSeconds",
                            "sagemaker:NetworkIsolation",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrainingJob",
                "description": "Starts a model training job. After training completes, Amazon SageMaker saves the resulting model artifacts and other optional output to an Amazon S3 location that you specify.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:FileSystemAccessMode",
                            "sagemaker:FileSystemDirectoryPath",
                            "sagemaker:FileSystemId",
                            "sagemaker:FileSystemType",
                            "sagemaker:InstanceTypes",
                            "sagemaker:InterContainerTrafficEncryption",
                            "sagemaker:MaxRuntimeInSeconds",
                            "sagemaker:NetworkIsolation",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTransformJob",
                "description": "Starts a transform job. After the results are obtained, Amazon SageMaker saves them to an Amazon S3 location that you specify.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transform-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:InstanceTypes",
                            "sagemaker:ModelArn",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrial",
                "description": "Create a trial.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrialComponent",
                "description": "Create a trial component.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial-component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUserProfile",
                "description": "Grants permission to create a UserProfile for a SageMaker Studio Domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user-profile*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:InstanceTypes",
                            "sagemaker:DomainSharingOutputKmsKey"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWorkteam",
                "description": "Create a workteam.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workteam*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAlgorithm",
                "description": "Deletes an algorithm.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "algorithm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApp",
                "description": "Grants permission to delete an App",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCodeRepository",
                "description": "Deletes a code repository.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "code-repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomain",
                "description": "Grants permission to delete a Domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpoint",
                "description": "Deletes an endpoint. Amazon SageMaker frees up all the resources that were deployed when the endpoint was created.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpointConfig",
                "description": "Deletes the endpoint configuration created using the CreateEndpointConfig API. The DeleteEndpointConfig API deletes only the specified configuration. It does not delete any endpoints created using the configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpoint-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteExperiment",
                "description": "Deletes an experiment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFlowDefinition",
                "description": "Deltes the specified flow definition.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "flow-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteHumanLoop",
                "description": "Deletes the specified human loop.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "human-loop*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteModel",
                "description": "Deletes a model created using the CreateModel API. The DeleteModel API deletes only the model entry in Amazon SageMaker that you created by calling the CreateModel API. It does not delete model artifacts, inference code, or the IAM role that you specified when creating the model.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteModelPackage",
                "description": "Deletes a model package.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "model-package*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMonitoringSchedule",
                "description": "Deletes a monitoring schedule. Amazon SageMaker will no longer run the scheduled monitoring.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "monitoring-schedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNotebookInstance",
                "description": "Deletes an Amazon SageMaker notebook instance. Before you can delete a notebook instance, you must call the StopNotebookInstance API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNotebookInstanceLifecycleConfig",
                "description": "Deletes an notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance-lifecycle-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Deletes the specified set of tags from an Amazon SageMaker resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "app",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "automl-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "compilation-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "endpoint-config",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial-component",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "flow-definition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "human-task-ui",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hyper-parameter-tuning-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "labeling-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "model",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "monitoring-schedule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "notebook-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "processing-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "training-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transform-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user-profile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workteam",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrial",
                "description": "Deletes a trial.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTrialComponent",
                "description": "Deletes a trial component.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial-component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUserProfile",
                "description": "Grants permission to delete a UserProfile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWorkteam",
                "description": "Deletes a workteam.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workteam*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAlgorithm",
                "description": "Returns information about an algorithm.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "algorithm*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeApp",
                "description": "Grants permission to describe an App",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "app*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAutoMLJob",
                "description": "Describes an automl job that was created via CreateAutoMLJob API.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "automl-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCodeRepository",
                "description": "Returns information about a code repository.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "code-repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCompilationJob",
                "description": "Returns information about a compilation job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "compilation-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDomain",
                "description": "Grants permission to describe a Domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpoint",
                "description": "Returns the description of an endpoint.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEndpointConfig",
                "description": "Returns the description of an endpoint configuration, which was created using the CreateEndpointConfig API.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "endpoint-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExperiment",
                "description": "Returns information about an experiment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "experiment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFlowDefinition",
                "description": "Returns detailed information about the specified flow definition.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "flow-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHumanLoop",
                "description": "Returns detailed information about the specified human loop.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "human-loop*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHumanTaskUi",
                "description": "Returns detailed information about the specified human review workflow user interface.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "human-task-ui*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHyperParameterTuningJob",
                "description": "Describes a hyper parameter tuning job that was created via CreateHyperParameterTuningJob API.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hyper-parameter-tuning-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeLabelingJob",
                "description": "Returns information about a labeling job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "labeling-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeModel",
                "description": "Describes a model that you created using the CreateModel API.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "model*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeModelPackage",
                "description": "Returns information about a model package.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "model-package*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMonitoringSchedule",
                "description": "Returns information about a monitoring schedule.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "monitoring-schedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNotebookInstance",
                "description": "Returns information about a notebook instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNotebookInstanceLifecycleConfig",
                "description": "Describes an notebook instance lifecycle configuration that was created via CreateNotebookInstanceLifecycleConfig API.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance-lifecycle-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProcessingJob",
                "description": "Returns information about a processing job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "processing-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSubscribedWorkteam",
                "description": "Returns information about a subscribed workteam.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workteam*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrainingJob",
                "description": "Returns information about a training job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTransformJob",
                "description": "Returns information about a transform job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "transform-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrial",
                "description": "Returns information about a trial.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrialComponent",
                "description": "Returns information about a trial component.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial-component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUserProfile",
                "description": "Grants permission to describe a UserProfile",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkforce",
                "description": "Returns information about a workforce.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workforce*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkteam",
                "description": "Returns information about a workteam.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workteam*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateTrialComponent",
                "description": "Disassociate a trial component with a trial.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial-component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "processing-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSearchSuggestions",
                "description": "Get search suggestions when provided with keyword.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InvokeEndpoint",
                "description": "After you deploy a model into production using Amazon SageMaker hosting services, your client applications use this API to get inferences from the model hosted at the specified endpoint.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAlgorithms",
                "description": "Lists algorithms.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApps",
                "description": "Grants permission to list the Apps in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAutoMLJobs",
                "description": "Lists automl jobs created via the CreateAutoMLJob.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCandidatesForAutoMLJob",
                "description": "Lists candidates for automl job created via the CreateAutoMLJob.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCodeRepositories",
                "description": "Lists code repositories.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCompilationJobs",
                "description": "Lists compilation jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomains",
                "description": "Grants permission to list the Domains in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEndpointConfigs",
                "description": "Lists endpoint configurations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEndpoints",
                "description": "Lists endpoints.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListExperiments",
                "description": "Lists experiments.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFlowDefinitions",
                "description": "Returns summary information about flow definitions, given the specified parameters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHumanLoops",
                "description": "Returns summary information about human loops, given the specified parameters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHumanTaskUis",
                "description": "Returns summary information about human review workflow user interfaces, given the specified parameters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListHyperParameterTuningJobs",
                "description": "Lists hyper parameter tuning jobs that was created using Amazon SageMaker.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLabelingJobs",
                "description": "Lists labeling jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLabelingJobsForWorkteam",
                "description": "Lists labeling jobs for workteam.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "workteam*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListModelPackages",
                "description": "Lists model packages.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListModels",
                "description": "Lists the models created with the CreateModel API.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMonitoringExecutions",
                "description": "Lists monitoring executions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMonitoringSchedules",
                "description": "Lists monitoring schedules.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNotebookInstanceLifecycleConfigs",
                "description": "Lists notebook instance lifecycle configurations that can be deployed using Amazon SageMaker.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNotebookInstances",
                "description": "Returns a list of the Amazon SageMaker notebook instances in the requester's account in an AWS Region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProcessingJobs",
                "description": "Lists processing jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscribedWorkteams",
                "description": "Lists subscribed workteams.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTags",
                "description": "Returns the tag set associated with the specified resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "app",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "automl-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "endpoint",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "endpoint-config",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "experiment-trial-component",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "flow-definition",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "human-task-ui",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "hyper-parameter-tuning-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "labeling-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "model",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "monitoring-schedule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "notebook-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "training-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "transform-job",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user-profile",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workteam",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrainingJobs",
                "description": "Lists training jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrainingJobsForHyperParameterTuningJob",
                "description": "Lists training jobs for a hyper parameter tuning job that was created using Amazon SageMaker.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "hyper-parameter-tuning-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTransformJobs",
                "description": "Lists transform jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrialComponents",
                "description": "Lists trial components.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTrials",
                "description": "Lists trials.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUserProfiles",
                "description": "Grants permission to list the UserProfiles in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkteams",
                "description": "Lists workteams.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RenderUiTemplate",
                "description": "Render a UI template used for a human annotation task.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "Search",
                "description": "Search for a training job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartHumanLoop",
                "description": "Starts a human loop.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "flow-definition*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMonitoringSchedule",
                "description": "Starts a monitoring schedule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "monitoring-schedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartNotebookInstance",
                "description": "Launches an EC2 instance with the latest version of the libraries and attaches your EBS volume.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopAutoMLJob",
                "description": "Stops a running automl job created via the CreateAutoMLJob.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "automl-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopCompilationJob",
                "description": "Stops a compilation job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "compilation-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopHumanLoop",
                "description": "Stops the specified human loop.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "human-loop*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopHyperParameterTuningJob",
                "description": "Stops a running hyper parameter tuning job create via the CreateHyperParameterTuningJob.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hyper-parameter-tuning-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopLabelingJob",
                "description": "Stops a labeling job. Any labels already generated will be exported before stopping.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "labeling-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopMonitoringSchedule",
                "description": "Stops a monitoring schedule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "monitoring-schedule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopNotebookInstance",
                "description": "Terminates the EC2 instance. Before terminating the instance, Amazon SageMaker disconnects the EBS volume from it. Amazon SageMaker preserves the EBS volume.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopProcessingJob",
                "description": "Stops a processing job. To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "processing-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTrainingJob",
                "description": "Stops a training job. To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "training-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTransformJob",
                "description": "Stops a transform job. When Amazon SageMaker receives a StopTransformJob request, the status of the job changes to Stopping. After Amazon SageMaker stops the job, the status is set to Stopped",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "transform-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCodeRepository",
                "description": "Updates a code repository.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "code-repository*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomain",
                "description": "Grants permission to update a Domain",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:InstanceTypes",
                            "sagemaker:DomainSharingOutputKmsKey"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEndpoint",
                "description": "Updates an endpoint to use the endpoint configuration specified in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEndpointWeightsAndCapacities",
                "description": "Updates variant weight, capacity, or both of one or more variants associated with an endpoint.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "endpoint*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateExperiment",
                "description": "Updates an experiment.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMonitoringSchedule",
                "description": "Updates a monitoring schedule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "monitoring-schedule*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys",
                            "sagemaker:InstanceTypes",
                            "sagemaker:MaxRuntimeInSeconds",
                            "sagemaker:NetworkIsolation",
                            "sagemaker:OutputKmsKey",
                            "sagemaker:VolumeKmsKey",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:VpcSubnets"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNotebookInstance",
                "description": "Updates a notebook instance. Notebook instance updates include upgrading or downgrading the EC2 instance used for your notebook instance to accommodate changes in your workload requirements. You can also update the VPC security groups.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "sagemaker:AcceleratorTypes",
                            "sagemaker:InstanceTypes",
                            "sagemaker:RootAccess"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNotebookInstanceLifecycleConfig",
                "description": "Updates a notebook instance lifecycle configuration created with the CreateNotebookInstanceLifecycleConfig API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "notebook-instance-lifecycle-config*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrial",
                "description": "Updates a trial.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrialComponent",
                "description": "Updates a trial component.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "experiment-trial-component*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUserProfile",
                "description": "Grants permission to update a UserProfile",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "sagemaker:InstanceTypes",
                            "sagemaker:VpcSecurityGroupIds",
                            "sagemaker:InstanceTypes",
                            "sagemaker:DomainSharingOutputKmsKey"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWorkforce",
                "description": "Updates a workforce.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workforce*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWorkteam",
                "description": "Updates a workteam.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workteam*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "human-loop",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:human-loop/${HumanLoopName}",
                "condition_keys": []
            },
            {
                "resource": "flow-definition",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:flow-definition/${FlowDefinitionName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "human-task-ui",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:human-task-ui/${HumanTaskUiName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "labeling-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:labeling-job/${LabelingJobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "workteam",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:workteam/${WorkteamName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "workforce",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:workforce/${WorkforceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "domain",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:domain/${DomainId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "user-profile",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:user-profile/${DomainId}/${UserProfileName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "app",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:app/${DomainId}/${UserProfileName}/${AppType}/${AppName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "notebook-instance",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:notebook-instance/${NotebookInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "notebook-instance-lifecycle-config",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:notebook-instance-lifecycle-config/${NotebookInstanceLifecycleConfigName}",
                "condition_keys": []
            },
            {
                "resource": "code-repository",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:code-repository/${CodeRepositoryName}",
                "condition_keys": []
            },
            {
                "resource": "algorithm",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:algorithm/${AlgorithmName}",
                "condition_keys": []
            },
            {
                "resource": "training-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:training-job/${TrainingJobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "processing-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:processing-job/${ProcessingJobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "hyper-parameter-tuning-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:hyper-parameter-tuning-job/${HyperParameterTuningJobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "model-package",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:model-package/${ModelPackageName}",
                "condition_keys": []
            },
            {
                "resource": "model",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:model/${ModelName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "endpoint-config",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:endpoint-config/${EndpointConfigName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "endpoint",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:endpoint/${EndpointName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "transform-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:transform-job/${TransformJobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "compilation-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:compilation-job/${CompilationJobName}",
                "condition_keys": []
            },
            {
                "resource": "automl-job",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:automl-job/${AutoMLJobJobName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "monitoring-schedule",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:monitoring-schedule/${MonitoringScheduleName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "experiment",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:experiment/${ExperimentName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "experiment-trial",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:experiment-trial/${TrialName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "experiment-trial-component",
                "arn": "arn:${Partition}:sagemaker:${Region}:${Account}:experiment-trial-component/${TrialComponentName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "sagemaker:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A key that is present in the request the user makes to the SageMaker service.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "A tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:AcceleratorTypes",
                "description": "The list of all accelerator types associated with the resource in the request.",
                "type": "ArrayOfString"
            },
            {
                "condition": "sagemaker:AppNetworkAccess",
                "description": "App network access associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:DirectInternetAccess",
                "description": "The direct internet access associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:DomainSharingOutputKmsKey",
                "description": "The Domain sharing output KMS key associated with the resource in the request.",
                "type": "ARN"
            },
            {
                "condition": "sagemaker:FileSystemAccessMode",
                "description": "File system access mode associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:FileSystemDirectoryPath",
                "description": "File system directory path associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:FileSystemId",
                "description": "A file system ID associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:FileSystemType",
                "description": "File system type associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:HomeEfsFileSystemKmsKey",
                "description": "The KMS Key Id of the EFS File System used for UserProfile home directories, which is associated with the resource in the request.",
                "type": "ARN"
            },
            {
                "condition": "sagemaker:InstanceTypes",
                "description": "The list of all instance types associated with the resource in the request.",
                "type": "ArrayOfString"
            },
            {
                "condition": "sagemaker:InterContainerTrafficEncryption",
                "description": "The inter container traffic encryption associated with the resource in the request.",
                "type": "Bool"
            },
            {
                "condition": "sagemaker:MaxRuntimeInSeconds",
                "description": "The max runtime in seconds associated with the resource in the request.",
                "type": "Numeric"
            },
            {
                "condition": "sagemaker:ModelArn",
                "description": "The model arn associated with the resource in the request.",
                "type": "ARN"
            },
            {
                "condition": "sagemaker:NetworkIsolation",
                "description": "The network isolation associated with the resource in the request.",
                "type": "Bool"
            },
            {
                "condition": "sagemaker:OutputKmsKey",
                "description": "The output kms key associated with the resource in the request.",
                "type": "ARN"
            },
            {
                "condition": "sagemaker:ResourceTag/",
                "description": "The preface string for a tag key and value pair attached to a resource.",
                "type": "String"
            },
            {
                "condition": "sagemaker:ResourceTag/${TagKey}",
                "description": "A tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "sagemaker:RootAccess",
                "description": "The root access associated with the resource in the request.",
                "type": "String"
            },
            {
                "condition": "sagemaker:VolumeKmsKey",
                "description": "The volume kms key associated with the resource in the request.",
                "type": "ARN"
            },
            {
                "condition": "sagemaker:VpcSecurityGroupIds",
                "description": "The list of all vpc security group ids associated with the resource in the request.",
                "type": "ArrayOfString"
            },
            {
                "condition": "sagemaker:VpcSubnets",
                "description": "The list of all vpc subnets associated with the resource in the request.",
                "type": "ArrayOfString"
            },
            {
                "condition": "sagemaker:WorkteamArn",
                "description": "The workteam arn associated to the request.",
                "type": "ARN"
            },
            {
                "condition": "sagemaker:WorkteamType",
                "description": "The workteam type associated to the request. This can be public-crowd, private-crowd or vendor-crowd.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Savings Plans",
        "prefix": "savingsplans",
        "privileges": [
            {
                "privilege": "CreateSavingsPlan",
                "description": "Grants permission to create a savings plan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSavingsPlanRates",
                "description": "Grants permission to describe the rates associated with customers savings plan",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "savingsplan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSavingsPlans",
                "description": "Grants permission to describe the savings plans associated with customers account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "savingsplan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSavingsPlansOfferingRates",
                "description": "Grants permission to describe the rates assciated with savings plans offerings",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSavingsPlansOfferings",
                "description": "Grants permission to describe the savings plans offerings that customer is eligible to purchase",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list tags for a savings plan",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "savingsplan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag a savings plan",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "savingsplan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag a savings plan",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "savingsplan*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "savingsplan",
                "arn": "arn:${Partition}:savingsplans::${Account}:savingsplan/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon EventBridge Schemas",
        "prefix": "schemas",
        "privileges": [
            {
                "privilege": "CreateDiscoverer",
                "description": "Creates an event schema discoverer. Once created, your events will be automatically map into corresponding schema documents",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRegistry",
                "description": "Create a new schema registry in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSchema",
                "description": "Create a new schema in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDiscoverer",
                "description": "Deletes discoverer in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegistry",
                "description": "Deletes an existing registry in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSchema",
                "description": "Deletes an existing schema in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSchemaVersion",
                "description": "Deletes a specific version of schema in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCodeBinding",
                "description": "Retrieves metadata for generated code for specific schema in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDiscoverer",
                "description": "Retrieves discoverer metadata in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRegistry",
                "description": "Describes an existing registry metadata in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSchema",
                "description": "Retrieves an existing schema in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCodeBindingSource",
                "description": "Retrieves metadata for generated code for specific schema in your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDiscoveredSchema",
                "description": "Retrieves schema for the provided list of sample events.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDiscoverers",
                "description": "Lists all the discoverers in your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegistries",
                "description": "List all discoverers in your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSchemaVersions",
                "description": "List all versions of a schema.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSchemas",
                "description": "List all schemas.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This action lists tags for a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutCodeBinding",
                "description": "Generates code for specific schema in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchSchemas",
                "description": "Searches schemas based on specified keywords in your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDiscoverer",
                "description": "Starts the specified discoverer. Once started the discoverer will automatically register schemas for published events to configured source in your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopDiscoverer",
                "description": "Starts the specified discoverer. Once started the discoverer will automatically register schemas for published events to configured source in your account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from on a resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDiscoverer",
                "description": "Updates an existing discoverer in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "discoverer*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRegistry",
                "description": "Updates an existing registry metadata in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "registry*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSchema",
                "description": "Updates an existing schema in your account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "schema*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "discoverer",
                "arn": "arn:${Partition}:schemas:${Region}:${Account}:discoverer/${DiscovererId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "registry",
                "arn": "arn:${Partition}:schemas:${Region}:${Account}:registry/${RegistryName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "schema",
                "arn": "arn:${Partition}:schemas:${Region}:${Account}:schema/${RegistryName}/${SchemaName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon SimpleDB",
        "prefix": "sdb",
        "privileges": [
            {
                "privilege": "BatchDeleteAttributes",
                "description": "Performs multiple DeleteAttributes operations in a single call, which reduces round trips and latencies.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchPutAttributes",
                "description": "With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call. With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDomain",
                "description": "The CreateDomain operation creates a new domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAttributes",
                "description": "Deletes one or more attributes associated with the item.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDomain",
                "description": "The DeleteDomain operation deletes a domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DomainMetadata",
                "description": "Returns information about the domain, including when the domain was created, the number of items and attributes, and the size of attribute names and values.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAttributes",
                "description": "Returns all of the attributes associated with the item.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomains",
                "description": "Description for ListDomains",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAttributes",
                "description": "The PutAttributes operation creates or replaces attributes in an item.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Select",
                "description": "Description for Select",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "domain",
                "arn": "arn:${Partition}:sdb:${Region}:${Account}:domain/${DomainName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Secrets Manager",
        "prefix": "secretsmanager",
        "privileges": [
            {
                "privilege": "CancelRotateSecret",
                "description": "Enables the user to cancel an in-progress secret rotation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSecret",
                "description": "Enables the user to create a secret that stores encrypted data that can be queried and rotated.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:Name",
                            "secretsmanager:Description",
                            "secretsmanager:KmsKeyId",
                            "aws:RequestTag/tag-key",
                            "aws:TagKeys",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourcePolicy",
                "description": "Enables the user to delete the resource policy attached to a secret.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSecret",
                "description": "Enables the user to delete a secret.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:RecoveryWindowInDays",
                            "secretsmanager:ForceDeleteWithoutRecovery",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSecret",
                "description": "Enables the user to retrieve the metadata about a secret, but not the encrypted data.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRandomPassword",
                "description": "Enables the user to generate a random string for use in password creation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResourcePolicy",
                "description": "Enables the user to get the resource policy attached to a secret.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSecretValue",
                "description": "Enables the user to retrieve and decrypt the encrypted data.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:VersionId",
                            "secretsmanager:VersionStage",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSecretVersionIds",
                "description": "Enables the user to list the available versions of a secret.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSecrets",
                "description": "Enables the user to list the available secrets.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutResourcePolicy",
                "description": "Enables the user to attach a resource policy to a secret.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSecretValue",
                "description": "Enables the user to create a new version of the secret with new encrypted data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreSecret",
                "description": "Enables the user to cancel deletion of a secret.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RotateSecret",
                "description": "Enables the user to start rotation of a secret.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:RotationLambdaARN",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Enables the user to add tags to a secret.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "aws:RequestTag/tag-key",
                            "aws:TagKeys",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Enables the user to remove tags from a secret.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "aws:TagKeys",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSecret",
                "description": "Enables the user to update a secret with new metadata or with a new version of the encrypted data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:Description",
                            "secretsmanager:KmsKeyId",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSecretVersionStage",
                "description": "Enables the user to move a stage from one secret to another.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Secret*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "secretsmanager:SecretId",
                            "secretsmanager:VersionStage",
                            "secretsmanager:resource/AllowRotationLambdaArn",
                            "secretsmanager:ResourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Secret",
                "arn": "arn:${Partition}:secretsmanager:${Region}:${Account}:secret:${SecretId}",
                "condition_keys": [
                    "aws:RequestTag/tag-key",
                    "aws:TagKeys",
                    "secretsmanager:ResourceTag/tag-key",
                    "secretsmanager:resource/AllowRotationLambdaArn"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/tag-key",
                "description": "Filters access by a key that is present in the request the user makes to the Secrets Manager service.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters access by the list of all the tag key namespresent in the request the user makes to the Secrets Manager service.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:Description",
                "description": "Filters access by the description text in the request.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:ForceDeleteWithoutRecovery",
                "description": "Filters access by whether the secret is to be deleted immediately without any recovery window.",
                "type": "Boolean"
            },
            {
                "condition": "secretsmanager:KmsKeyId",
                "description": "Filters access by the ARN of the KMS key in the request.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:Name",
                "description": "Filters access by the friendly name of the secret in the request.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:RecoveryWindowInDays",
                "description": "Filters access by the number of days that Secrets Manager waits before it can delete the secret.",
                "type": "Long"
            },
            {
                "condition": "secretsmanager:ResourceTag/tag-key",
                "description": "Filters access by a tag key and value pair.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:RotationLambdaARN",
                "description": "Filters access by the ARN of the rotation Lambda function in the request.",
                "type": "ARN"
            },
            {
                "condition": "secretsmanager:SecretId",
                "description": "Filters access by the SecretID value in the request.",
                "type": "ARN"
            },
            {
                "condition": "secretsmanager:VersionId",
                "description": "Filters access by the unique identifier of the version of the secret in the request.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:VersionStage",
                "description": "Filters access by the list of version stages in the request.",
                "type": "String"
            },
            {
                "condition": "secretsmanager:resource/AllowRotationLambdaArn",
                "description": "Filters access by the ARN of the rotation Lambda function associated with the secret.",
                "type": "ARN"
            }
        ]
    },
    {
        "service_name": "AWS Security Hub",
        "prefix": "securityhub",
        "privileges": [
            {
                "privilege": "AcceptInvitation",
                "description": "Grants permission to accept Security Hub invitations to become a member account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDisableStandards",
                "description": "Grants permission to disable standards in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "standards-subscription*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchEnableStandards",
                "description": "Grants permission to enable standards in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "standard*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchImportFindings",
                "description": "Grants permission to import findings into Security Hub from an integrated product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "securityhub:TargetAccount"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchUpdateFindings",
                "description": "Grants permission to update customer-controlled fields for a selected set of Security Hub findings",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateActionTarget",
                "description": "Grants permission to create custom actions in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInsight",
                "description": "Grants permission to create insights in Security Hub. Insights are collections of related findings",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMembers",
                "description": "Grants permission to create member accounts in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeclineInvitations",
                "description": "Grants permission to decline Security Hub invitations to become a member account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteActionTarget",
                "description": "Grants permission to delete custom actions in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "action-target*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInsight",
                "description": "Grants permission to delete insights from Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "insight*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInvitations",
                "description": "Grants permission to delete Security Hub invitations to become a member account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMembers",
                "description": "Grants permission to delete Security Hub member accounts",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeActionTargets",
                "description": "Grants permission to retrieve a list of custom actions using the API",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeHub",
                "description": "Grants permission to retrieve information about the hub resource in your account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProducts",
                "description": "Grants permission to retrieve information about the available Security Hub product integrations",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStandards",
                "description": "Grants permission to retrieve information about Security Hub standards",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hub*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStandardsControls",
                "description": "Grants permission to retrieve information about Security Hub standards controls",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "hub*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableImportFindingsForProduct",
                "description": "Grants permission to disable the findings importing for a Security Hub integrated product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableSecurityHub",
                "description": "Grants permission to disable Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateFromMasterAccount",
                "description": "Grants permission to a Security Hub member account to disassociate from the associated master account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateMembers",
                "description": "Grants permission to disassociate Security Hub member accounts from the associated master account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableImportFindingsForProduct",
                "description": "Grants permission to enable the findings importing for a Security Hub integrated product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableSecurityHub",
                "description": "Grants permission to enable Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEnabledStandards",
                "description": "Grants permission to retrieve a list of the standards that are enabled in Security Hub",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFindings",
                "description": "Grants permission to retrieve a list of findings from Security Hub",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInsightResults",
                "description": "Grants permission to retrieve insight results from Security Hub",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "insight*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInsights",
                "description": "Grants permission to retrieve Security Hub insights",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "insight*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInvitationsCount",
                "description": "Grants permission to retrieve the count of Security Hub membership invitations sent to the account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMasterAccount",
                "description": "Grants permission to retrieve details about the Security Hub master account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMembers",
                "description": "Grants permission to retrieve the details of Security Hub member accounts",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InviteMembers",
                "description": "Grants permission to invite other AWS accounts to become Security Hub member accounts",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEnabledProductsForImport",
                "description": "Grants permission to retrieve the Security Hub integrated products that are currently enabled",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInvitations",
                "description": "Grants permission to retrieve the Security Hub invitations sent to the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMembers",
                "description": "Grants permission to retrieve details about Security Hub member accounts associated with the master account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list of tags associated with a resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "hub*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to add tags to a Security Hub resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "hub*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to remove tags from a Security Hub resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "hub*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateActionTarget",
                "description": "Grants permission to update custom actions in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "action-target*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFindings",
                "description": "Grants permission to update Security Hub findings",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInsight",
                "description": "Grants permission to update insights in Security Hub",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "insight*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStandardsControl",
                "description": "Grants permission to update Security Hub standards controls",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "hub*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "insight",
                "arn": "arn:${Partition}:securityhub:${Region}:${Account}:insight/${CompanyId}/${ProductId}/${UniqueId}",
                "condition_keys": []
            },
            {
                "resource": "standard",
                "arn": "arn:${Partition}:securityhub:::ruleset/${StandardsName}/v/${StandardsVersion}",
                "condition_keys": []
            },
            {
                "resource": "standards-subscription",
                "arn": "arn:${Partition}:securityhub:${Region}:${Account}:subscription/${StandardsName}/v/${StandardsVersion}",
                "condition_keys": []
            },
            {
                "resource": "product-subscription",
                "arn": "arn:${Partition}:securityhub:${Region}:${Account}:product-subscription/${Company}/${ProductId}",
                "condition_keys": []
            },
            {
                "resource": "product",
                "arn": "arn:${Partition}:securityhub:${Region}:${Account}:product/${Company}/${ProductId}",
                "condition_keys": []
            },
            {
                "resource": "hub",
                "arn": "arn:${Partition}:securityhub:${Region}:${Account}:hub/default",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "action-target",
                "arn": "arn:${Partition}:securityhub:${Region}:${Account}:action/custom/${Id}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "securityhub:TargetAccount",
                "description": "The ID of the AWS account into which you want to import findings. In the AWS Security Finding format, this field is called AwsAccountId",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Serverless Application Repository",
        "prefix": "serverlessrepo",
        "privileges": [
            {
                "privilege": "CreateApplication",
                "description": "Creates an application, optionally including an AWS SAM file to create the first application version in the same call.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplicationVersion",
                "description": "Creates an application version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCloudFormationChangeSet",
                "description": "Creates an AWS CloudFormation ChangeSet for the given application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "serverlessrepo:applicationType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCloudFormationTemplate",
                "description": "Creates an AWS CloudFormation template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "serverlessrepo:applicationType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplication",
                "description": "Deletes the specified application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplication",
                "description": "Gets the specified application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "serverlessrepo:applicationType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplicationPolicy",
                "description": "Gets the policy for the specified application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCloudFormationTemplate",
                "description": "Gets the specified AWS CloudFormation template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplicationDependencies",
                "description": "Retrieves the list of applications nested in the containing application",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "serverlessrepo:applicationType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplicationVersions",
                "description": "Lists versions for the specified application owned by the requester.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "serverlessrepo:applicationType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "Lists applications owned by the requester.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutApplicationPolicy",
                "description": "Puts the policy for the specified application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchApplications",
                "description": "Gets all applications authorized for this user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "serverlessrepo:applicationType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UnshareApplication",
                "description": "Unshares the specified application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplication",
                "description": "Updates meta-data of the application",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "applications*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "applications",
                "arn": "arn:${Partition}:serverlessrepo:${Region}:${Account}:applications/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "serverlessrepo:applicationType",
                "description": "Application type",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Service Catalog",
        "prefix": "servicecatalog",
        "privileges": [
            {
                "privilege": "AcceptPortfolioShare",
                "description": "Accepts a portfolio that has been shared with you",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateBudgetWithResource",
                "description": "Associates a budget with a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociatePrincipalWithPortfolio",
                "description": "Associates an IAM principal with a portfolio, giving the specified principal access to any products associated with the specified portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateProductWithPortfolio",
                "description": "Associates a product with a portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateServiceActionWithProvisioningArtifact",
                "description": "Associates an action with a provisioning artifact",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateTagOptionWithResource",
                "description": "Associate the specified TagOption with the specified portfolio or product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Product",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchAssociateServiceActionWithProvisioningArtifact",
                "description": "Associates multiple self-service actions with provisioning artifacts.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "BatchDisassociateServiceActionFromProvisioningArtifact",
                "description": "Disassociates a batch of self-service actions from the specified provisioning artifact.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CopyProduct",
                "description": "Copies the specified source product to the specified target product or a new product.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConstraint",
                "description": "Creates a constraint on an associated product and portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePortfolio",
                "description": "Creates a portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePortfolioShare",
                "description": "Shares a portfolio you own with another AWS account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProduct",
                "description": "Creates a product and that product's first provisioning artifact",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProvisionedProductPlan",
                "description": "Adds a new provisioned product plan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProvisioningArtifact",
                "description": "Adds a new provisioning artifact to an existing product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateServiceAction",
                "description": "Creates a self-service action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTagOption",
                "description": "Creates a TagOption.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConstraint",
                "description": "Removes and deletes an existing constraint from an associated product and portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePortfolio",
                "description": "Deletes a portfolio if all associations and shares have been removed from the portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePortfolioShare",
                "description": "Unshares a portfolio you own from an AWS account you previously shared the portfolio with",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProduct",
                "description": "Deletes a product if all associations have been removed from the product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProvisionedProductPlan",
                "description": "Deletes a provisioned product plan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProvisioningArtifact",
                "description": "Deletes a provisioning artifact from a product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServiceAction",
                "description": "Deletes a self-service action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTagOption",
                "description": "Deletes the specified TagOption.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConstraint",
                "description": "Describes a constraint",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCopyProductStatus",
                "description": "Gets the status of the specified copy product operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePortfolio",
                "description": "Describes a portfolio",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePortfolioShareStatus",
                "description": "Gets the status of the specified portfolio share operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProduct",
                "description": "Describes a product as an end-user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProductAsAdmin",
                "description": "Describes a product as an admin",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProductView",
                "description": "Describes a product as an end-user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisionedProduct",
                "description": "Describes a provisioned product",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisionedProductPlan",
                "description": "Describes a provisioned product plan",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisioningArtifact",
                "description": "Describes a provisioning artifact",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProvisioningParameters",
                "description": "Describes the parameters that you need to specify to successfully provision a specified provisioning artifact",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRecord",
                "description": "Describes a record and lists any outputs",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicecatalog:accountLevel",
                            "servicecatalog:roleLevel",
                            "servicecatalog:userLevel"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServiceAction",
                "description": "Describes a self-service action.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServiceActionExecutionParameters",
                "description": "Gets the default parameters if you executed the specified Service Action on the specified Provisioned Product.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTagOption",
                "description": "Gets information about the specified TagOption.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableAWSOrganizationsAccess",
                "description": "Disable portfolio sharing through AWS Organizations feature.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateBudgetFromResource",
                "description": "Disassociates a budget from a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociatePrincipalFromPortfolio",
                "description": "Disassociates an IAM principal from a portfolio.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateProductFromPortfolio",
                "description": "Disassociates a product from a portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateServiceActionFromProvisioningArtifact",
                "description": "Disassociates the specified self-service action association from the specified provisioning artifact.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateTagOptionFromResource",
                "description": "Disassociates the specified TagOption from the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "Product",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableAWSOrganizationsAccess",
                "description": "Enable portfolio sharing feature through AWS Organizations.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecuteProvisionedProductPlan",
                "description": "Executes a provisioned product plan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExecuteProvisionedProductServiceAction",
                "description": "Executes a provisioned product plan",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAWSOrganizationsAccessStatus",
                "description": "Get the Access Status for AWS Organization portfolio share feature.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAcceptedPortfolioShares",
                "description": "Lists the portfolios that have been shared with you and you have accepted",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBudgetsForResource",
                "description": "Lists all the budgets associated to a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConstraintsForPortfolio",
                "description": "Lists constraints associated with a given portfolio",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLaunchPaths",
                "description": "Lists the different ways to launch a given product as an end-user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOrganizationPortfolioAccess",
                "description": "Lists the organization nodes that have access to the specified portfolio.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPortfolioAccess",
                "description": "Lists the AWS accounts you have shared a given portfolio with",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPortfolios",
                "description": "Lists the portfolios in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPortfoliosForProduct",
                "description": "Lists the portfolios associated with a given product",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPrincipalsForPortfolio",
                "description": "Lists the IAM principals associated with a given portfolio",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisionedProductPlans",
                "description": "Lists the provisioned product plans",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisioningArtifacts",
                "description": "Lists the provisioning artifacts associated with a given product",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisioningArtifactsForServiceAction",
                "description": "Lists all provisioning artifacts for the specified self-service action.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRecordHistory",
                "description": "Lists all the records in your account or all the records related to a given provisioned product",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicecatalog:accountLevel",
                            "servicecatalog:roleLevel",
                            "servicecatalog:userLevel"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourcesForTagOption",
                "description": "Lists the resources associated with the specified TagOption.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServiceActions",
                "description": "Lists all self-service actions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServiceActionsForProvisioningArtifact",
                "description": "Lists all the service actions associated with the specified provisioning artifact in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStackInstancesForProvisionedProduct",
                "description": "Lists account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagOptions",
                "description": "Lists the specified TagOptions or all TagOptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ProvisionProduct",
                "description": "Provisions a product with a specified provisioning artifact and launch parameters",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RejectPortfolioShare",
                "description": "Rejects a portfolio that has been shared with you that you previously accepted",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ScanProvisionedProducts",
                "description": "Lists all the provisioned products in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicecatalog:accountLevel",
                            "servicecatalog:roleLevel",
                            "servicecatalog:userLevel"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchProducts",
                "description": "Lists the products available to you as an end-user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchProductsAsAdmin",
                "description": "Lists all the products in your account or all the products associated with a given portfolio",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchProvisionedProducts",
                "description": "Lists all the provisioned products in your account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicecatalog:accountLevel",
                            "servicecatalog:roleLevel",
                            "servicecatalog:userLevel"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateProvisionedProduct",
                "description": "Terminates an existing provisioned product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicecatalog:accountLevel",
                            "servicecatalog:roleLevel",
                            "servicecatalog:userLevel"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConstraint",
                "description": "Updates the metadata fields of an existing constraint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePortfolio",
                "description": "Updates the metadata fields and/or tags of an existing portfolio",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Portfolio*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProduct",
                "description": "Updates the metadata fields and/or tags of an existing product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProvisionedProduct",
                "description": "Updates an existing provisioned product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicecatalog:accountLevel",
                            "servicecatalog:roleLevel",
                            "servicecatalog:userLevel"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProvisionedProductProperties",
                "description": "Updates the properties of an existing provisioned product",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProvisioningArtifact",
                "description": "Updates the metadata fields of an existing provisioning artifact",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "Product*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServiceAction",
                "description": "Updates a self-service action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTagOption",
                "description": "Updates the specified TagOption.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "Portfolio",
                "arn": "arn:${Partition}:catalog:${Region}:${Account}:portfolio/${PortfolioId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "Product",
                "arn": "arn:${Partition}:catalog:${Region}:${Account}:product/${ProductId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "servicecatalog:accountLevel",
                "description": "Allows users to see and perform actions on resources created by anyone in the account.",
                "type": "String"
            },
            {
                "condition": "servicecatalog:roleLevel",
                "description": "Allows users to see and perform actions on resources created either by them or by anyone federating into the same role as them.",
                "type": "String"
            },
            {
                "condition": "servicecatalog:userLevel",
                "description": "Allows users to see and perform actions on only resources that they created.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Cloud Map",
        "prefix": "servicediscovery",
        "privileges": [
            {
                "privilege": "CreateHttpNamespace",
                "description": "Creates an HTTP namespace.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePrivateDnsNamespace",
                "description": "Creates a private namespace based on DNS, which will be visible only inside a specified Amazon VPC.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePublicDnsNamespace",
                "description": "Creates a public namespace based on DNS, which will be visible on the internet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateService",
                "description": "Creates a service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:NamespaceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNamespace",
                "description": "Deletes a specified namespace.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "namespace*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteService",
                "description": "Deletes a specified service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterInstance",
                "description": "Deletes the records and the health check, if any, that Amazon Route 53 created for the specified instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:ServiceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DiscoverInstances",
                "description": "Discovers registered instances for a specified namespace and service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:NamespaceName",
                            "servicediscovery:ServiceName"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstance",
                "description": "Gets information about a specified instance.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:ServiceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInstancesHealthStatus",
                "description": "Gets the current health status (Healthy, Unhealthy, or Unknown) of one or more instances.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:ServiceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetNamespace",
                "description": "Gets information about a namespace.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "namespace*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOperation",
                "description": "Gets information about a specific operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetService",
                "description": "Gets the settings for a specified service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstances",
                "description": "Gets summary information about the instances that were registered with a specified service.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:ServiceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListNamespaces",
                "description": "Gets information about the namespaces.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOperations",
                "description": "Lists operations that match the criteria that you specify.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServices",
                "description": "Gets settings for all the services that match specified filters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterInstance",
                "description": "Registers an instance based on the settings in a specified service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:ServiceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInstanceCustomHealthStatus",
                "description": "Updates the current health status for an instance that has a custom health check.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicediscovery:ServiceArn"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateService",
                "description": "Updates the settings in a specified service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "service*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "namespace",
                "arn": "arn:${Partition}:servicediscovery:${Region}:${Account}:namespace/${NamespaceId}",
                "condition_keys": []
            },
            {
                "resource": "service",
                "arn": "arn:${Partition}:servicediscovery:${Region}:${Account}:service/${ServiceId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "servicediscovery:NamespaceArn",
                "description": "A filter that lets you get objects by specifying the Amazon Resource Name (ARN) for the related namespace.",
                "type": "String"
            },
            {
                "condition": "servicediscovery:NamespaceName",
                "description": "A filter that lets you get objects by specifying the name of the related namespace.",
                "type": "String"
            },
            {
                "condition": "servicediscovery:ServiceArn",
                "description": "A filter that lets you get objects by specifying the Amazon Resource Name (ARN) for the related service.",
                "type": "String"
            },
            {
                "condition": "servicediscovery:ServiceName",
                "description": "A filter that lets you get objects by specifying the name of the related service.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Service Quotas",
        "prefix": "servicequotas",
        "privileges": [
            {
                "privilege": "AssociateServiceQuotaTemplate",
                "description": "Grants permission to associate the Service Quotas template with your organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServiceQuotaIncreaseRequestFromTemplate",
                "description": "Grants permission to remove the specified service quota from the service quota template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateServiceQuotaTemplate",
                "description": "Grants permission to disassociate the Service Quotas template from your organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAWSDefaultServiceQuota",
                "description": "Grants permission to return the details for the specified service quota, including the AWS default value",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAssociationForServiceQuotaTemplate",
                "description": "Grants permission to retrieve the ServiceQuotaTemplateAssociationStatus value, which tells you if the Service Quotas template is associated with an organization",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRequestedServiceQuotaChange",
                "description": "Grants permission to retrieve the details for a particular service quota increase request",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceQuota",
                "description": "Grants permission to return the details for the specified service quota, including the applied value",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceQuotaIncreaseRequestFromTemplate",
                "description": "Grants permission to retrieve the details for a service quota increase request from the service quota template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAWSDefaultServiceQuotas",
                "description": "Grants permission to list all default service quotas for the specified AWS service",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRequestedServiceQuotaChangeHistory",
                "description": "Grants permission to request a list of the changes to quotas for a service",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRequestedServiceQuotaChangeHistoryByQuota",
                "description": "Grants permission to request a list of the changes to specific service quotas",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServiceQuotaIncreaseRequestsInTemplate",
                "description": "Grants permission to return a list of the service quota increase requests from the service quota template",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServiceQuotas",
                "description": "Grants permission to list all service quotas for the specified AWS service, in that account, in that Region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServices",
                "description": "Grants permission to list the AWS services available in Service Quotas",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutServiceQuotaIncreaseRequestIntoTemplate",
                "description": "Grants permission to define and add a quota to the service quota template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "quota",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicequotas:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestServiceQuotaIncrease",
                "description": "Grants permission to submit the request for a service quota increase",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "quota",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "servicequotas:service"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "quota",
                "arn": "arn:${Partition}:servicequotas:${Region}:${Account}:${ServiceCode}/${QuotaCode}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "servicequotas:service",
                "description": "Filters or restricts access to a specified AWS service",
                "type": "string"
            }
        ]
    },
    {
        "service_name": "Amazon Pinpoint Email Service",
        "prefix": "ses",
        "privileges": [
            {
                "privilege": "CreateConfigurationSet",
                "description": "Create a configuration set. Configuration sets are groups of rules that you can apply to the emails you send using Amazon Pinpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationSetEventDestination",
                "description": "Create an event destination",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDedicatedIpPool",
                "description": "Create a new pool of dedicated IP addresses",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dedicated-ip-pool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDeliverabilityTestReport",
                "description": "Create a new predictive inbox placement test.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateEmailIdentity",
                "description": "Verifies an email identity for use with Amazon Pinpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSet",
                "description": "Delete an existing configuration set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSetEventDestination",
                "description": "Delete an event destination",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDedicatedIpPool",
                "description": "Delete a dedicated IP pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dedicated-ip-pool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEmailIdentity",
                "description": "Deletes an email identity that you previously verified for use with Amazon Pinpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccount",
                "description": "Obtain information about the email-sending status and capabilities",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetBlacklistReports",
                "description": "Retrieve a list of the blacklists that your dedicated IP addresses appear on",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfigurationSet",
                "description": "Get information about an existing configuration set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfigurationSetEventDestinations",
                "description": "Retrieve a list of event destinations that are associated with a configuration set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDedicatedIp",
                "description": "Get information about a dedicated IP address",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDedicatedIps",
                "description": "List the dedicated IP addresses that are associated with your Amazon Pinpoint account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "dedicated-ip-pool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeliverabilityDashboardOptions",
                "description": "Show the status of the Deliverability dashboard",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeliverabilityTestReport",
                "description": "Retrieve the results of a predictive inbox placement test",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "deliverability-test-report*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDomainStatisticsReport",
                "description": "Retrieve inbox placement and engagement rates for the domains that you use to send email",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEmailIdentity",
                "description": "Provides information about a specific identity associated with your Amazon Pinpoint account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurationSets",
                "description": "List all of the configuration sets associated with your Amazon Pinpoint account in the current region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDedicatedIpPools",
                "description": "List all of the dedicated IP pools that exist in your Amazon Pinpoint account in the current AWS Region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeliverabilityTestReports",
                "description": "Show a list of the predictive inbox placement tests that you've performed, regardless of their statuses",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEmailIdentities",
                "description": "Returns a list of all of the email identities that are associated with your Amazon Pinpoint account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Retrieve a list of the tags (keys and values) that are associated with a specific resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "configuration-set",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dedicated-ip-pool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deliverability-test-report",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "identity",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccountDedicatedIpWarmupAttributes",
                "description": "Enable or disable the automatic warm-up feature for dedicated IP addresses",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccountSendingAttributes",
                "description": "Enable or disable the ability of your account to send email",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurationSetDeliveryOptions",
                "description": "Associate a configuration set with a dedicated IP pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurationSetReputationOptions",
                "description": "Enable or disable collection of reputation metrics for emails that you send using a particular configuration set in a specific AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurationSetSendingOptions",
                "description": "Enable or disable email sending for messages that use a particular configuration set in a specific AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurationSetTrackingOptions",
                "description": "Specify a custom domain to use for open and click tracking elements in email that you send using Amazon Pinpoint",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDedicatedIpInPool",
                "description": "Move a dedicated IP address to an existing dedicated IP pool",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "dedicated-ip-pool*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDedicatedIpWarmupAttributes",
                "description": "Put Dedicated IP warm up attributes",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutDeliverabilityDashboardOption",
                "description": "Enable or disable the Deliverability dashboard",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEmailIdentityDkimAttributes",
                "description": "Used to enable or disable DKIM authentication for an email identity",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEmailIdentityFeedbackAttributes",
                "description": "Used to enable or disable feedback forwarding for an identity",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEmailIdentityMailFromAttributes",
                "description": "Used to enable or disable the custom Mail-From domain configuration for an email identity",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendEmail",
                "description": "Sends an email message",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FeedbackAddress",
                            "ses:FromAddress",
                            "ses:FromDisplayName",
                            "ses:Recipients"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add one or more tags (keys and values) to a specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "configuration-set",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dedicated-ip-pool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deliverability-test-report",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "identity",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove one or more tags (keys and values) from a specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "configuration-set",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "dedicated-ip-pool",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "deliverability-test-report",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "identity",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationSetEventDestination",
                "description": "Update the configuration of an event destination for a configuration set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "configuration-set*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "configuration-set",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "dedicated-ip-pool",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:dedicated-ip-pool/${CustomVerificationEmailTemplateName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "deliverability-test-report",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:deliverability-test-report/${CustomVerificationEmailTemplateName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "event-destination",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}:event-destination/${EventDestinationName}",
                "condition_keys": []
            },
            {
                "resource": "identity",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            },
            {
                "condition": "ses:FeedbackAddress",
                "description": "The \"Return-Path\" address, which specifies where bounces and complaints are sent by email feedback forwarding.",
                "type": "String"
            },
            {
                "condition": "ses:FromAddress",
                "description": "The \"From\" address of a message.",
                "type": "String"
            },
            {
                "condition": "ses:FromDisplayName",
                "description": "The \"From\" address that is used as the display name of a message.",
                "type": "String"
            },
            {
                "condition": "ses:Recipients",
                "description": "The recipient addresses of a message, which include the \"To\", \"CC\", and \"BCC\" addresses.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon SES",
        "prefix": "ses",
        "privileges": [
            {
                "privilege": "CloneReceiptRuleSet",
                "description": "Creates a receipt rule set by cloning an existing one",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationSet",
                "description": "Creates a new configuration set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationSetEventDestination",
                "description": "Creates a configuration set event destination",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationSetTrackingOptions",
                "description": "Creates an association between a configuration set and a custom domain for open and click event tracking",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCustomVerificationEmailTemplate",
                "description": "Creates a new custom verification email template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReceiptFilter",
                "description": "Creates a new IP address filter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReceiptRule",
                "description": "Creates a receipt rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReceiptRuleSet",
                "description": "Creates an empty receipt rule set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTemplate",
                "description": "Creates an email template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSet",
                "description": "Deletes the configuration set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSetEventDestination",
                "description": "Deletes a configuration set event destination",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSetTrackingOptions",
                "description": "Deletes an association between a configuration set and a custom domain for open and click event tracking",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCustomVerificationEmailTemplate",
                "description": "Deletes an existing custom verification email template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIdentity",
                "description": "Deletes the specified identity (an email address or a domain) from the list of verified identities",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIdentityPolicy",
                "description": "Deletes the specified identity (an email address or a domain) from the list of verified identities",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReceiptFilter",
                "description": "Deletes the specified IP address filter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReceiptRule",
                "description": "Deletes the specified receipt rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReceiptRuleSet",
                "description": "Deletes the specified receipt rule set and all of the receipt rules it contains",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTemplate",
                "description": "Deletes an email template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVerifiedEmailAddress",
                "description": "Deletes the specified email address from the list of verified addresses",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeActiveReceiptRuleSet",
                "description": "Returns the metadata and receipt rules for the receipt rule set that is currently active",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeConfigurationSet",
                "description": "Returns the details of the specified configuration set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReceiptRule",
                "description": "Returns the details of the specified receipt rule",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeReceiptRuleSet",
                "description": "Returns the details of the specified receipt rule set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccountSendingEnabled",
                "description": "Returns the email sending status of the Amazon SES account for the current region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCustomVerificationEmailTemplate",
                "description": "Returns the custom email verification template for the template name you specify",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityDkimAttributes",
                "description": "Returns the current status of Easy DKIM signing for an entity",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityMailFromDomainAttributes",
                "description": "Returns the custom MAIL FROM attributes for a list of identities (email addresses and/or domains)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityNotificationAttributes",
                "description": "Given a list of verified identities (email addresses and/or domains), returns a structure describing identity notification attributes",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityPolicies",
                "description": "Returns the requested sending authorization policies for the given identity (an email address or a domain)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIdentityVerificationAttributes",
                "description": "Given a list of identities (email addresses and/or domains), returns the verification status and (for domain identities) the verification token for each identity",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSendQuota",
                "description": "Returns the user's current sending limits",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSendStatistics",
                "description": "Returns the user's sending statistics. The result is a list of data points, representing the last two weeks of sending activity",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTemplate",
                "description": "Returns the template object (which includes the Subject line, HTML part and text part) for the template you specify",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurationSets",
                "description": "Returns a list of the configuration sets associated with your Amazon SES account in the current AWS Region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCustomVerificationEmailTemplates",
                "description": "Lists the existing custom verification email templates for your account in the current AWS Region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIdentities",
                "description": "Returns a list containing all of the identities (email addresses and domains) for your AWS account, regardless of verification status",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIdentityPolicies",
                "description": "Returns a list of sending authorization policies that are attached to the given identity (an email address or a domain)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReceiptFilters",
                "description": "Lists the IP address filters associated with your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListReceiptRuleSets",
                "description": "Lists the receipt rule sets that exist under your AWS account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTemplates",
                "description": "Lists the email templates present in your Amazon SES account in the current AWS Region",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVerifiedEmailAddresses",
                "description": "Returns a list containing all of the email addresses that have been verified",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutIdentityPolicy",
                "description": "Adds or updates a sending authorization policy for the specified identity (an email address or a domain)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReorderReceiptRuleSet",
                "description": "Reorders the receipt rules within a receipt rule set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendBounce",
                "description": "Generates and sends a bounce message to the sender of an email you received through Amazon SES",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FromAddress"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendBulkTemplatedEmail",
                "description": "Composes an email message to multiple destinations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FeedbackAddress",
                            "ses:FromAddress",
                            "ses:FromDisplayName",
                            "ses:Recipients"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendCustomVerificationEmail",
                "description": "Adds an email address to the list of identities for your Amazon SES account in the current AWS Region and attempts to verify it",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FeedbackAddress",
                            "ses:FromAddress",
                            "ses:FromDisplayName",
                            "ses:Recipients"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendEmail",
                "description": "Composes an email message based on input data, and then immediately queues the message for sending",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FeedbackAddress",
                            "ses:FromAddress",
                            "ses:FromDisplayName",
                            "ses:Recipients"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendRawEmail",
                "description": "Sends an email message, with header and content specified by the client",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FeedbackAddress",
                            "ses:FromAddress",
                            "ses:FromDisplayName",
                            "ses:Recipients"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendTemplatedEmail",
                "description": "Composes an email message using an email template and immediately queues it for sending",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "identity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ses:FeedbackAddress",
                            "ses:FromAddress",
                            "ses:FromDisplayName",
                            "ses:Recipients"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetActiveReceiptRuleSet",
                "description": "Sets the specified receipt rule set as the active receipt rule set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityDkimEnabled",
                "description": "Enables or disables Easy DKIM signing of email sent from an identity",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityFeedbackForwardingEnabled",
                "description": "Given an identity (an email address or a domain), enables or disables whether Amazon SES forwards bounce and complaint notifications as email",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityHeadersInNotificationsEnabled",
                "description": "Given an identity (an email address or a domain), sets whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityMailFromDomain",
                "description": "Enables or disables the custom MAIL FROM domain setup for a verified identity (an email address or a domain)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetIdentityNotificationTopic",
                "description": "Given an identity (an email address or a domain), sets the Amazon Simple Notification Service (Amazon SNS) topic to which Amazon SES will publish bounce, complaint, and/or delivery notifications for emails sent with that identity as the Source",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetReceiptRulePosition",
                "description": "Sets the position of the specified receipt rule in the receipt rule set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestRenderTemplate",
                "description": "Creates a preview of the MIME content of an email when provided with a template and a set of replacement data",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAccountSendingEnabled",
                "description": "Enables or disables email sending across your entire Amazon SES account in the current AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationSetEventDestination",
                "description": "Updates the event destination of a configuration set",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationSetReputationMetricsEnabled",
                "description": "Enables or disables the publishing of reputation metrics for emails sent using a specific configuration set in a given AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationSetSendingEnabled",
                "description": "Enables or disables email sending for messages sent using a specific configuration set in a given AWS Region",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationSetTrackingOptions",
                "description": "Modifies an association between a configuration set and a custom domain for open and click event tracking",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCustomVerificationEmailTemplate",
                "description": "Updates an existing custom verification email template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateReceiptRule",
                "description": "Updates a receipt rule",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTemplate",
                "description": "Updates an email template",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyDomainDkim",
                "description": "Returns a set of DKIM tokens for a domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyDomainIdentity",
                "description": "Verifies a domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyEmailAddress",
                "description": "Verifies an email address. This action causes a confirmation email message to be sent to the specified address. This action is throttled at one request per second",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyEmailIdentity",
                "description": "Verifies an email address. This action causes a confirmation email message to be sent to the specified address. This action is throttled at one request per second",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "configuration-set",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}",
                "condition_keys": []
            },
            {
                "resource": "custom-verification-email-template",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:custom-verification-email-template/${CustomVerificationEmailTemplateName}",
                "condition_keys": []
            },
            {
                "resource": "event-destination",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}:event-destination/${EventDestinationName}",
                "condition_keys": []
            },
            {
                "resource": "identity",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}",
                "condition_keys": []
            },
            {
                "resource": "receipt-filter",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:receipt-filter/${ReceiptFilterName}",
                "condition_keys": []
            },
            {
                "resource": "receipt-rule",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:receipt-rule-set/${ReceiptRuleSetName}:receipt-rule/${ReceiptRuleName}",
                "condition_keys": []
            },
            {
                "resource": "receipt-rule-set",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:receipt-rule-set/${ReceiptRuleSetName}",
                "condition_keys": []
            },
            {
                "resource": "template",
                "arn": "arn:${Partition}:ses:${Region}:${Account}:template/${TemplateName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "ses:FeedbackAddress",
                "description": "The \"Return-Path\" address, which specifies where bounces and complaints are sent by email feedback forwarding.",
                "type": "String"
            },
            {
                "condition": "ses:FromAddress",
                "description": "The \"From\" address of a message.",
                "type": "String"
            },
            {
                "condition": "ses:FromDisplayName",
                "description": "The \"From\" address that is used as the display name of a message.",
                "type": "String"
            },
            {
                "condition": "ses:Recipients",
                "description": "The recipient addresses of a message, which include the \"To\", \"CC\", and \"BCC\" addresses.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Shield",
        "prefix": "shield",
        "privileges": [
            {
                "privilege": "AssociateDRTLogBucket",
                "description": "Authorizes the DDoS Response team to access the specified Amazon S3 bucket containing your flow logs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetBucketPolicy",
                            "s3:PutBucketPolicy"
                        ]
                    }
                ]
            },
            {
                "privilege": "AssociateDRTRole",
                "description": "Authorizes the DDoS Response team using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:GetRole",
                            "iam:ListAttachedRolePolicies",
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateProtection",
                "description": "Activate DDoS protection service for a given resource ARN",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "protection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSubscription",
                "description": "Activate subscription",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProtection",
                "description": "Delete an existing protection",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "protection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSubscription",
                "description": "Deactivate subscription",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAttack",
                "description": "Get attack details",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "attack*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDRTAccess",
                "description": "Returns the current role and list of Amazon S3 log buckets used by the DDoS Response team to access your AWS account while assisting with attack mitigation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEmergencyContactSettings",
                "description": "Lists the email addresses that the DRT can use to contact you during a suspected attack",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeProtection",
                "description": "Get protection details",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "protection*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSubscription",
                "description": "Get subscription details, such as start time",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDRTLogBucket",
                "description": "Removes the DDoS Response team's access to the specified Amazon S3 bucket containing your flow logs",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:DeleteBucketPolicy",
                            "s3:GetBucketPolicy",
                            "s3:PutBucketPolicy"
                        ]
                    }
                ]
            },
            {
                "privilege": "DisassociateDRTRole",
                "description": "Removes the DDoS Response team's access to your AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSubscriptionState",
                "description": "Get subscription state",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAttacks",
                "description": "List all existing attacks",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProtections",
                "description": "List all existing protections",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateEmergencyContactSettings",
                "description": "Updates the details of the list of email addresses that the DRT can use to contact you during a suspected attack",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSubscription",
                "description": "Updates the details of an existing subscription",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "attack",
                "arn": "arn:${Partition}:shield::${Account}:attack/${Id}",
                "condition_keys": []
            },
            {
                "resource": "protection",
                "arn": "arn:${Partition}:shield::${Account}:protection/${Id}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Code Signing for Amazon FreeRTOS",
        "prefix": "signer",
        "privileges": [
            {
                "privilege": "CancelSigningProfile",
                "description": "Cancels a signing profile.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "signing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSigningJob",
                "description": "Describe a signing job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "signing-job*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSigningPlatform",
                "description": "Retrieves a signing platform.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSigningProfile",
                "description": "Retrieves a signing profile.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "signing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSigningJobs",
                "description": "List signing jobs.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSigningPlatforms",
                "description": "List all signing platforms.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSigningProfiles",
                "description": "List all signing profile associated with the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the tags associated with the Signing Profile resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "signing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutSigningProfile",
                "description": "Creates a new signing profile if not exists.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSigningJob",
                "description": "Starts a code signing request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "signing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds one or more tags to an Signing Profile resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "signing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes one or more tags from an Signing Profile resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "signing-profile*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "signing-profile",
                "arn": "arn:${Partition}:signer:${Region}::/signing-profiles/${profileName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "signing-job",
                "arn": "arn:${Partition}:signer:${Region}::/signing-jobs/${jobId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Server Migration Service",
        "prefix": "sms",
        "privileges": [
            {
                "privilege": "CreateApp",
                "description": "Create an application configuration to migrate on-premise application onto AWS..",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateReplicationJob",
                "description": "Create a job to migrate on-premise server onto AWS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApp",
                "description": "Delete an existing application configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAppLaunchConfiguration",
                "description": "Delete launch configuration for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAppReplicationConfiguration",
                "description": "Delete replication configuration for an existing application..",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteReplicationJob",
                "description": "Delete an existing job to migrate on-premise server onto AWS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServerCatalog",
                "description": "Delete the complete list of on-premise servers gathered into AWS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateConnector",
                "description": "Disassociate a connector that has been associated.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateChangeSet",
                "description": "Generate a changeSet for the CloudFormation stack of an application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GenerateTemplate",
                "description": "Generate a CloudFormation template for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApp",
                "description": "Get the configuration and statuses for an existing application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAppLaunchConfiguration",
                "description": "Get launch configuration for an existing application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAppReplicationConfiguration",
                "description": "Get replication configuration for an existing application.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnectors",
                "description": "Get all connectors that have been associated.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMessages",
                "description": "Gets messages from AWS Server Migration Service to Server Migration Connector.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReplicationJobs",
                "description": "Get all existing jobs to migrate on-premise servers onto AWS.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetReplicationRuns",
                "description": "Get all runs for an existing job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServers",
                "description": "Get all servers that have been imported.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportServerCatalog",
                "description": "Gathers a complete list of on-premise servers.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LaunchApp",
                "description": "Create and launch a CloudFormation stack for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApps",
                "description": "Get a list of summaries for existing applications.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAppLaunchConfiguration",
                "description": "Create or update launch configuration for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAppReplicationConfiguration",
                "description": "Create or update replication configuration for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendMessage",
                "description": "Send message from Server Migration Connector to AWS Server Migration Service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartAppReplication",
                "description": "Create and start replication jobs for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartOnDemandReplicationRun",
                "description": "Start a replication run for an existing replication job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopAppReplication",
                "description": "Stop and delete replication jobs for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateApp",
                "description": "Terminate the CloudFormation stack for an existing application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApp",
                "description": "Update an existing application configuration",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateReplicationJob",
                "description": "Update an existing job to migrate on-premise server onto AWS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Pinpoint SMS and Voice Service",
        "prefix": "sms-voice",
        "privileges": [
            {
                "privilege": "CreateConfigurationSet",
                "description": "Create a new configuration set. After you create the configuration set, you can add one or more event destinations to it.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateConfigurationSetEventDestination",
                "description": "Create a new event destination in a configuration set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSet",
                "description": "Deletes an existing configuration set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteConfigurationSetEventDestination",
                "description": "Deletes an event destination in a configuration set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConfigurationSetEventDestinations",
                "description": "Obtain information about an event destination, including the types of events it reports, the Amazon Resource Name (ARN) of the destination, and the name of the event destination.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListConfigurationSets",
                "description": "Return a list of configuration sets. This operation only returns the configuration sets that are associated with your account in the current AWS Region.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendVoiceMessage",
                "description": "Create a new voice message and send it to a recipient's phone number.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateConfigurationSetEventDestination",
                "description": "Update an event destination in a configuration set. An event destination is a location that you publish information about your voice calls to. For example, you can log an event to an Amazon CloudWatch destination when a call fails.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Snowball",
        "prefix": "snowball",
        "privileges": [
            {
                "privilege": "CancelCluster",
                "description": "Cancels a cluster job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelJob",
                "description": "Cancels the specified job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAddress",
                "description": "Creates an address for a Snowball to be shipped to.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCluster",
                "description": "Creates an empty cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateJob",
                "description": "Creates a job to import or export data between Amazon S3 and your on-premises data center.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAddress",
                "description": "Takes an AddressId and returns specific details about that address in the form of an Address object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAddresses",
                "description": "Returns a specified number of ADDRESS objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCluster",
                "description": "Returns information about a specific cluster including shipping information, cluster status, and other important metadata.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeJob",
                "description": "Returns information about a specific job including shipping information, job status, and other important metadata.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobManifest",
                "description": "Returns a link to an Amazon S3 presigned URL for the manifest file associated with the specified JobId value.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJobUnlockCode",
                "description": "Returns the UnlockCode code value for the specified job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSnowballUsage",
                "description": "Returns information about the Snowball service limit for your account, and also the number of Snowballs your account has in use.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusterJobs",
                "description": "Returns an array of JobListEntry objects of the specified length.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClusters",
                "description": "Returns an array of ClusterListEntry objects of the specified length.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListJobs",
                "description": "Returns an array of JobListEntry objects of the specified length.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCluster",
                "description": "While a cluster's ClusterState value is in the AwaitingQuorum state, you can update some of the information associated with a cluster.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateJob",
                "description": "While a job's JobState value is New, you can update some of the information associated with a job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon SNS",
        "prefix": "sns",
        "privileges": [
            {
                "privilege": "AddPermission",
                "description": "Adds a statement to a topic's access control policy, granting access for the specified AWS accounts to the specified actions.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CheckIfPhoneNumberIsOptedOut",
                "description": "Accepts a phone number and indicates whether the phone holder has opted out of receiving SMS messages from your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ConfirmSubscription",
                "description": "Verifies an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlatformApplication",
                "description": "Creates a platform application object for one of the supported push notification services, such as APNS and GCM, to which devices and mobile apps may register.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePlatformEndpoint",
                "description": "Creates an endpoint for a device and mobile app on one of the supported push notification services, such as GCM and APNS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTopic",
                "description": "Creates a topic to which notifications can be published.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteEndpoint",
                "description": "Deletes the endpoint for a device and mobile app from Amazon SNS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePlatformApplication",
                "description": "Deletes a platform application object for one of the supported push notification services, such as APNS and GCM.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTopic",
                "description": "Deletes a topic and all its subscriptions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEndpointAttributes",
                "description": "Retrieves the endpoint attributes for a device on one of the supported push notification services, such as GCM and APNS.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPlatformApplicationAttributes",
                "description": "Retrieves the attributes of the platform application object for the supported push notification services, such as APNS and GCM.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSMSAttributes",
                "description": "Returns the settings for sending SMS messages from your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSubscriptionAttributes",
                "description": "Returns all of the properties of a subscription.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTopicAttributes",
                "description": "Returns all of the properties of a topic. Topic properties returned might differ based on the authorization of the user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListEndpointsByPlatformApplication",
                "description": "Lists the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM and APNS.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPhoneNumbersOptedOut",
                "description": "Returns a list of phone numbers that are opted out, meaning you cannot send SMS messages to them.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPlatformApplications",
                "description": "Lists the platform application objects for the supported push notification services, such as APNS and GCM.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscriptions",
                "description": "Returns a list of the requester's subscriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscriptionsByTopic",
                "description": "Returns a list of the subscriptions to a specific topic.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "List all tags added to the specified Amazon SNS topic.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "topic",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTopics",
                "description": "Returns a list of the requester's topics. Each call returns a limited list of topics, up to 100.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OptInPhoneNumber",
                "description": "Opts in a phone number that is currently opted out, which enables you to resume sending SMS messages to the number.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Publish",
                "description": "Sends a message to all of a topic's subscribed endpoints.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemovePermission",
                "description": "Removes a statement from a topic's access control policy.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetEndpointAttributes",
                "description": "Sets the attributes for an endpoint for a device on one of the supported push notification services, such as GCM and APNS.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetPlatformApplicationAttributes",
                "description": "Sets the attributes of the platform application object for the supported push notification services, such as APNS and GCM.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetSubscriptionAttributes",
                "description": "Allows a subscription owner to set an attribute of the topic to a new value.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetTopicAttributes",
                "description": "Allows a topic owner to set an attribute of the topic to a new value.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Subscribe",
                "description": "Prepares to subscribe an endpoint by sending the endpoint a confirmation message.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "topic*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "sns:Endpoint",
                            "sns:Protocol"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Add tags to the specified Amazon SNS topic.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "topic",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "Unsubscribe",
                "description": "Deletes a subscription. If the subscription requires authentication for deletion, only the owner of the subscription or the topic's owner can unsubscribe, and an AWS signature is required.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Remove tags from the specified Amazon SNS topic.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "topic",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "topic",
                "arn": "arn:${Partition}:sns:${Region}:${Account}:${TopicName}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Tags from request",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Tag keys from request",
                "type": "String"
            },
            {
                "condition": "sns:Endpoint",
                "description": "The URL, email address, or ARN from a Subscribe request or a previously confirmed subscription.",
                "type": "String"
            },
            {
                "condition": "sns:Protocol",
                "description": "The protocol value from a Subscribe request or a previously confirmed subscription.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon SQS",
        "prefix": "sqs",
        "privileges": [
            {
                "privilege": "AddPermission",
                "description": "Adds a permission to a queue for a specific principal.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ChangeMessageVisibility",
                "description": "Changes the visibility timeout of a specified message in a queue to a new value.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ChangeMessageVisibilityBatch",
                "description": "Changes the visibility timeout of multiple messages.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateQueue",
                "description": "Creates a new queue, or returns the URL of an existing one.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMessage",
                "description": "Deletes the specified message from the specified queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMessageBatch",
                "description": "Deletes up to ten messages from the specified queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteQueue",
                "description": "Deletes the queue specified by the queue URL, regardless of whether the queue is empty.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueueAttributes",
                "description": "Gets attributes for the specified queue.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetQueueUrl",
                "description": "Returns the URL of an existing queue.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDeadLetterSourceQueues",
                "description": "Returns a list of your queues that have the RedrivePolicy queue attribute configured with a dead letter queue.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQueueTags",
                "description": "Lists tags added to an SQS queue.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListQueues",
                "description": "Returns a list of your queues.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PurgeQueue",
                "description": "Deletes the messages in a queue specified by the queue URL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ReceiveMessage",
                "description": "Retrieves one or more messages, with a maximum limit of 10 messages, from the specified queue.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemovePermission",
                "description": "Revokes any permissions in the queue policy that matches the specified Label parameter.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendMessage",
                "description": "Delivers a message to the specified queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendMessageBatch",
                "description": "Delivers up to ten messages to the specified queue.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetQueueAttributes",
                "description": "Sets the value of one or more queue attributes.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagQueue",
                "description": "Add tags to the specified SQS queue.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagQueue",
                "description": "Remove tags from the specified SQS queue.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "queue*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "queue",
                "arn": "arn:${Partition}:sqs:${Region}:${Account}:${QueueName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Systems Manager",
        "prefix": "ssm",
        "privileges": [
            {
                "privilege": "AddTagsToResource",
                "description": "Grants permission to add or overwrite one or more tags for a specified AWS resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "document",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "maintenancewindow",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "managed-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "parameter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "patchbaseline",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelCommand",
                "description": "Grants permission to cancel a specified Run Command command",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelMaintenanceWindowExecution",
                "description": "Grants permission to cancel an in-progress maintenance window execution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateActivation",
                "description": "Grants permission to create an activation that is used to register on-premises servers and virtual machines (VMs) with Systems Manager",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAssociation",
                "description": "Grants permission to associate a specified Systems Manager document with specified instances or other targets",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAssociationBatch",
                "description": "Grants permission to combine entries for multiple CreateAssociation operations in a single command",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDocument",
                "description": "Grants permission to create a Systems Manager SSM document",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateMaintenanceWindow",
                "description": "Grants permission to create a maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOpsItem",
                "description": "Grants permission to create an OpsItem in OpsCenter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePatchBaseline",
                "description": "Grants permission to create a patch baseline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResourceDataSync",
                "description": "Grants permission to create a resource data sync configuration, which regularly collects inventory data from managed instances and updates the data in an Amazon S3 bucket",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resourcedatasync*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ssm:SyncType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteActivation",
                "description": "Grants permission to delete a specified activation for managed instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAssociation",
                "description": "Grants permission to disassociate a specified SSM document from a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDocument",
                "description": "Grants permission to delete a specified SSM document and its instance associations",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInventory",
                "description": "Grants permission to delete a specified custom inventory type, or the data associated with a custom inventory type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMaintenanceWindow",
                "description": "Grants permission to delete a specified maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteParameter",
                "description": "Grants permission to delete a specified SSM parameter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteParameters",
                "description": "Grants permission to delete multiple specified SSM parameters",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePatchBaseline",
                "description": "Grants permission to delete a specified patch baseline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResourceDataSync",
                "description": "Grants permission to delete a specified resource data sync",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resourcedatasync*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ssm:SyncType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterManagedInstance",
                "description": "Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "managed-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterPatchBaselineForPatchGroup",
                "description": "Grants permission to deregister a specified patch baseline from being the default patch baseline for a specified patch group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTargetFromMaintenanceWindow",
                "description": "Grants permission to deregister a specified target from a maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterTaskFromMaintenanceWindow",
                "description": "Grants permission to deregister a specified task from a maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeActivations",
                "description": "Grants permission to view details about a specified managed instance activation, such as when it was created and the number of instances registered using the activation",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssociation",
                "description": "Grants permission to view details about the specified association for a specified instance or target",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssociationExecutionTargets",
                "description": "Grants permission to view information about a specified association execution",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAssociationExecutions",
                "description": "Grants permission to view all executions for a specified association",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAutomationExecutions",
                "description": "Grants permission to view details about all active and terminated Automation executions",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAutomationStepExecutions",
                "description": "Grants permission to view information about all active and terminated step executions in an Automation workflow",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAvailablePatches",
                "description": "Grants permission to view all patches eligible to include in a patch baseline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDocument",
                "description": "Grants permission to view details about a specified SSM document",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDocumentParameters",
                "description": "Grants permission to display information about SSM document parameters in the Systems Manager console (internal Systems Manager action)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDocumentPermission",
                "description": "Grants permission to view the permissions for a specified SSM document",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEffectiveInstanceAssociations",
                "description": "Grants permission to view all current associations for a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeEffectivePatchesForPatchBaseline",
                "description": "Grants permission to view details about the patches currently associated with the specified patch baseline (Windows only)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceAssociationsStatus",
                "description": "Grants permission to view the status of the associations for a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceInformation",
                "description": "Grants permission to view details about a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstancePatchStates",
                "description": "Grants permission to view status details about patches on a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstancePatchStatesForPatchGroup",
                "description": "Grants permission to describe the high-level patch state for the instances in the specified patch group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstancePatches",
                "description": "Grants permission to view general details about the patches on a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstanceProperties",
                "description": "Grants permission to user's Amazon EC2 console to render managed instances' nodes",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInventoryDeletions",
                "description": "Grants permission to view details about a specified inventory deletion",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowExecutionTaskInvocations",
                "description": "Grants permission to view details of a specified task execution for a maintenance window",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowExecutionTasks",
                "description": "Grants permission to view details about the tasks that ran during a specified maintenance window execution",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowExecutions",
                "description": "Grants permission to view the executions of a specified maintenance window",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowSchedule",
                "description": "Grants permission to view details about upcoming executions of a specified maintenance window",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowTargets",
                "description": "Grants permission to view a list of the targets associated with a specified maintenance window",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowTasks",
                "description": "Grants permission to view a list of the tasks associated with a specified maintenance window",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindows",
                "description": "Grants permission to view information about all or specified maintenance windows",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceWindowsForTarget",
                "description": "Grants permission to view information about the maintenance window targets and tasks associated with a specified instance",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOpsItems",
                "description": "Grants permission to view details about specified OpsItems",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeParameters",
                "description": "Grants permission to view details about a specified SSM parameter",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePatchBaselines",
                "description": "Grants permission to view information about patch baselines that meet the specified criteria",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePatchGroupState",
                "description": "Grants permission to view aggregated status details for patches for a specified patch group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePatchGroups",
                "description": "Grants permission to view information about the patch baseline for a specified patch group",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePatchProperties",
                "description": "Grants permission to view details of available patches for a specified operating system and patch property",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSessions",
                "description": "Grants permission to view a list of recent Session Manager sessions that meet the specified search criteria",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAutomationExecution",
                "description": "Grants permission to view details of a specified Automation execution",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCommandInvocation",
                "description": "Grants permission to view details about the command execution of a specified invocation or plugin",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetConnectionStatus",
                "description": "Grants permission to view the Session Manager connection status for a specified managed instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDefaultPatchBaseline",
                "description": "Grants permission to view the current default patch baseline for a specified operating system type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDeployablePatchSnapshotForInstance",
                "description": "Grants permission to retrieve the current patch baseline snapshot for a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDocument",
                "description": "Grants permission to view the contents of a specified SSM document",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInventory",
                "description": "Grants permission to view instance inventory details per the specified criteria",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetInventorySchema",
                "description": "Grants permission to view a list of inventory types or attribute names for a specified inventory item type",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMaintenanceWindow",
                "description": "Grants permission to view details about a specified maintenance window",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMaintenanceWindowExecution",
                "description": "Grants permission to view details about a specified maintenance window execution",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMaintenanceWindowExecutionTask",
                "description": "Grants permission to view details about a specified maintenance window execution task",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMaintenanceWindowExecutionTaskInvocation",
                "description": "Grants permission to view details about a specific maintenance window task running on a specific target",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMaintenanceWindowTask",
                "description": "Grants permission to view details about tasks registered with a specified maintenance window",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetManifest",
                "description": "Used by Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call)",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOpsItem",
                "description": "Grants permission to view information about a specified OpsItem",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetOpsSummary",
                "description": "Grants permission to view summary information about OpsItems based on specified filters and aggregators",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "resourcedatasync*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetParameter",
                "description": "Grants permission to view information about a specified parameter",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetParameterHistory",
                "description": "Grants permission to view details and changes for a specified parameter",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetParameters",
                "description": "Grants permission to view information about multiple specified parameters",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetParametersByPath",
                "description": "Grants permission to view information about parameters in a specified hierarchy",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPatchBaseline",
                "description": "Grants permission to view information about a specified patch baseline",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPatchBaselineForPatchGroup",
                "description": "Grants permission to view the ID of the current patch baseline for a specified patch group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceSetting",
                "description": "Grants permission to view the account-level setting for an AWS service",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "servicesetting*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "LabelParameterVersion",
                "description": "Grants permission to apply an identifying label to a specified version of a parameter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociationVersions",
                "description": "Grants permission to list versions of the specified association",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAssociations",
                "description": "Grants permission to list the associations for a specified SSM document or managed instance",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCommandInvocations",
                "description": "Grants permission to list information about command invocations sent to a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListCommands",
                "description": "Grants permission to list the commands sent to a specified instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListComplianceItems",
                "description": "Grants permission to list compliance status for specified resource types on a specified resource",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListComplianceSummaries",
                "description": "Grants permission to list a summary count of compliant and noncompliant resources for a specified compliance type",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDocumentVersions",
                "description": "Grants permission to list all versions of a specified document",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDocuments",
                "description": "Grants permission to view information about a specified SSM document",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInstanceAssociations",
                "description": "Used by SSM Agent to check for new State Manager associations (internal Systems Manager call)",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInventoryEntries",
                "description": "Grants permission to view a list of specified inventory types for a specified instance",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceComplianceSummaries",
                "description": "Grants permission to list resource-level summary count",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceDataSync",
                "description": "Grants permission to list information about resource data sync configurations in an account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ssm:SyncType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to view a list of resource tags for a specified resource",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "document",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "maintenancewindow",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "managed-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "parameter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "patchbaseline",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyDocumentPermission",
                "description": "Grants permission to share a custom SSM document publicly or privately with specified AWS accounts",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutComplianceItems",
                "description": "Grants permission to register a compliance type and other compliance details on a specified resource",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutConfigurePackageResult",
                "description": "Used by SSM Agent to generate a report of the results of specific agent requests (internal Systems Manager call)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutInventory",
                "description": "Grants permission to add or update inventory items on multiple specified managed instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutParameter",
                "description": "Grants permission to create an SSM parameter",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "parameter*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDefaultPatchBaseline",
                "description": "Grants permission to specify the default patch baseline for an operating system type",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterPatchBaselineForPatchGroup",
                "description": "Grants permission to specify the default patch baseline for a specified patch group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTargetWithMaintenanceWindow",
                "description": "Grants permission to register a target with a specified maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterTaskWithMaintenanceWindow",
                "description": "Grants permission to register a task with a specified maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "Grants permission to remove a specified tag key from a specified resource",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "document",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "maintenancewindow",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "managed-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "parameter",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "patchbaseline",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetServiceSetting",
                "description": "Grants permission to reset the service setting for an AWS account to the default value",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "servicesetting*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResumeSession",
                "description": "Grants permission to reconnect a Session Manager session to a managed instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendAutomationSignal",
                "description": "Grants permission to send a signal to change the current behavior or status of a specified Automation execution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendCommand",
                "description": "Grants permission to run commands on one or more specified managed instances",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "managed-instance",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}",
                            "ssm:resourceTag/tag-key"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartAssociationsOnce",
                "description": "Grants permission to run a specified association manually",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartAutomationExecution",
                "description": "Grants permission to initiate the execution of an Automation document",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSession",
                "description": "Grants permission to initiate a connection to a specified target for a Session Manager session",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "document",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ssm:SessionDocumentAccessCheck"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopAutomationExecution",
                "description": "Grants permission to stop a specified Automation execution that is already in progress",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateSession",
                "description": "Grants permission to permanently end a Session Manager connection to an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "session*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssociation",
                "description": "Grants permission to update an association and immediately run the association on the specified targets",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAssociationStatus",
                "description": "Grants permission to update the status of the SSM document associated with a specified instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "document",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDocument",
                "description": "Grants permission to update one or more values for an SSM document",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDocumentDefaultVersion",
                "description": "Grants permission to change the default version of an SSM document",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInstanceAssociationStatus",
                "description": "Used by SSM Agent to update the status of the association that it is currently running (internal Systems Manager call)",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInstanceInformation",
                "description": "Used by SSM Agent to send a heartbeat signal to the Systems Manager service in the cloud",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMaintenanceWindow",
                "description": "Grants permission to update a specified maintenance window",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMaintenanceWindowTarget",
                "description": "Grants permission to update a specified maintenance window target",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMaintenanceWindowTask",
                "description": "Grants permission to update a specified maintenance window task",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "maintenancewindow*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateManagedInstanceRole",
                "description": "Grants permission to assign or change the IAM role assigned to a specified managed instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "managed-instance*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateOpsItem",
                "description": "Grants permission to edit or change an OpsItem",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePatchBaseline",
                "description": "Grants permission to update a specified patch baseline",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "patchbaseline*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResourceDataSync",
                "description": "Grants permission to update a resource data sync",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "resourcedatasync*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "ssm:SyncType"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServiceSetting",
                "description": "Grants permission to update the service setting for an AWS account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "servicesetting*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "association",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:association/${AssociationId}",
                "condition_keys": []
            },
            {
                "resource": "automation-execution",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:automation-execution/${AutomationExecutionId}",
                "condition_keys": []
            },
            {
                "resource": "automation-definition",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:automation-definition/${AutomationDefinitionName:VersionId}",
                "condition_keys": []
            },
            {
                "resource": "document",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:document/${DocumentName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ssm:resourceTag/tag-key"
                ]
            },
            {
                "resource": "instance",
                "arn": "arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ssm:resourceTag/tag-key"
                ]
            },
            {
                "resource": "maintenancewindow",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:maintenancewindow/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ssm:resourceTag/tag-key"
                ]
            },
            {
                "resource": "managed-instance",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:managed-instance/${ManagedInstanceName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ssm:resourceTag/tag-key"
                ]
            },
            {
                "resource": "managed-instance-inventory",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:managed-instance-inventory/${InstanceId}",
                "condition_keys": []
            },
            {
                "resource": "opsitem",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:opsitem/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "parameter",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:parameter/${FullyQualifiedParameterName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ssm:resourceTag/tag-key"
                ]
            },
            {
                "resource": "patchbaseline",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:patchbaseline/${PatchBaselineIdResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}",
                    "ssm:resourceTag/tag-key"
                ]
            },
            {
                "resource": "session",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:session/${SessionId}",
                "condition_keys": []
            },
            {
                "resource": "resourcedatasync",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:resource-data-sync/${SyncName}",
                "condition_keys": []
            },
            {
                "resource": "servicesetting",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:servicesetting/${ResourceId}",
                "condition_keys": []
            },
            {
                "resource": "windowtarget",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:windowtarget/${WindowTargetId}",
                "condition_keys": []
            },
            {
                "resource": "windowtask",
                "arn": "arn:${Partition}:ssm:${Region}:${Account}:windowtask/${WindowTaskId}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters 'Create' requests based on the allowed set of values for a specified tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters access based on a tag key-value pair assigned to the AWS resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters 'Create' requests based on whether mandatory tags are included in the request",
                "type": "String"
            },
            {
                "condition": "ssm:Overwrite",
                "description": "Filters access by controlling whether the values for specified resources can be overwritten.",
                "type": "String"
            },
            {
                "condition": "ssm:Recursive",
                "description": "Filters access for resources created in a hierarchical structure.",
                "type": "String"
            },
            {
                "condition": "ssm:SessionDocumentAccessCheck",
                "description": "Filters access by verifying that a user also has access to the default Session Manager configuration document.",
                "type": "Boolean"
            },
            {
                "condition": "ssm:SyncType",
                "description": "Filters access by verifying that a user also has access to the ResourceDataSync SyncType specified in the request",
                "type": "String"
            },
            {
                "condition": "ssm:resourceTag/tag-key",
                "description": "Filters access based on a tag key-value pair assigned to the Systems Manager resource",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Session Manager Message Gateway Service",
        "prefix": "ssmmessages",
        "privileges": [
            {
                "privilege": "CreateControlChannel",
                "description": "Registers a control channel for an instance to send control messages to Systems Manager service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateDataChannel",
                "description": "Registers a data channel for an instance to send data messages to Systems Manager service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OpenControlChannel",
                "description": "Opens a websocket connection for a registered control channel stream from an instance to Systems Manager service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "OpenDataChannel",
                "description": "Opens a websocket connection for a registered data channel stream from an instance to Systems Manager service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS SSO",
        "prefix": "sso",
        "privileges": [
            {
                "privilege": "AssociateDirectory",
                "description": "Connect a directory to be used by AWS Single Sign-On",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateProfile",
                "description": "Create an association between a directory user or group and a profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplicationInstance",
                "description": "Add an application instance to AWS Single Sign-On",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateApplicationInstanceCertificate",
                "description": "Add a new certificate for an application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateManagedApplicationInstance",
                "description": "Add a managed application instance to AWS Single Sign-On",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreatePermissionSet",
                "description": "Create a permission set",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProfile",
                "description": "Create a profile for an application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTrust",
                "description": "Create a federation trust in a target account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationInstance",
                "description": "Delete the application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteApplicationInstanceCertificate",
                "description": "Delete an inactive or expired certificate from the application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteManagedApplicationInstance",
                "description": "Delete the managed application instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePermissionSet",
                "description": "Delete a permission set",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePermissionsPolicy",
                "description": "Delete the permission policy associated with a permission set",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProfile",
                "description": "Delete the profile for an application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribePermissionsPolicies",
                "description": "Retrieve all the permissions policies associated with a permission set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDirectory",
                "description": "Disassociate a directory to be used by AWS Single Sign-On",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateProfile",
                "description": "Disassociate a directory user or group from a profile",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplicationInstance",
                "description": "Retrieve details for an application instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetApplicationTemplate",
                "description": "Retrieve application template details",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetManagedApplicationInstance",
                "description": "Retrieve details for an application instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMfaDeviceManagementForDirectory",
                "description": "Retrieve Mfa Device Management settings for the directory",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPermissionSet",
                "description": "Retrieve details of a permission set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPermissionsPolicy",
                "description": "Retrieve all permission policies associated with a permission set",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sso:DescribePermissionsPolicies"
                        ]
                    }
                ]
            },
            {
                "privilege": "GetProfile",
                "description": "Retrieve a profile for an application instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSSOStatus",
                "description": "Check if AWS Single Sign-On is enabled",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSharedSsoConfiguration",
                "description": "Retrieve shared configuration for the current SSO instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSsoConfiguration",
                "description": "Retrieve configuration for the current SSO instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTrust",
                "description": "Retrieve the federation trust in a target account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportApplicationInstanceServiceProviderMetadata",
                "description": "Update the application instance by uploading an application SAML metadata file provided by the service provider",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplicationInstanceCertificates",
                "description": "Retrieve all of the certificates for a given application instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListApplicationInstances",
                "description": "Retrieve all application instances",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sso:GetApplicationInstance"
                        ]
                    }
                ]
            },
            {
                "privilege": "ListApplicationTemplates",
                "description": "Retrieve all supported application templates",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sso:GetApplicationTemplate"
                        ]
                    }
                ]
            },
            {
                "privilege": "ListApplications",
                "description": "Retrieve all supported applications",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDirectoryAssociations",
                "description": "Retrieve details about the directory connected to AWS Single Sign-On",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListPermissionSets",
                "description": "Retrieve all permission sets",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProfileAssociations",
                "description": "Retrieve the directory user or group associated with the profile",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProfiles",
                "description": "Retrieve all profiles for an application instance",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "sso:GetProfile"
                        ]
                    }
                ]
            },
            {
                "privilege": "PutMfaDeviceManagementForDirectory",
                "description": "Put Mfa Device Management settings for the directory",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutPermissionsPolicy",
                "description": "Add a policy to a permission set",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartSSO",
                "description": "Initialize AWS Single Sign-On",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceActiveCertificate",
                "description": "Set a certificate as the active one for this application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceDisplayData",
                "description": "Update display data of an application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceResponseConfiguration",
                "description": "Update federation response configuration for the application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceResponseSchemaConfiguration",
                "description": "Update federation response schema configuration for the application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceSecurityConfiguration",
                "description": "Update security details for the application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceServiceProviderConfiguration",
                "description": "Update service provider related configuration for the application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateApplicationInstanceStatus",
                "description": "Update the status of an application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDirectoryAssociation",
                "description": "Update the user attribute mappings for your connected directory",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateManagedApplicationInstanceStatus",
                "description": "Update the status of a managed application instance",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePermissionSet",
                "description": "Update the permission set.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateProfile",
                "description": "Update the profile for an application instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSSOConfiguration",
                "description": "Update the configuration for the current SSO instance",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateTrust",
                "description": "Update the federation trust in a target account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS SSO Directory",
        "prefix": "sso-directory",
        "privileges": [
            {
                "privilege": "AddMemberToGroup",
                "description": "Adds member to the group in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteVirtualMfaDeviceRegistration",
                "description": "Completes the creation process of a virtual MFA device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAlias",
                "description": "Creates an alias for the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateBearerToken",
                "description": "Creates a bearer token for a given provisioning tenant.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateExternalIdPConfigurationForDirectory",
                "description": "Create an External Identity Provider configuration for the directory",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Creates a group in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateProvisioningTenant",
                "description": "Creates a provisioning tenant for a given directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Creates a user in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBearerToken",
                "description": "Deletes the bearer token.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteExternalIdPConfigurationForDirectory",
                "description": "Delete an External Identity Provider configuration associated with the directory",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Deletes a group from the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMfaDeviceForUser",
                "description": "Deletes a MFA device by device name for a given user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteProvisioningTenant",
                "description": "Deletes the provisioning tenant.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Deletes a user from the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectory",
                "description": "Retrieve information about the directory that AWS SSO provides by default",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGroups",
                "description": "Retrieves information about group from the directory that AWS SSO provides by default",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUsers",
                "description": "Retrieves information about user from the directory that AWS SSO provides by default",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableExternalIdPConfigurationForDirectory",
                "description": "Disable authentication of end users with an External Identity Provider",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableUser",
                "description": "Deactivates user in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableExternalIdPConfigurationForDirectory",
                "description": "Enable authentication of end users with an External Identity Provider",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableUser",
                "description": "Activates user in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAWSSPConfigurationForDirectory",
                "description": "Retrieve the AWS SSO Service Provider configurations for the directory",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListBearerTokens",
                "description": "Lists bearer tokens for a given provisioning tenant.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListExternalIdPConfigurationsForDirectory",
                "description": "List all the External Identity Provider configurations created for the directory",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupsForUser",
                "description": "Lists groups for a user from the directory that AWS SSO provides by default",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMembersInGroup",
                "description": "Retrieves all members that are part of the group in the directory that AWS SSO provides by default",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMfaDevicesForUser",
                "description": "Lists all active MFA devices and their MFA device metadata for a user",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListProvisioningTenants",
                "description": "Lists provisioning tenants for a given directory.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveMemberFromGroup",
                "description": "Removes member that are part of the group in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchGroups",
                "description": "Search for groups within the associated directory",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchUsers",
                "description": "Search for users within the associated directory",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartVirtualMfaDeviceRegistration",
                "description": "Begins the creation process of virtual mfa device",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateExternalIdPConfigurationForDirectory",
                "description": "Update an External Identity Provider configuration associated with the directory",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Updates information about group in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePassword",
                "description": "Updates password by sending password reset link via email or generating one time password for a user in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Updates user information in the directory that AWS SSO provides by default",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "VerifyEmail",
                "description": "Verify email address of an User",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Step Functions",
        "prefix": "states",
        "privileges": [
            {
                "privilege": "CreateActivity",
                "description": "Creates an activity. Activities must poll Step Functions using the GetActivityTask and respond using SendTask* API calls.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "activity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStateMachine",
                "description": "Creates a state machine.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "statemachine*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteActivity",
                "description": "Deletes an activity.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "activity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteStateMachine",
                "description": "Deletes a state machine.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "statemachine*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeActivity",
                "description": "Describes an activity.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "activity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeExecution",
                "description": "Describes an execution.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "execution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStateMachine",
                "description": "Describes a state machine.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "statemachine*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStateMachineForExecution",
                "description": "Describes state machine for an execution.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "execution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetActivityTask",
                "description": "Used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "activity*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetExecutionHistory",
                "description": "Returns the history of the specified execution as a list of events. By default, the results are returned in ascending order of the timeStamp of the events.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "execution*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActivities",
                "description": "Lists the existing activities. The results may be split into multiple pages.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListExecutions",
                "description": "Lists the executions of a state machine that meet the filtering criteria. The results may be split into multiple pages.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "statemachine*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListStateMachines",
                "description": "Lists the existing state machines. The results may be split into multiple pages.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This action lists tags for an AWS Step Functions resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "activity",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "statemachine",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendTaskFailure",
                "description": "Used by workers to report that the task identified by the taskToken failed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendTaskHeartbeat",
                "description": "Used by workers to report to the service that the task represented by the specified taskToken is still making progress.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SendTaskSuccess",
                "description": "Used by workers to report that the task identified by the taskToken completed successfully.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartExecution",
                "description": "Starts a state machine execution.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "statemachine*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopExecution",
                "description": "Stops an execution.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an AWS Step Functions resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "activity",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "statemachine",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from an AWS Step Functions resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "activity",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "statemachine",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateStateMachine",
                "description": "Updates a state machine.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "statemachine*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "activity",
                "arn": "arn:${Partition}:states:${Region}:${Account}:activity:${ActivityName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "execution",
                "arn": "arn:${Partition}:states:${Region}:${Account}:execution:${StateMachineName}:${ExecutionId}",
                "condition_keys": []
            },
            {
                "resource": "statemachine",
                "arn": "arn:${Partition}:states:${Region}:${Account}:stateMachine:${StateMachineName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Tag for request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Tag for resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Tag for key",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Storage Gateway",
        "prefix": "storagegateway",
        "privileges": [
            {
                "privilege": "ActivateGateway",
                "description": "This operation activates the gateway you previously deployed on your host.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddCache",
                "description": "This operation configures one or more gateway local disks as cache for a cached-volume gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddTagsToResource",
                "description": "This operation adds one or more tags to the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "share",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddUploadBuffer",
                "description": "This operation configures one or more gateway local disks as upload buffer for a specified gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddWorkingStorage",
                "description": "This operation configures one or more gateway local disks as working storage for a gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AttachVolume",
                "description": "This operation connects a volume to an iSCSI connection and then attaches the volume to the specified gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelArchival",
                "description": "Cancels archiving of a virtual tape to the virtual tape shelf (VTS) after the archiving process is initiated.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelRetrieval",
                "description": "Cancels retrieval of a virtual tape from the virtual tape shelf (VTS) to a gateway after the retrieval process is initiated.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCachediSCSIVolume",
                "description": "This operation creates a cached volume on a specified cached gateway. This operation is supported only for the gateway-cached volume architecture.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNFSFileShare",
                "description": "This operation creates a NFS file share on an existing file gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSMBFileShare",
                "description": "This operation creates a SMB file share on an existing file gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSnapshot",
                "description": "This operation initiates a snapshot of a volume.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSnapshotFromVolumeRecoveryPoint",
                "description": "This operation initiates a snapshot of a gateway from a volume recovery point.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateStorediSCSIVolume",
                "description": "This operation creates a volume on a specified gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTapeWithBarcode",
                "description": "Creates a virtual tape by using your own barcode.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTapes",
                "description": "Creates one or more virtual tapes. You write data to the virtual tapes and then archive the tapes.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteBandwidthRateLimit",
                "description": "This operation deletes the bandwidth rate limits of a gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteChapCredentials",
                "description": "This operation deletes Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target and initiator pair.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "target*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFileShare",
                "description": "This operation deletes a file share from a file gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGateway",
                "description": "This operation deletes a gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSnapshotSchedule",
                "description": "This operation deletes a snapshot of a volume.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTape",
                "description": "Deletes the specified virtual tape.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTapeArchive",
                "description": "Deletes the specified virtual tape from the virtual tape shelf (VTS).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVolume",
                "description": "This operation deletes the specified gateway volume that you previously created using the CreateCachediSCSIVolume or CreateStorediSCSIVolume API.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeBandwidthRateLimit",
                "description": "This operation returns the bandwidth rate limits of a gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCache",
                "description": "This operation returns information about the cache of a gateway. This operation is supported only for the gateway-cached volume architecture.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCachediSCSIVolumes",
                "description": "This operation returns a description of the gateway volumes specified in the request. This operation is supported only for the gateway-cached volume architecture.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChapCredentials",
                "description": "This operation returns an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "target*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGatewayInformation",
                "description": "This operation returns metadata about a gateway such as its name, network interfaces, configured time zone, and the state (whether the gateway is running or not).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMaintenanceStartTime",
                "description": "This operation returns your gateway's weekly maintenance start time including the day and time of the week.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNFSFileShares",
                "description": "This operation gets a description for one or more file shares from a file gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSMBFileShares",
                "description": "This operation gets a description for one or more file shares from a file gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSMBSettings",
                "description": "This operation gets a description of a Server Message Block (SMB) file share settings from a file gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSnapshotSchedule",
                "description": "This operation describes the snapshot schedule for the specified gateway volume.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeStorediSCSIVolumes",
                "description": "This operation returns the description of the gateway volumes specified in the request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTapeArchives",
                "description": "Returns a description of specified virtual tapes in the virtual tape shelf (VTS).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTapeRecoveryPoints",
                "description": "Returns a list of virtual tape recovery points that are available for the specified gateway-VTL.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTapes",
                "description": "Returns a description of the specified Amazon Resource Name (ARN) of virtual tapes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUploadBuffer",
                "description": "This operation returns information about the upload buffer of a gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeVTLDevices",
                "description": "Returns a description of virtual tape library (VTL) devices for the specified gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkingStorage",
                "description": "This operation returns information about the working storage of a gateway.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DetachVolume",
                "description": "This operation disconnects a volume from an iSCSI connection and then detaches the volume from the specified gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableGateway",
                "description": "Disables a gateway when the gateway is no longer functioning.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "JoinDomain",
                "description": "This operation enables you to join an Active Directory Domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFileShares",
                "description": "This operation gets a list of the file shares for a specific file gateway, or the list of file shares that belong to the calling user account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGateways",
                "description": "This operation lists gateways owned by an AWS account in a region specified in the request. The returned list is ordered by gateway Amazon Resource Name (ARN).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLocalDisks",
                "description": "This operation returns a list of the gateway's local disks.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This operation lists the tags that have been added to the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "share",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTapes",
                "description": "Lists virtual tapes in your virtual tape library (VTL) and your virtual tape shelf (VTS).",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "tape*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVolumeInitiators",
                "description": "This operation lists iSCSI initiators that are connected to a volume.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVolumeRecoveryPoints",
                "description": "This operation lists the recovery points for a specified gateway.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVolumes",
                "description": "This operation lists the iSCSI stored volumes of a gateway.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "NotifyWhenUploaded",
                "description": "This action sends you a notification through CloudWatch Events when all files written to your NFS file share have been uploaded to Amazon S3.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RefreshCache",
                "description": "This operation refreshes the cache for the specified file share.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveTagsFromResource",
                "description": "This operation removes one or more tags from the specified resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "gateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "share",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "volume",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetCache",
                "description": "This operation resets all cache disks that have encountered a error and makes the disks available for reconfiguration as cache storage.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetrieveTapeArchive",
                "description": "Retrieves an archived virtual tape from the virtual tape shelf (VTS) to a gateway-VTL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RetrieveTapeRecoveryPoint",
                "description": "Retrieves the recovery point for the specified virtual tape.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "tape*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetLocalConsolePassword",
                "description": "Sets the password for your VM local console.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetSMBGuestPassword",
                "description": "Sets the password for SMB Guest user.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ShutdownGateway",
                "description": "This operation shuts down a gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartGateway",
                "description": "This operation starts a gateway that you previously shut down.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateBandwidthRateLimit",
                "description": "This operation updates the bandwidth rate limits of a gateway.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateChapCredentials",
                "description": "This operation updates the Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "target*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGatewayInformation",
                "description": "This operation updates a gateway's metadata, which includes the gateway's name and time zone.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGatewaySoftwareNow",
                "description": "This operation updates the gateway virtual machine (VM) software.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMaintenanceStartTime",
                "description": "This operation updates a gateway's weekly maintenance start time information, including day and time of the week. The maintenance time is the time in your gateway's time zone.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "gateway*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNFSFileShare",
                "description": "This operation updates a NFS file share.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSMBFileShare",
                "description": "This operation updates a SMB file share.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "share*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSnapshotSchedule",
                "description": "This operation updates a snapshot schedule configured for a gateway volume.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "volume*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateVTLDeviceType",
                "description": "This operation updates the type of medium changer in a gateway-VTL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "device*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "device",
                "arn": "arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}/device/${Vtldevice}",
                "condition_keys": []
            },
            {
                "resource": "gateway",
                "arn": "arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "share",
                "arn": "arn:${Partition}:storagegateway:${Region}:${Account}:share/${ShareId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "tape",
                "arn": "arn:${Partition}:storagegateway:${Region}:${Account}:tape/${TapeBarcode}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "target",
                "arn": "arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}/target/${IscsiTarget}",
                "condition_keys": []
            },
            {
                "resource": "volume",
                "arn": "arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}/volume/${VolumeId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters create requests based on the allowed set of values for each of the tags.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value associated with the resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters create requests based on the presence of mandatory tags in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS Security Token Service",
        "prefix": "sts",
        "privileges": [
            {
                "privilege": "AssumeRole",
                "description": "Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:PrincipalTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "sts:TransitiveTagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssumeRoleWithSAML",
                "description": "Returns a set of temporary security credentials for users who have been authenticated via a SAML authentication response",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "saml:namequalifier",
                            "saml:sub",
                            "saml:sub_type",
                            "saml:aud",
                            "saml:iss",
                            "saml:doc",
                            "saml:cn",
                            "saml:commonName",
                            "saml:eduorghomepageuri",
                            "saml:eduorgidentityauthnpolicyuri",
                            "saml:eduorglegalname",
                            "saml:eduorgsuperioruri",
                            "saml:eduorgwhitepagesuri",
                            "saml:edupersonaffiliation",
                            "saml:edupersonassurance",
                            "saml:edupersonentitlement",
                            "saml:edupersonnickname",
                            "saml:edupersonorgdn",
                            "saml:edupersonorgunitdn",
                            "saml:edupersonprimaryaffiliation",
                            "saml:edupersonprimaryorgunitdn",
                            "saml:edupersonprincipalname",
                            "saml:edupersonscopedaffiliation",
                            "saml:edupersontargetedid",
                            "saml:givenName",
                            "saml:mail",
                            "saml:name",
                            "saml:organizationStatus",
                            "saml:primaryGroupSID",
                            "saml:surname",
                            "saml:uid",
                            "saml:x500UniqueIdentifier",
                            "aws:TagKeys",
                            "aws:PrincipalTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "sts:TransitiveTagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssumeRoleWithWebIdentity",
                "description": "Returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "role*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "cognito-identity.amazonaws.com:amr",
                            "cognito-identity.amazonaws.com:aud",
                            "cognito-identity.amazonaws.com:sub",
                            "www.amazon.com:app_id",
                            "www.amazon.com:user_id",
                            "graph.facebook.com:app_id",
                            "graph.facebook.com:id",
                            "accounts.google.com:aud",
                            "accounts.google.com:oaud",
                            "accounts.google.com:sub",
                            "aws:TagKeys",
                            "aws:PrincipalTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "sts:TransitiveTagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DecodeAuthorizationMessage",
                "description": "Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccessKeyInfo",
                "description": "Returns details about the access key id passed as a parameter to the request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCallerIdentity",
                "description": "Returns details about the IAM identity whose credentials are used to call the API",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFederationToken",
                "description": "Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:PrincipalTag/${TagKey}",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSessionToken",
                "description": "Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for an AWS account or IAM user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagSession",
                "description": "Grants permission to add tags to a STS session",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "role",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:PrincipalTag/${TagKey}",
                            "aws:RequestTag/${TagKey}",
                            "sts:TransitiveTagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "role",
                "arn": "arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "user",
                "arn": "arn:${Partition}:iam::${Account}:user/${UserNameWithPath}",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "accounts.google.com:aud",
                "description": "Filters actions based on the Google application ID",
                "type": "String"
            },
            {
                "condition": "accounts.google.com:oaud",
                "description": "Filters actions based on the Google audience",
                "type": "String"
            },
            {
                "condition": "accounts.google.com:sub",
                "description": "Filters actions based on the subject of the claim (the Google user ID)",
                "type": "String"
            },
            {
                "condition": "aws:FederatedProvider",
                "description": "Filters actions based on the IdP that was used to authenticate the user",
                "type": "String"
            },
            {
                "condition": "aws:PrincipalTag/${TagKey}",
                "description": "Filters actions based on the tag associated with the principal that is making the request",
                "type": "String"
            },
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the tags that are passed in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on the tags associated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the tag keys that are passed in the request",
                "type": "String"
            },
            {
                "condition": "cognito-identity.amazonaws.com:amr",
                "description": "Filters actions based on the login information for Amazon Cognito",
                "type": "String"
            },
            {
                "condition": "cognito-identity.amazonaws.com:aud",
                "description": "Filters actions based on the Amazon Cognito identity pool ID",
                "type": "String"
            },
            {
                "condition": "cognito-identity.amazonaws.com:sub",
                "description": "Filters actions based on the subject of the claim (the Amazon Cognito user ID)",
                "type": "String"
            },
            {
                "condition": "graph.facebook.com:app_id",
                "description": "Filters actions based on the Facebook application ID",
                "type": "String"
            },
            {
                "condition": "graph.facebook.com:id",
                "description": "Filters actions based on the Facebook user ID",
                "type": "String"
            },
            {
                "condition": "saml:aud",
                "description": "Filters actions based on the endpoint URL to which SAML assertions are presented",
                "type": "String"
            },
            {
                "condition": "saml:cn",
                "description": "Filters actions based on the eduOrg attribute",
                "type": "String"
            },
            {
                "condition": "saml:commonName",
                "description": "Filters actions based on the commonName attribute",
                "type": "String"
            },
            {
                "condition": "saml:doc",
                "description": "Filters actions based on the principal that was used to assume the role",
                "type": "String"
            },
            {
                "condition": "saml:eduorghomepageuri",
                "description": "Filters actions based on the eduOrg attribute",
                "type": "String"
            },
            {
                "condition": "saml:eduorgidentityauthnpolicyuri",
                "description": "Filters actions based on the eduOrg attribute",
                "type": "String"
            },
            {
                "condition": "saml:eduorglegalname",
                "description": "Filters actions based on the eduOrg attribute",
                "type": "String"
            },
            {
                "condition": "saml:eduorgsuperioruri",
                "description": "Filters actions based on the eduOrg attribute",
                "type": "String"
            },
            {
                "condition": "saml:eduorgwhitepagesuri",
                "description": "Filters actions based on the eduOrg attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonaffiliation",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonassurance",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonentitlement",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonnickname",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonorgdn",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonorgunitdn",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonprimaryaffiliation",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonprimaryorgunitdn",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonprincipalname",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersonscopedaffiliation",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:edupersontargetedid",
                "description": "Filters actions based on the eduPerson attribute",
                "type": "String"
            },
            {
                "condition": "saml:givenName",
                "description": "Filters actions based on the givenName attribute",
                "type": "String"
            },
            {
                "condition": "saml:iss",
                "description": "Filters actions based on the issuer, which is represented by a URN",
                "type": "String"
            },
            {
                "condition": "saml:mail",
                "description": "Filters actions based on the mail attribute",
                "type": "String"
            },
            {
                "condition": "saml:name",
                "description": "Filters actions based on the name attribute",
                "type": "String"
            },
            {
                "condition": "saml:namequalifier",
                "description": "Filters actions based on the hash value of the issuer, account ID, and friendly name",
                "type": "String"
            },
            {
                "condition": "saml:organizationStatus",
                "description": "Filters actions based on the organizationStatus attribute",
                "type": "String"
            },
            {
                "condition": "saml:primaryGroupSID",
                "description": "Filters actions based on the primaryGroupSID attribute",
                "type": "String"
            },
            {
                "condition": "saml:sub",
                "description": "Filters actions based on the subject of the claim (the SAML user ID)",
                "type": "String"
            },
            {
                "condition": "saml:sub_type",
                "description": "Filters actions based on the value persistent, transient, or the full Format URI",
                "type": "String"
            },
            {
                "condition": "saml:surname",
                "description": "Filters actions based on the surname attribute",
                "type": "String"
            },
            {
                "condition": "saml:uid",
                "description": "Filters actions based on the uid attribute",
                "type": "String"
            },
            {
                "condition": "saml:x500UniqueIdentifier",
                "description": "Filters actions based on the uid attribute",
                "type": "String"
            },
            {
                "condition": "sts:ExternalId",
                "description": "Filters actions based on the unique identifier equired when you assume a role in another account",
                "type": "String"
            },
            {
                "condition": "sts:TransitiveTagKeys",
                "description": "Filters actions based on the transitive tag keys that are passed in the request",
                "type": "String"
            },
            {
                "condition": "www.amazon.com:app_id",
                "description": "Filters actions based on the Login with Amazon application ID",
                "type": "String"
            },
            {
                "condition": "www.amazon.com:user_id",
                "description": "Filters actions based on the Login with Amazon user ID",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Sumerian",
        "prefix": "sumerian",
        "privileges": [
            {
                "privilege": "Login",
                "description": "Grant login access to the Sumerian console.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ViewRelease",
                "description": "Grant access to view a project release.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "project*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "project",
                "arn": "arn:${Partition}:sumerian:${Region}:${Account}:project:${ProjectName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS Support",
        "prefix": "support",
        "privileges": [
            {
                "privilege": "AddAttachmentsToSet",
                "description": "Adds one or more attachments to an AWS Support case.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddCommunicationToCase",
                "description": "Adds a customer communication to an AWS Support case.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCase",
                "description": "Creates a new AWS Support case.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAttachment",
                "description": "Returns the description for an attachment.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCaseAttributes",
                "description": "This is an internally managed function which allows secondary services to read AWS Support case attributes.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCases",
                "description": "Returns a list of AWS Support cases that matches the given inputs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCommunications",
                "description": "Returns the communications and attachments for one or more AWS Support cases.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIssueTypes",
                "description": "Returns issue types for AWS Support cases.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServices",
                "description": "Returns the current list of AWS services and categories that applies to each service.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSeverityLevels",
                "description": "Returns the list of severity levels that can be assigned to an AWS Support case.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSupportLevel",
                "description": "Returns the support level for an AWS Account identifier.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrustedAdvisorCheckRefreshStatuses",
                "description": "Returns the status of a Trusted Advisor refresh check based on a list of check identifiers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrustedAdvisorCheckResult",
                "description": "Returns the results of the Trusted Advisor check that has the specified check identifier.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrustedAdvisorCheckSummaries",
                "description": "Returns the summaries of the results of the Trusted Advisor checks that have the specified check identifiers.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTrustedAdvisorChecks",
                "description": "Returns a list of all available Trusted Advisor checks, including name, identifier, category and description.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateCallForCase",
                "description": "This is an internally managed function to initiate a call on AWS Support Center.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateChatForCase",
                "description": "This is an internally managed function to initiate a chat on AWS Support Center.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutCaseAttributes",
                "description": "This is an internally managed function which allows secondary services to attach attributes to AWS Support cases.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RateCaseCommunication",
                "description": "Rate an AWS Support case communication.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RefreshTrustedAdvisorCheck",
                "description": "Requests a refresh of the Trusted Advisor check that has the specified check identifier.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResolveCase",
                "description": "Resolves an AWS Support case.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchForCases",
                "description": "Returns a list of AWS Support cases that matches the given inputs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Simple Workflow Service",
        "prefix": "swf",
        "privileges": [
            {
                "privilege": "CancelTimer",
                "description": "Description for CancelTimer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CancelWorkflowExecution",
                "description": "Description for CancelWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CompleteWorkflowExecution",
                "description": "Description for CompleteWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ContinueAsNewWorkflowExecution",
                "description": "Description for ContinueAsNewWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CountClosedWorkflowExecutions",
                "description": "Returns the number of closed workflow executions within the given domain that meet the specified filtering criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:tagFilter.tag",
                            "swf:typeFilter.name",
                            "swf:typeFilter.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CountOpenWorkflowExecutions",
                "description": "Returns the number of open workflow executions within the given domain that meet the specified filtering criteria.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:tagFilter.tag",
                            "swf:typeFilter.name",
                            "swf:typeFilter.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CountPendingActivityTasks",
                "description": "Returns the estimated number of activity tasks in the specified task list.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:taskList.name"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CountPendingDecisionTasks",
                "description": "Returns the estimated number of decision tasks in the specified task list.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:taskList.name"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprecateActivityType",
                "description": "Deprecates the specified activity type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:activityType.name",
                            "swf:activityType.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprecateDomain",
                "description": "Deprecates the specified domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeprecateWorkflowType",
                "description": "Deprecates the specified workflow type.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:workflowType.name",
                            "swf:workflowType.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeActivityType",
                "description": "Returns information about the specified activity type.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:activityType.name",
                            "swf:activityType.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDomain",
                "description": "Returns information about the specified domain, including description and status.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkflowExecution",
                "description": "Returns information about the specified workflow execution including its type and some statistics.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkflowType",
                "description": "Returns information about the specified workflow type.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:workflowType.name",
                            "swf:workflowType.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "FailWorkflowExecution",
                "description": "Description for FailWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkflowExecutionHistory",
                "description": "Returns the history of the specified workflow execution.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActivityTypes",
                "description": "Returns information about all activities registered in the specified domain that match the specified name and registration status.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListClosedWorkflowExecutions",
                "description": "Returns a list of closed workflow executions in the specified domain that meet the filtering criteria.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:tagFilter.tag",
                            "swf:typeFilter.name",
                            "swf:typeFilter.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomains",
                "description": "Returns the list of domains registered in the account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOpenWorkflowExecutions",
                "description": "Returns a list of open workflow executions in the specified domain that meet the filtering criteria.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:tagFilter.tag",
                            "swf:typeFilter.name",
                            "swf:typeFilter.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "This action lists tags for an AWS SWF resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkflowTypes",
                "description": "Returns information about workflow types in the specified domain.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PollForActivityTask",
                "description": "Used by workers to get an ActivityTask from the specified activity taskList.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:taskList.name"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PollForDecisionTask",
                "description": "Used by deciders to get a DecisionTask from the specified decision taskList.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:taskList.name"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RecordActivityTaskHeartbeat",
                "description": "Used by activity workers to report to the service that the ActivityTask represented by the specified taskToken is still making progress.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RecordMarker",
                "description": "Description for RecordMarker",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterActivityType",
                "description": "Registers a new activity type along with its configuration settings in the specified domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:defaultTaskList.name",
                            "swf:name",
                            "swf:version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDomain",
                "description": "Registers a new domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterWorkflowType",
                "description": "Registers a new workflow type and its configuration settings in the specified domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:defaultTaskList.name",
                            "swf:name",
                            "swf:version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestCancelActivityTask",
                "description": "Description for RequestCancelActivityTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestCancelExternalWorkflowExecution",
                "description": "Description for RequestCancelExternalWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RequestCancelWorkflowExecution",
                "description": "Records a WorkflowExecutionCancelRequested event in the currently running workflow execution identified by the given domain, workflowId, and runId.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RespondActivityTaskCanceled",
                "description": "Used by workers to tell the service that the ActivityTask identified by the taskToken was successfully canceled.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RespondActivityTaskCompleted",
                "description": "Used by workers to tell the service that the ActivityTask identified by the taskToken completed successfully with a result (if provided).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:activityType.name",
                            "swf:activityType.version",
                            "swf:tagList.member.0",
                            "swf:tagList.member.1",
                            "swf:tagList.member.2",
                            "swf:tagList.member.3",
                            "swf:tagList.member.4",
                            "swf:taskList.name",
                            "swf:workflowType.name",
                            "swf:workflowType.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RespondActivityTaskFailed",
                "description": "Used by workers to tell the service that the ActivityTask identified by the taskToken has failed with reason (if specified).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RespondDecisionTaskCompleted",
                "description": "Used by deciders to tell the service that the DecisionTask identified by the taskToken has successfully completed.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ScheduleActivityTask",
                "description": "Description for ScheduleActivityTask",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SignalExternalWorkflowExecution",
                "description": "Description for SignalExternalWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SignalWorkflowExecution",
                "description": "Records a WorkflowExecutionSignaled event in the workflow execution history and creates a decision task for the workflow execution identified by the given domain, workflowId and runId.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartChildWorkflowExecution",
                "description": "Description for StartChildWorkflowExecution",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTimer",
                "description": "Description for StartTimer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartWorkflowExecution",
                "description": "Starts an execution of the workflow type in the specified domain using the provided workflowId and input data.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "swf:tagList.member.0",
                            "swf:tagList.member.1",
                            "swf:tagList.member.2",
                            "swf:tagList.member.3",
                            "swf:tagList.member.4",
                            "swf:taskList.name",
                            "swf:workflowType.name",
                            "swf:workflowType.version"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "This action tags an AWS SWF resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateWorkflowExecution",
                "description": "Records a WorkflowExecutionTerminated event and forces closure of the workflow execution identified by the given domain, runId, and workflowId.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "domain*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "This action removes a tag from an AWS SWF resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "domain",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "domain",
                "arn": "arn:${Partition}:swf::${Account}:domain/${DomainName}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Tag for request.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Tag for resource.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Tag for key.",
                "type": "String"
            },
            {
                "condition": "swf:activityType.name",
                "description": "Constrains the policy statement to only an activity type of the specified name.",
                "type": "String"
            },
            {
                "condition": "swf:activityType.version",
                "description": "Contstrains the policy statement to only an activity type of the specified version.",
                "type": "String"
            },
            {
                "condition": "swf:defaultTaskList.name",
                "description": "Constrains the policy statement to only requests that specify a matching defaultTaskList name.",
                "type": "String"
            },
            {
                "condition": "swf:name",
                "description": "Constrains the policy statement to only activities or workflows with the specified name.",
                "type": "String"
            },
            {
                "condition": "swf:tagFilter.tag",
                "description": "Constrains the policy statement to only requests that specify a matching tagFilter.tag value.",
                "type": "String"
            },
            {
                "condition": "swf:tagList.member.0",
                "description": "Constrains the policy statement to only requests that contain the specified tag.",
                "type": "String"
            },
            {
                "condition": "swf:tagList.member.1",
                "description": "Constrains the policy statement to only requests that contain the specified tag.",
                "type": "String"
            },
            {
                "condition": "swf:tagList.member.2",
                "description": "Constrains the policy statement to only requests that contain the specified tag.",
                "type": "String"
            },
            {
                "condition": "swf:tagList.member.3",
                "description": "Constrains the policy statement to only requests that contain the specified tag.",
                "type": "String"
            },
            {
                "condition": "swf:tagList.member.4",
                "description": "Constrains the policy statement to only requests that contain the specified tag.",
                "type": "String"
            },
            {
                "condition": "swf:taskList.name",
                "description": "Constrains the policy statement to only requests that specify a tasklist with the specified name.",
                "type": "String"
            },
            {
                "condition": "swf:typeFilter.name",
                "description": "Constrains the policy statement to only requests that specify a type filter with the specified name.",
                "type": "String"
            },
            {
                "condition": "swf:typeFilter.version",
                "description": "Constrains the policy statement to only requests that specify a type filter with the specified version.",
                "type": "String"
            },
            {
                "condition": "swf:version",
                "description": "Constrains the policy statement to only activities or workflows with the specified version.",
                "type": "String"
            },
            {
                "condition": "swf:workflowType.name",
                "description": "Constrains the policy statement to only a workflow of the specified type.",
                "type": "String"
            },
            {
                "condition": "swf:workflowType.name",
                "description": "Constrains the policy statement to only requests that specify a workflow type of the specified name.",
                "type": "String"
            },
            {
                "condition": "swf:workflowType.version",
                "description": "Constrains the policy statement to only requests that specify a workflow type of the specified version.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon CloudWatch Synthetics",
        "prefix": "synthetics",
        "privileges": [
            {
                "privilege": "CreateCanary",
                "description": "Create a canary.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCanary",
                "description": "Deletes a canary. Amazon Synthetics deletes all the resources except for the Lambda function and the CloudWatch Alarms if you created one.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "canary*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCanaries",
                "description": "Returns information of all canaries or a canary.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "canary",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTestRuns",
                "description": "Returns information about all the test runs associated with a canary.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "canary",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Returns a list of all tags and values associated with a canary.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "canary",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartCanary",
                "description": "Starts a canary, so that Amazon Synthetics starts monitoring a website.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "canary*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopCanary",
                "description": "Stops a canary.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "canary*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds one or more tags to a canary.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "canary",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes one or more tags from a canary.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "canary",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCanary",
                "description": "Updates a canary.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "canary*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "canary",
                "arn": "arn:${Partition}:synthetics::${Account}:canary:${CanaryName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon Resource Group Tagging API",
        "prefix": "tag",
        "privileges": [
            {
                "privilege": "DescribeReportCreation",
                "description": "Describe the status of the StartReportCreation operation.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetComplianceSummary",
                "description": "Get a table that shows counts of resources that are noncompliant with their effective tag policies.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResources",
                "description": "Get tagged AWS resources that match the given tag filters",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTagKeys",
                "description": "Get all tagKeys for the account in the specific region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTagValues",
                "description": "Get all tagValues for the account in the specific region",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartReportCreation",
                "description": "Generate a report that lists all tagged resources in accounts across your organization, and whether each resource is compliant with the effective tag policy.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResources",
                "description": "Add tags to AWS resources",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResources",
                "description": "Remove tags from AWS resources",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Textract",
        "prefix": "textract",
        "privileges": [
            {
                "privilege": "AnalyzeDocument",
                "description": "Detects instances of real-world document entities within an image provided as input.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "DetectDocumentText",
                "description": "Detects text in document images.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "GetDocumentAnalysis",
                "description": "Returns information about a document analysis job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDocumentTextDetection",
                "description": "Returns information about a document text detection job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartDocumentAnalysis",
                "description": "Starts an asynchronous job to detect instances of real-world document entities within an image or pdf provided as input.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "StartDocumentTextDetection",
                "description": "Starts an asynchronous job to detect text in document images or pdfs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon Transcribe",
        "prefix": "transcribe",
        "privileges": [
            {
                "privilege": "CreateVocabulary",
                "description": "Creates a new custom vocabulary that you can use to change the way Amazon Transcribe handles transcription of an audio file.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "CreateVocabularyFilter",
                "description": "Creates a new vocabulary filter that you can use to filter out words from the transcription of an audio file generated by Amazon Transcribe",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "DeleteMedicalTranscriptionJob",
                "description": "Deletes a previously submitted medical transcription job.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTranscriptionJob",
                "description": "Deletes a previously submitted transcription job along with any other generated results such as the transcription, models, and so on.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVocabulary",
                "description": "Deletes a vocabulary from Amazon Transcribe.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteVocabularyFilter",
                "description": "Deletes a vocabulary filter from Amazon Transcribe.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMedicalTranscriptionJob",
                "description": "Returns information about a medical transcription job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTranscriptionJob",
                "description": "Returns information about a transcription job.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVocabulary",
                "description": "Gets information about a vocabulary.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetVocabularyFilter",
                "description": "Gets information about a vocabulary filter.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMedicalTranscriptionJobs",
                "description": "Lists medical transcription jobs with the specified status.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTranscriptionJobs",
                "description": "Lists transcription jobs with the specified status.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVocabularies",
                "description": "Returns a list of vocabularies that match the specified criteria. If no criteria are specified, returns the entire list of vocabularies.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListVocabularyFilters",
                "description": "Returns a list of vocabulary filters that match the specified criteria. If no criteria are specified, returns the at most 5 vocabulary filters.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMedicalStreamTranscription",
                "description": "Starts a protocol where audio is streamed to Transcribe Medical and the transcription results are streamed to your application.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartMedicalTranscriptionJob",
                "description": "Starts an asynchronous job to transcribe medical speech to text.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "StartStreamTranscription",
                "description": "Starts a bidirectional HTTP2 stream to transcribe speech to text in real time.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTranscriptionJob",
                "description": "Starts an asynchronous job to transcribe speech to text.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "UpdateVocabulary",
                "description": "Updates an existing vocabulary with new values. The UpdateVocabulary operation overwrites all of the existing information with the values that you provide in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            },
            {
                "privilege": "UpdateVocabularyFilter",
                "description": "Updates an existing vocabulary filter with new values. The UpdateVocabularyFilter operation overwrites all of the existing information with the values that you provide in the request.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": [
                            "s3:GetObject"
                        ]
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Transfer for SFTP",
        "prefix": "transfer",
        "privileges": [
            {
                "privilege": "CreateServer",
                "description": "Enables the caller to create a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Enables the caller to add a user associated with a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:PassRole"
                        ]
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteServer",
                "description": "Enables the caller to delete a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSshPublicKey",
                "description": "Enables the caller to delete an SSH public key from a user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Enables the caller to delete a user associated with a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeServer",
                "description": "Enables the caller to describe a server.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUser",
                "description": "Enables the caller to describe a user associated with a server.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportSshPublicKey",
                "description": "Enables the caller to add an SSH public key to a user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListServers",
                "description": "Enables the caller to list servers",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Enables the caller to list tags for a server or a user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "server",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Enables the caller to list users associated with a server.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartServer",
                "description": "Enables the caller to start a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopServer",
                "description": "Enables the caller to stop a server.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Enables the caller to tag a server or a user.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "server",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestIdentityProvider",
                "description": "Enables the caller to test a server's custom identity provider.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Enables the caller to untag a server or a user.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "server",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateServer",
                "description": "Enables the caller to update the configuration of a server",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Enables the caller to update the configuration of a user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "server*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "user*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "user",
                "arn": "arn:${Partition}:transfer:${region}:${account}:user/${serverId}/${username}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "server",
                "arn": "arn:${Partition}:transfer:${region}:${account}:server/${serverId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "A key that is present in the request the user makes.",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "A key that is present on the resource the user makes.",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "The list of all the tag key names associated with the resource in the request.",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon Translate",
        "prefix": "translate",
        "privileges": [
            {
                "privilege": "DeleteTerminology",
                "description": "A synchronous action that deletes a custom terminology.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTextTranslationJob",
                "description": "Gets the properties associated with an asynchronous batch translation job including name, ID, status, source and target languages, input/output S3 buckets, and so on.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTerminology",
                "description": "Retrieves a custom terminology.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportTerminology",
                "description": "Creates or updates a custom terminology, depending on whether or not one already exists for the given terminology name.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTerminologies",
                "description": "Provides a list of custom terminologies associated with your account.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTextTranslationJobs",
                "description": "Gets a list of the batch translation jobs that you have submitted.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartTextTranslationJob",
                "description": "Starts an asynchronous batch translation job. Batch translation jobs can be used to translate large volumes of text across multiple documents at once.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopTextTranslationJob",
                "description": "Stops an asynchronous batch translation job that is in progress.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TranslateText",
                "description": "Translate text from a source language to a target language.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Trusted Advisor",
        "prefix": "trustedadvisor",
        "privileges": [
            {
                "privilege": "DescribeAccount",
                "description": "View support plan and various TA preferences.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountAccess",
                "description": "Resolve whether Account has disabled Trusted Advisor",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCheckItems",
                "description": "View details for the check items",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "checks*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCheckRefreshStatuses",
                "description": "Describe check refresh statuses",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "checks*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCheckSummaries",
                "description": "Describes the check's summaries",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "checks*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeChecks",
                "description": "List valid Trusted Advisor checks and details.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNotificationPreferences",
                "description": "Describes the notification preferences for the account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ExcludeCheckItems",
                "description": "Exclude recommendations for checks for a given customer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "checks*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "IncludeCheckItems",
                "description": "Include recommendations for checks for a given customer",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "checks*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RefreshCheck",
                "description": "Enqueue a refresh for the specified check",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "checks*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetAccountAccess",
                "description": "Toggle whether TrustedAdvisor is enabled/disabled for the account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateNotificationPreferences",
                "description": "Update notification preferences",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "checks",
                "arn": "arn:${Partition}:trustedadvisor:${Region}:${Account}:checks/${CategoryCode}/${CheckId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS WAF",
        "prefix": "waf",
        "privileges": [
            {
                "privilege": "CreateByteMatchSet",
                "description": "Creates a ByteMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGeoMatchSet",
                "description": "Creates a GeoMatchSet, which you use to specify which web requests you want to allow or block based on the country that the requests originate from.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIPSet",
                "description": "Creates an IPSet, which you use to specify which web requests you want to allow or block based on the IP addresses that the requests originate from.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRateBasedRule",
                "description": "Creates a RateBasedRule, which contains a RateLimit specifying the maximum number of requests that AWS WAF allows from a specified IP address in a five-minute period.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRegexMatchSet",
                "description": "Creates a RegexMatchSet, which you use to specify which web requests you want to allow or block based on the regex patterns you specified in a RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRegexPatternSet",
                "description": "Creates a RegexPatternSet, which you use to specify the regular expression (regex) pattern that you want AWS WAF to search for.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRule",
                "description": "Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to block.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRuleGroup",
                "description": "Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSizeConstraintSet",
                "description": "Creates a SizeConstraintSet, which you use to identify the part of a web request that you want to check for length.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSqlInjectionMatchSet",
                "description": "Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests that contain snippets of SQL code in a specified part of web requests.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWebACL",
                "description": "Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateXssMatchSet",
                "description": "Creates an XssMatchSet, which you use to allow, block, or count requests that contain cross-site scripting attacks in the specified part of web requests.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteByteMatchSet",
                "description": "Permanently deletes a ByteMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGeoMatchSet",
                "description": "Permanently deletes an GeoMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIPSet",
                "description": "Permanently deletes an IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoggingConfiguration",
                "description": "Permanently deletes the LoggingConfiguration from the specified web ACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePermissionPolicy",
                "description": "Permanently deletes an IAM policy from the specified RuleGroup.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRateBasedRule",
                "description": "Permanently deletes a RateBasedRule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegexMatchSet",
                "description": "Permanently deletes an RegexMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegexPatternSet",
                "description": "Permanently deletes an RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRule",
                "description": "Permanently deletes a Rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRuleGroup",
                "description": "Permanently deletes a RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSizeConstraintSet",
                "description": "Permanently deletes a SizeConstraintSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSqlInjectionMatchSet",
                "description": "Permanently deletes a SqlInjectionMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWebACL",
                "description": "Permanently deletes a WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteXssMatchSet",
                "description": "Permanently deletes an XssMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetByteMatchSet",
                "description": "Returns the ByteMatchSet specified by ByteMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetChangeToken",
                "description": "When you want to create, update, or delete AWS WAF objects, get a change token and include the change token in the create, update, or delete request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetChangeTokenStatus",
                "description": "Returns the status of a ChangeToken that you got by calling GetChangeToken.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGeoMatchSet",
                "description": "Returns the GeoMatchSet specified by GeoMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIPSet",
                "description": "Returns the IPSet that is specified by IPSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoggingConfiguration",
                "description": "Returns the LoggingConfiguration for the specified web ACL.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPermissionPolicy",
                "description": "Returns the IAM policy attached to the RuleGroup.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRateBasedRule",
                "description": "Returns the RateBasedRule that is specified by the RuleId that you included in the GetRateBasedRule request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRateBasedRuleManagedKeys",
                "description": "Returns an array of IP addresses currently being blocked by the RateBasedRule that is specified by the RuleId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegexMatchSet",
                "description": "Returns the RegexMatchSet specified by RegexMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegexPatternSet",
                "description": "Returns the RegexPatternSet specified by RegexPatternSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRule",
                "description": "Returns the Rule that is specified by the RuleId that you included in the GetRule request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRuleGroup",
                "description": "Returns the RuleGroup that is specified by the RuleGroupId that you included in the GetRuleGroup request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSampledRequests",
                "description": "Gets detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests that your AWS resource received during a time range that you choose.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSizeConstraintSet",
                "description": "Returns the SizeConstraintSet specified by SizeConstraintSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSqlInjectionMatchSet",
                "description": "Returns the SqlInjectionMatchSet that is specified by SqlInjectionMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWebACL",
                "description": "Returns the WebACL that is specified by WebACLId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetXssMatchSet",
                "description": "Returns the XssMatchSet that is specified by XssMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActivatedRulesInRuleGroup",
                "description": "Returns an array of ActivatedRule objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListByteMatchSets",
                "description": "Returns an array of ByteMatchSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGeoMatchSets",
                "description": "Returns an array of GeoMatchSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIPSets",
                "description": "Returns an array of IPSetSummary objects in the response.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLoggingConfigurations",
                "description": "Returns an array of LoggingConfiguration objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRateBasedRules",
                "description": "Returns an array of RuleSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegexMatchSets",
                "description": "Returns an array of RegexMatchSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegexPatternSets",
                "description": "Returns an array of RegexPatternSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRuleGroups",
                "description": "Returns an array of RuleGroup objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRules",
                "description": "Returns an array of RuleSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSizeConstraintSets",
                "description": "Returns an array of SizeConstraintSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSqlInjectionMatchSets",
                "description": "Returns an array of SqlInjectionMatchSet objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscribedRuleGroups",
                "description": "Returns an array of RuleGroup objects that you are subscribed to.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the Tags for a given resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebACLs",
                "description": "Returns an array of WebACLSummary objects in the response.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListXssMatchSets",
                "description": "Returns an array of XssMatchSet objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLoggingConfiguration",
                "description": "Associates a LoggingConfiguration with a specified web ACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "PutPermissionPolicy",
                "description": "Attaches a IAM policy to the specified resource. The only supported use for this action is to share a RuleGroup across accounts.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds a Tag to a given resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes a Tag from a given resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateByteMatchSet",
                "description": "Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGeoMatchSet",
                "description": "Inserts or deletes GeoMatchConstraint objects in a GeoMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIPSet",
                "description": "Inserts or deletes IPSetDescriptor objects in an IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRateBasedRule",
                "description": "Inserts or deletes Predicate objects in a rule and updates the RateLimit in the rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRegexMatchSet",
                "description": "Inserts or deletes RegexMatchTuple objects (filters) in a RegexMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRegexPatternSet",
                "description": "Inserts or deletes RegexPatternStrings in a RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRule",
                "description": "Inserts or deletes Predicate objects in a Rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRuleGroup",
                "description": "Inserts or deletes ActivatedRule objects in a RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSizeConstraintSet",
                "description": "Inserts or deletes SizeConstraint objects (filters) in a SizeConstraintSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSqlInjectionMatchSet",
                "description": "Inserts or deletes SqlInjectionMatchTuple objects (filters) in a SqlInjectionMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWebACL",
                "description": "Inserts or deletes ActivatedRule objects in a WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateXssMatchSet",
                "description": "Inserts or deletes XssMatchTuple objects (filters) in an XssMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "bytematchset",
                "arn": "arn:${Partition}:waf::${Account}:bytematchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "ipset",
                "arn": "arn:${Partition}:waf::${Account}:ipset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "ratebasedrule",
                "arn": "arn:${Partition}:waf::${Account}:ratebasedrule/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "rule",
                "arn": "arn:${Partition}:waf::${Account}:rule/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "sizeconstraintset",
                "arn": "arn:${Partition}:waf::${Account}:sizeconstraintset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "sqlinjectionmatchset",
                "arn": "arn:${Partition}:waf::${Account}:sqlinjectionmatchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "webacl",
                "arn": "arn:${Partition}:waf::${Account}:webacl/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "xssmatchset",
                "arn": "arn:${Partition}:waf::${Account}:xssmatchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "regexmatchset",
                "arn": "arn:${Partition}:waf::${Account}:regexmatch/${Id}",
                "condition_keys": []
            },
            {
                "resource": "regexpatternset",
                "arn": "arn:${Partition}:waf::${Account}:regexpatternset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "geomatchset",
                "arn": "arn:${Partition}:waf::${Account}:geomatchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "rulegroup",
                "arn": "arn:${Partition}:waf::${Account}:rulegroup/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS WAF Regional",
        "prefix": "waf-regional",
        "privileges": [
            {
                "privilege": "AssociateWebACL",
                "description": "Associates a WebACL with a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateByteMatchSet",
                "description": "Creates a ByteMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGeoMatchSet",
                "description": "Creates a GeoMatchSet, which you use to specify which web requests you want to allow or block based on the country that the requests originate rom.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIPSet",
                "description": "Creates an IPSet, which you use to specify which web requests you want to allow or block based on the IP addresses that the requests originate rom.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRateBasedRule",
                "description": "Creates a RateBasedRule, which contains a RateLimit specifying the maximum number of requests that AWS WAF allows from a specified IP address n a five-minute period.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRegexMatchSet",
                "description": "Creates a RegexMatchSet, which you use to specify which web requests you want to allow or block based on the regex patterns you specified in a egexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRegexPatternSet",
                "description": "Creates a RegexPatternSet, which you use to specify the regular expression (regex) pattern that you want AWS WAF to search for.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRule",
                "description": "Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to lock.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRuleGroup",
                "description": "Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSizeConstraintSet",
                "description": "Creates a SizeConstraintSet, which you use to identify the part of a web request that you want to check for length.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSqlInjectionMatchSet",
                "description": "Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests that contain snippets of SQL code in a specified part of web equests.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWebACL",
                "description": "Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateXssMatchSet",
                "description": "Creates an XssMatchSet, which you use to allow, block, or count requests that contain cross-site scripting attacks in the specified part of web equests.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteByteMatchSet",
                "description": "Permanently deletes a ByteMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGeoMatchSet",
                "description": "Permanently deletes an GeoMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIPSet",
                "description": "Permanently deletes an IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoggingConfiguration",
                "description": "Permanently deletes the LoggingConfiguration from the specified web ACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeletePermissionPolicy",
                "description": "Permanently deletes an IAM policy from the specified RuleGroup.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRateBasedRule",
                "description": "Permanently deletes a RateBasedRule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegexMatchSet",
                "description": "Permanently deletes an RegexMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegexPatternSet",
                "description": "Permanently deletes an RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRule",
                "description": "Permanently deletes a Rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRuleGroup",
                "description": "Permanently deletes a RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSizeConstraintSet",
                "description": "Permanently deletes a SizeConstraintSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSqlInjectionMatchSet",
                "description": "Permanently deletes a SqlInjectionMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWebACL",
                "description": "Permanently deletes a WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteXssMatchSet",
                "description": "Permanently deletes an XssMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateWebACL",
                "description": "Removes a WebACL from the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetByteMatchSet",
                "description": "Returns the ByteMatchSet specified by ByteMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetChangeToken",
                "description": "When you want to create, update, or delete AWS WAF objects, get a change token and include the change token in the create, update, or delete equest.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetChangeTokenStatus",
                "description": "Returns the status of a ChangeToken that you got by calling GetChangeToken.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGeoMatchSet",
                "description": "Returns the GeoMatchSet specified by GeoMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIPSet",
                "description": "Returns the IPSet that is specified by IPSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoggingConfiguration",
                "description": "Returns the LoggingConfiguration for the specified web ACL.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetPermissionPolicy",
                "description": "Returns the IAM policy attached to the RuleGroup.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRateBasedRule",
                "description": "Returns the RateBasedRule that is specified by the RuleId that you included in the GetRateBasedRule request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRateBasedRuleManagedKeys",
                "description": "Returns an array of IP addresses currently being blocked by the RateBasedRule that is specified by the RuleId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegexMatchSet",
                "description": "Returns the RegexMatchSet specified by RegexMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegexPatternSet",
                "description": "Returns the RegexPatternSet specified by RegexPatternSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRule",
                "description": "Returns the Rule that is specified by the RuleId that you included in the GetRule request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRuleGroup",
                "description": "Returns the RuleGroup that is specified by the RuleGroupId that you included in the GetRuleGroup request.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSampledRequests",
                "description": "Gets detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests hat your AWS resource received during a time range that you choose.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSizeConstraintSet",
                "description": "Returns the SizeConstraintSet specified by SizeConstraintSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSqlInjectionMatchSet",
                "description": "Returns the SqlInjectionMatchSet that is specified by SqlInjectionMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWebACL",
                "description": "Returns the WebACL that is specified by WebACLId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWebACLForResource",
                "description": "Returns the WebACL for the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "loadbalancer/app/*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetXssMatchSet",
                "description": "Returns the XssMatchSet that is specified by XssMatchSetId.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListActivatedRulesInRuleGroup",
                "description": "Returns an array of ActivatedRule objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListByteMatchSets",
                "description": "Returns an array of ByteMatchSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGeoMatchSets",
                "description": "Returns an array of GeoMatchSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIPSets",
                "description": "Returns an array of IPSetSummary objects in the response.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLoggingConfigurations",
                "description": "Returns an array of LoggingConfiguration objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRateBasedRules",
                "description": "Returns an array of RuleSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegexMatchSets",
                "description": "Returns an array of RegexMatchSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegexPatternSets",
                "description": "Returns an array of RegexPatternSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourcesForWebACL",
                "description": "Returns an array of resources associated with the specified WebACL.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRuleGroups",
                "description": "Returns an array of RuleGroup objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRules",
                "description": "Returns an array of RuleSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSizeConstraintSets",
                "description": "Returns an array of SizeConstraintSetSummary objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSqlInjectionMatchSets",
                "description": "Returns an array of SqlInjectionMatchSet objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSubscribedRuleGroups",
                "description": "Returns an array of RuleGroup objects that you are subscribed to.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Lists the Tags for a given resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebACLs",
                "description": "Returns an array of WebACLSummary objects in the response.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListXssMatchSets",
                "description": "Returns an array of XssMatchSet objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLoggingConfiguration",
                "description": "Associates a LoggingConfiguration with a specified web ACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "PutPermissionPolicy",
                "description": "Attaches a IAM policy to the specified resource. The only supported use for this action is to share a RuleGroup across accounts.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Adds a Tag to a given resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Removes a Tag from a given resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rule",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateByteMatchSet",
                "description": "Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "bytematchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGeoMatchSet",
                "description": "Inserts or deletes GeoMatchConstraint objects in a GeoMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "geomatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIPSet",
                "description": "Inserts or deletes IPSetDescriptor objects in an IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRateBasedRule",
                "description": "Inserts or deletes Predicate objects in a rule and updates the RateLimit in the rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ratebasedrule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRegexMatchSet",
                "description": "Inserts or deletes RegexMatchTuple objects (filters) in a RegexMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRegexPatternSet",
                "description": "Inserts or deletes RegexPatternStrings in a RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRule",
                "description": "Inserts or deletes Predicate objects in a Rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRuleGroup",
                "description": "Inserts or deletes ActivatedRule objects in a RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSizeConstraintSet",
                "description": "Inserts or deletes SizeConstraint objects (filters) in a SizeConstraintSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sizeconstraintset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSqlInjectionMatchSet",
                "description": "Inserts or deletes SqlInjectionMatchTuple objects (filters) in a SqlInjectionMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sqlinjectionmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWebACL",
                "description": "Inserts or deletes ActivatedRule objects in a WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateXssMatchSet",
                "description": "Inserts or deletes XssMatchTuple objects (filters) in an XssMatchSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "xssmatchset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "bytematchset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:bytematchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "ipset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:ipset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "loadbalancer/app/",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/app/${LoadBalancerName}/${LoadBalancerId}",
                "condition_keys": []
            },
            {
                "resource": "ratebasedrule",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:ratebasedrule/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "rule",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:rule/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "sizeconstraintset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:sizeconstraintset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "sqlinjectionmatchset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:sqlinjectionmatchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "webacl",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:webacl/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "xssmatchset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:xssmatchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "regexmatchset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:regexmatch/${Id}",
                "condition_keys": []
            },
            {
                "resource": "regexpatternset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:regexpatternset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "geomatchset",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:geomatchset/${Id}",
                "condition_keys": []
            },
            {
                "resource": "rulegroup",
                "arn": "arn:${Partition}:waf-regional:${Region}:${Account}:rulegroup/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "AWS WAF V2",
        "prefix": "wafv2",
        "privileges": [
            {
                "privilege": "AssociateWebACL",
                "description": "Grants permission to associate a WebACL with a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "apigateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CheckCapacity",
                "description": "Grants permission to calculate web ACL capacity unit (WCU) requirements for a specified scope and set of rules.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIPSet",
                "description": "Grants permission to create an IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRegexPatternSet",
                "description": "Grants permission to create a RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateRuleGroup",
                "description": "Grants permission to create a RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWebACL",
                "description": "Grants permission to create a WebACL.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:RequestTag/${TagKey}",
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIPSet",
                "description": "Grants permission to delete the specified IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLoggingConfiguration",
                "description": "Grants permission to delete the LoggingConfiguration from the specified WebACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRegexPatternSet",
                "description": "Grants permission to delete the specified RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteRuleGroup",
                "description": "Grants permission to delete the specified RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWebACL",
                "description": "Grants permission to delete the specified WebACL.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeManagedRuleGroup",
                "description": "Grants permission to view high-level information for a managed rule group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateWebACL",
                "description": "Grants permission disassociate a WebACL from an application resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "apigateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetIPSet",
                "description": "Grants permission to view details about the specified IPSet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetLoggingConfiguration",
                "description": "Grants permission to view LoggingConfiguration about the specified WebACL.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRateBasedStatementManagedKeys",
                "description": "Grants permission to view the keys that are currently blocked by a rate-based rule.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRegexPatternSet",
                "description": "Grants permission to view details about the specified RegexPatternSet.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetRuleGroup",
                "description": "Grants permission to view details about the specified RuleGroup.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSampledRequests",
                "description": "Grants permission to view detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests that your AWS resource received during a time range that you choose.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWebACL",
                "description": "Grants permission to view details about the specified GetWebACL.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWebACLForResource",
                "description": "Grants permission to view the WebACL for the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "apigateway",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "loadbalancer/app/",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableManagedRuleGroups",
                "description": "Grants permission to view an array of managed rule groups that are available for you to use.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListIPSets",
                "description": "Grants permission to view an array of IPSetSummary objects for the IP sets that you manage.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListLoggingConfigurations",
                "description": "Grants permission to view an array of your LoggingConfiguration objects.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRegexPatternSets",
                "description": "Grants permission to view an array of RegexPatternSetSummary objects for the regex pattern sets that you manage.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourcesForWebACL",
                "description": "Grants permission to view an array of the Amazon Resource Names (ARNs) for the resources that are associated with the specified web ACL.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListRuleGroups",
                "description": "Grants permission to view an array of RuleGroupSummary objects for the rule groups that you manage.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to lists tag for the specified resource.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "ipset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "regexpatternset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebACLs",
                "description": "Grants permission to view an array of WebACLSummary objects for the web ACLs that you manage.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutLoggingConfiguration",
                "description": "Grants permission to enables the specified LoggingConfiguration, to start logging from a web ACL.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": [
                            "iam:CreateServiceLinkedRole"
                        ]
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to associates tags with the specified AWS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ipset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "regexpatternset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys",
                            "aws:RequestTag/${TagKey}",
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to disassociates tags from an AWS resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "ipset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "regexpatternset",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "rulegroup",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "webacl",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:TagKeys"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIPSet",
                "description": "Grants permission to update the specified IPSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "ipset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRegexPatternSet",
                "description": "Grants permission to update the specified RegexPatternSet.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "regexpatternset*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRuleGroup",
                "description": "Grants permission to update the specified RuleGroup.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "rulegroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateWebACL",
                "description": "Grants permission to update the specified WebACL.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "webacl*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "",
                        "condition_keys": [
                            "aws:ResourceTag/${TagKey}"
                        ],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "webacl",
                "arn": "arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/webacl/${Name}/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "ipset",
                "arn": "arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/ipset/${Name}/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "rulegroup",
                "arn": "arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/rulegroup/${Name}/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "regexpatternset",
                "arn": "arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/regexpatternset/${Name}/${Id}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            },
            {
                "resource": "loadbalancer/app/",
                "arn": "arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/app/${LoadBalancerName}/${LoadBalancerId}",
                "condition_keys": []
            },
            {
                "resource": "apigateway",
                "arn": "arn:${Partition}:apigateway:${Region}::/restapis/${ApiId}/stages/prod",
                "condition_keys": []
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the allowed set of values for each of the tags",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag-value assoicated with the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of mandatory tags in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon WorkSpaces Application Manager",
        "prefix": "wam",
        "privileges": [
            {
                "privilege": "AuthenticatePackager",
                "description": "Allows the Amazon WAM packaging instance to access your application package catalog.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "AWS Well-Architected Tool",
        "prefix": "wellarchitected",
        "privileges": [
            {
                "privilege": "CreateWorkload",
                "description": "Creates a new workload.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWorkloadShare",
                "description": "Shares a workload with another account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWorkload",
                "description": "Deletes an existing workload.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetWorkload",
                "description": "Retrieves the specified workload.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "workload*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWorkloads",
                "description": "Lists the workloads in this account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "workload",
                "arn": "arn:${Partition}:wellarchitected:${Region}:${Account}:workload/${ResourceId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon WorkDocs",
        "prefix": "workdocs",
        "privileges": [
            {
                "privilege": "AbortDocumentVersionUpload",
                "description": "Grants permission to abort the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ActivateUser",
                "description": "Grants permission to activate the specified user. Only active users can access Amazon WorkDocs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddResourcePermissions",
                "description": "Grants permission to create a set of permissions for the specified folder or document.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AddUserToGroup",
                "description": "Grants permission to add a user to a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CheckAlias",
                "description": "Grants permission to check an alias.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateComment",
                "description": "Grants permission to add a new comment to the specified document version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateCustomMetadata",
                "description": "Grants permission to add one or more custom properties to the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFolder",
                "description": "Grants permission to create a folder with the specified name and parent folder.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInstance",
                "description": "Grants permission to create an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateLabels",
                "description": "Grants permission to add labels to the given resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateNotificationSubscription",
                "description": "Grants permission to configure WorkDocs to use Amazon SNS notifications.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Grants permission to create a user in a Simple AD or Microsoft AD directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeactivateUser",
                "description": "Grants permission to deactivate the specified user, which revokes the user's access to Amazon WorkDocs.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteComment",
                "description": "Grants permission to delete the specified comment from the document version.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteCustomMetadata",
                "description": "Grants permission to delete custom metadata from the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteDocument",
                "description": "Grants permission to permanently delete the specified document and its associated metadata.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFolder",
                "description": "Grants permission to permanently delete the specified folder and its contents.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFolderContents",
                "description": "Grants permission to delete the contents of the specified folder.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInstance",
                "description": "Grants permission to delete an instance.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteLabels",
                "description": "Grants permission to delete one or more labels from a resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteNotificationSubscription",
                "description": "Grants permission to delete the specified subscription from the specified organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Grants permission to delete the specified user from a Simple AD or Microsoft AD directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterDirectory",
                "description": "Grants permission to deregister a directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeActivities",
                "description": "Grants permission to fetch user activities in a specified time period.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAvailableDirectories",
                "description": "Grants permission to describe available directories.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeComments",
                "description": "Grants permission to list all the comments for the specified document version.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDocumentVersions",
                "description": "Grants permission to retrieve the document versions for the specified document.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFolderContents",
                "description": "Grants permission to describe the contents of the specified folder, including its documents and sub-folders.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGroups",
                "description": "Grants permission to describe the user groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInstances",
                "description": "Grants permission to describe instances.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeNotificationSubscriptions",
                "description": "Grants permission to list the specified notification subscriptions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResourcePermissions",
                "description": "Grants permission to view a description of a specified resource's permissions.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeRootFolders",
                "description": "Grants permission to describe the root folders.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUsers",
                "description": "Grants permission to view a description of the specified users. You can describe all users or filter the results (for example, by status or organization).",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DownloadDocumentVersion",
                "description": "Grants permission to download a specified document version.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetCurrentUser",
                "description": "Grants permission to retrieve the details of the current user.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDocument",
                "description": "Grants permission to retrieve the specified document object.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDocumentPath",
                "description": "Grants permission to retrieve the path information (the hierarchy from the root folder) for the requested document.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetDocumentVersion",
                "description": "Grants permission to retrieve version metadata for the specified document.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFolder",
                "description": "Grants permission to retrieve the metadata of the specified folder.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetFolderPath",
                "description": "Grants permission to retrieve the path information (the hierarchy from the root folder) for the specified folder.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetResources",
                "description": "Grants permission to get a collection of resources.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "InitiateDocumentVersionUpload",
                "description": "Grants permission to create a new document object and version object.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterDirectory",
                "description": "Grants permission to register a directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveAllResourcePermissions",
                "description": "Grants permission to remove all the permissions from the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveResourcePermission",
                "description": "Grants permission to remove the permission for the specified principal from the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDocument",
                "description": "Grants permission to update the specified attributes of the specified document.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDocumentVersion",
                "description": "Grants permission to change the status of the document version to ACTIVE.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFolder",
                "description": "Grants permission to update the specified attributes of the specified folder.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInstanceAlias",
                "description": "Grants permission to update an instance alias.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateUser",
                "description": "Grants permission to update the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [],
        "conditions": []
    },
    {
        "service_name": "Amazon WorkLink",
        "prefix": "worklink",
        "privileges": [
            {
                "privilege": "AssociateDomain",
                "description": "Grants permission to associate a domain with an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateWebsiteAuthorizationProvider",
                "description": "Grants permission to associate a website authorization provider with an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateWebsiteCertificateAuthority",
                "description": "Grants permission to associate a website certificate authority with an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateFleet",
                "description": "Grants permission to create an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteFleet",
                "description": "Grants permission to delete an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAuditStreamConfiguration",
                "description": "Grants permission to describe the audit stream configuration for an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeCompanyNetworkConfiguration",
                "description": "Grants permission to describe the company network configuration for an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDevice",
                "description": "Grants permission to describe details of a device associated with an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDevicePolicyConfiguration",
                "description": "Grants permission to describe the device policy configuration for an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDomain",
                "description": "Grants permission to describe details about a domain associated with an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeFleetMetadata",
                "description": "Grants permission to describe metadata of an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIdentityProviderConfiguration",
                "description": "Grants permission to describe the identity provider configuration for an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWebsiteCertificateAuthority",
                "description": "Grants permission to describe a website certificate authority associated with an Amazon WorkLink fleet",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDomain",
                "description": "Grants permission to disassociate a domain from an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateWebsiteAuthorizationProvider",
                "description": "Grants permission to disassociate a website authorization provider from an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateWebsiteCertificateAuthority",
                "description": "Grants permission to disassociate a website certificate authority from an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDevices",
                "description": "Grants permission to list the devices associated with an Amazon WorkLink fleet",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListDomains",
                "description": "Grants permission to list the associated domains for an Amazon WorkLink fleet",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListFleets",
                "description": "Grants permission to list the Amazon WorkLink fleets associated with the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebsiteAuthorizationProviders",
                "description": "Grants permission to list the website authorization providers for an Amazon WorkLink fleet",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListWebsiteCertificateAuthorities",
                "description": "Grants permission to list the website certificate authorities associated with an Amazon WorkLink fleet",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RestoreDomainAccess",
                "description": "Grants permission to restore access to a domain associated with an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeDomainAccess",
                "description": "Grants permission to revoke access to a domain associated with an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SignOutUser",
                "description": "Grants permission to sign out a user from an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateAuditStreamConfiguration",
                "description": "Grants permission to update the audit stream configuration for an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateCompanyNetworkConfiguration",
                "description": "Grants permission to update\u00a0the company network configuration for an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDevicePolicyConfiguration",
                "description": "Grants permission to update the device policy configuration for an Amazon WorkLink fleet",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateDomainMetadata",
                "description": "Grants permission to update the metadata for a domain associated with an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateFleetMetadata",
                "description": "Grants permission to update the metadata of an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateIdentityProviderConfiguration",
                "description": "Grants permission to update the identity provider configuration for an Amazon WorkLink fleet",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "fleet*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "fleet",
                "arn": "arn:${Partition}:worklink::${Account}:fleet/${fleetName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon WorkMail",
        "prefix": "workmail",
        "privileges": [
            {
                "privilege": "AddMembersToGroup",
                "description": "Adds a list of members (users or groups) to a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateDelegateToResource",
                "description": "Adds a member (user or group) to the resource's set of delegates.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AssociateMemberToGroup",
                "description": "Adds a member (user or group) to the group's set.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateAlias",
                "description": "Adds an alias to the set of a given member (user or group) of WorkMail.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Creates a group that can be used in WorkMail by calling the RegisterToWorkMail operation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateInboundMailFlowRule",
                "description": "Create an inbound email flow rule which will apply to all email sent to an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMailDomain",
                "description": "Creates a mail domain.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateMailUser",
                "description": "Creates a user in the directory and the WorkMail storage but does not enable the user for mail.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOrganization",
                "description": "Creates an organization, either using an existing directory or creates a new directory on-the-fly. Also creates and enables the complementary mail domain. Optionally creates KMS key",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateOutboundMailFlowRule",
                "description": "Create an outbound email flow rule which will apply to all email sent from an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateResource",
                "description": "Creates a new WorkMail resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSmtpGateway",
                "description": "Register an SMTP device against a WorkMail organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateUser",
                "description": "Creates a user who can be used in WorkMail by calling the RegisterToWorkMail operation.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAccessControlRule",
                "description": "Deletes an access control rule for the specified WorkMail organization.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteAlias",
                "description": "Remove one or more specified aliases from a set of aliases for a given user.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Deletes a group from WorkMail.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteInboundMailFlowRule",
                "description": "Remove an inbound email flow rule to no longer apply to emails sent to an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMailDomain",
                "description": "Removes an unused mail domain from an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMailboxPermissions",
                "description": "Deletes permissions granted to a member (user or group).",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteMobileDevice",
                "description": "Removes a mobile device from a user",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOrganization",
                "description": "Removes an organization from an account, either removing the directory from directory services or leaving it available for re-use",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteOutboundMailFlowRule",
                "description": "Remove an outbound email flow rule to no longer apply to emails sent from an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteResource",
                "description": "Deletes the specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSmtpGateway",
                "description": "Remove an SMTP device from an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteUser",
                "description": "Deletes a user from WorkMail and all subsequent systems. The action cannot be undone.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeregisterFromWorkMail",
                "description": "Mark a user, group, or resource as no longer used in WorkMail.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeDirectories",
                "description": "Shows a list of directories available for use in creating an organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeGroup",
                "description": "Returns the data available for the group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeInboundMailFlowRule",
                "description": "Returns the details of an inbound mail flow rule configured for an organization",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeKmsKeys",
                "description": "Shows a list of KMS Keys available for use in creating an organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMailDomains",
                "description": "Shows the details of all mail domains associated with the organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMailGroups",
                "description": "Shows the details of all groups associated with the organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeMailUsers",
                "description": "Shows the details of all users associated with the orgaization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganization",
                "description": "Provides more information regarding a given organization based on its identifier.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOrganizations",
                "description": "Shows a summary of all organizations associated with the account",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeOutboundMailFlowRule",
                "description": "Returns the details of an outbound mail flow rule configured for an organization",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeResource",
                "description": "Returns the data available for the resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeSmtpGateway",
                "description": "Returns the details of an SMTP device registered against an organization",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeUser",
                "description": "Provides information regarding the user.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableMailGroups",
                "description": "Disable a mail group when it is not being used and, to allow it to be deleted",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisableMailUsers",
                "description": "Disable a user mailbox when it is no longer being used, and to allow it to be deleted",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateDelegateFromResource",
                "description": "Removes a member from the resource's set of delegates.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateMemberFromGroup",
                "description": "Removes a member from a group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableMailDomain",
                "description": "Enable a mail domain in the organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableMailGroups",
                "description": "Enable a mail group after it has been created to allow it to receive mail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "EnableMailUsers",
                "description": "Enable a user's mailbox after it has been created to allow it to receive mail",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetAccessControlEffect",
                "description": "Gets the effects of an organization's access control rules as they apply to a specified IPv4 address, access protocol action, or user ID.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetJournalingRules",
                "description": "Returns journaling and fallback email addresses configured for email journaling",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMailDomainDetails",
                "description": "Get the details of the mail domain",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMailGroupDetails",
                "description": "Get the details of the mail group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMailUserDetails",
                "description": "Get the details of the user's mailbox and account",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMailboxDetails",
                "description": "Returns the details of the user's mailbox.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMobileDeviceDetails",
                "description": "Get the details of the mobile device",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMobileDevicesForUser",
                "description": "Get a list of the mobile devices associated with the user",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetMobilePolicyDetails",
                "description": "Get the details of the mobile device policy associated with the organization",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAccessControlRules",
                "description": "Lists the access control rules for the specified organization.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAliases",
                "description": "Creates a paginated call to list the aliases associated with a given entity.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroupMembers",
                "description": "Returns an overview of the members of a group. Users and groups can be members of a group.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListGroups",
                "description": "Returns summaries of the organization's groups.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListInboundMailFlowRules",
                "description": "Returns a list of inbound mail flow rules configured for an organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMailboxPermissions",
                "description": "Lists the mailbox permissions associated with a user, group, or resource mailbox.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListMembersInMailGroup",
                "description": "Get a list of all the members in a mail group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOrganizations",
                "description": "Returns summaries of the customer's non-deleted organizations.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListOutboundMailFlowRules",
                "description": "Returns a list of outbound mail flow rules configured for an organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResourceDelegates",
                "description": "Lists the delegates associated with a resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListResources",
                "description": "Returns summaries of the organization's resources.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListSmtpGateways",
                "description": "Returns a list of SMTP devices registered against the organization",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListTagsForResource",
                "description": "Grants permission to list the tags applied to an Amazon WorkMail organization resource.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListUsers",
                "description": "Returns summaries of the organization's users.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutAccessControlRule",
                "description": "Adds a new access control rule for the specified organization. The rule allows or denies access to the organization for the specified IPv4 addresses, access protocol actions, and user IDs. Adding a new rule with the same name as an existing rule replaces the older rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutMailboxPermissions",
                "description": "Sets permissions for a user, group, or resource. This replaces any pre-existing permissions.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RegisterToWorkMail",
                "description": "Registers an existing and disabled user, group, or resource for use by associating a mailbox and calendaring capabilities.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RemoveMembersFromGroup",
                "description": "Remove members from a mail group",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetPassword",
                "description": "Allows the administrator to reset the password for a user.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ResetUserPassword",
                "description": "Reset the password for a user's account",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SearchMembers",
                "description": "Prefix search to find a specific user in a mail group",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetAdmin",
                "description": "Mark a user as being an administrator",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetDefaultMailDomain",
                "description": "Set the default mail domain for the organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetJournalingRules",
                "description": "Set journaling and fallback email addresses for email journaling",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetMailGroupDetails",
                "description": "Set the details of the mail group which has just been created",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetMailUserDetails",
                "description": "Set the details for the user account which has just been created",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "SetMobilePolicyDetails",
                "description": "Set the details of a mobile policy associated with the organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TagResource",
                "description": "Grants permission to tag the specified Amazon WorkMail organization resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestInboundMailFlowRules",
                "description": "Test what inbound rules will apply to an email with a given sender and recipient",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TestOutboundMailFlowRules",
                "description": "Test what outbound rules will apply to an email with a given sender and recipient",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UntagResource",
                "description": "Grants permission to untag the specified Amazon WorkMail organization resource.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateInboundMailFlowRule",
                "description": "Update the details of an inbound email flow rule which will apply to all email sent to an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateMailboxQuota",
                "description": "Updates the maximum size (in MB) of the user's mailbox.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateOutboundMailFlowRule",
                "description": "Update the details of an outbound email flow rule which will apply to all email sent from an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdatePrimaryEmailAddress",
                "description": "Updates the primary email for a user, group, or resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateResource",
                "description": "Updates data for the resource. To retrieve the latest information, it must be preceded by a DescribeResource call.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSmtpGateway",
                "description": "Update the details of an existing SMTP device registered against an organization",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "WipeMobileDevice",
                "description": "Remotely wipe the mobile device associated with a user's account",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "organization*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "organization",
                "arn": "arn:${Partition}:workmail:${Region}:${Account}:organization/${ResourceId}",
                "condition_keys": [
                    "aws:ResourceTag/${TagKey}"
                ]
            }
        ],
        "conditions": [
            {
                "condition": "aws:RequestTag/${TagKey}",
                "description": "Filters actions based on the presence of tag key-value pairs in the request",
                "type": "String"
            },
            {
                "condition": "aws:ResourceTag/${TagKey}",
                "description": "Filters actions based on tag key-value pairs attached to the resource",
                "type": "String"
            },
            {
                "condition": "aws:TagKeys",
                "description": "Filters actions based on the presence of tag keys in the request",
                "type": "String"
            }
        ]
    },
    {
        "service_name": "Amazon WorkMail Message Flow",
        "prefix": "workmailmessageflow",
        "privileges": [
            {
                "privilege": "GetRawMessageContent",
                "description": "Grants permission to read the content of email messages with the specified message ID",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "RawMessage*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "RawMessage",
                "arn": "arn:${Partition}:workmailmessageflow:${Region}:${Account}:message/${OrganizationId}/${Context}/${MessageId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "Amazon WorkSpaces",
        "prefix": "workspaces",
        "privileges": [
            {
                "privilege": "AssociateIpGroups",
                "description": "Associates the specified IP access control group with the specified directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "AuthorizeIpRules",
                "description": "Adds one or more rules to the specified IP access control group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceipgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateIpGroup",
                "description": "Creates an IP access control group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateTags",
                "description": "Creates tags for a WorkSpace.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateWorkspaces",
                "description": "Creates one or more WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directoryid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    },
                    {
                        "resource_type": "workspacebundle*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteIpGroup",
                "description": "Deletes the specified IP access control group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceipgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteTags",
                "description": "Deletes tags from a Workspace.",
                "access_level": "Tagging",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteWorkspaceImage",
                "description": "Deletes the specified workspace image.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccount",
                "description": "Retrieves a list that describes the configuration of bring your own license (BYOL) for the specified account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeAccountModifications",
                "description": "Retrieves a list that describes modifications to the configuration of bring your own license (BYOL) for the specified account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeClientProperties",
                "description": "Describe client properties about the specified resources.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "directoryid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeIpGroups",
                "description": "Retrieves information about the IP access control groups of your account in the region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "workspaceipgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeTags",
                "description": "Describes tags for a WorkSpace.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkspaceBundles",
                "description": "Obtains information about the WorkSpace bundles that are available to your account in the specified region.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "workspacebundle*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkspaceDirectories",
                "description": "Retrieves information about the AWS Directory Service directories in the region that are registered with Amazon WorkSpaces and are available to your account.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkspaceImages",
                "description": "Retrieves a list that describes one or more specified images.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkspaces",
                "description": "Obtains information about the specified WorkSpaces.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DescribeWorkspacesConnectionStatus",
                "description": "Describes the connection status of a specified WorkSpace.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DisassociateIpGroups",
                "description": "Disassociates the specified IP access control group from the specified directory.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ImportWorkspaceImage",
                "description": "Import a licensed EC2 image to into Amazon WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ListAvailableManagementCidrRanges",
                "description": "List available CIDR ranges for a CIDR range constraint.",
                "access_level": "List",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyAccount",
                "description": "Modify the configuration of bring your own license (BYOL) for the specified account.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyClientProperties",
                "description": "Modify the client properties of a specified resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "directoryid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyWorkspaceProperties",
                "description": "Modifies the WorkSpace properties, including the running mode and AutoStop time.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "ModifyWorkspaceState",
                "description": "Modify the state of specified WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebootWorkspaces",
                "description": "Reboots the specified WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RebuildWorkspaces",
                "description": "Rebuilds the specified WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "RevokeIpRules",
                "description": "Removes one or more rules from the specified IP access control group.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceipgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StartWorkspaces",
                "description": "Starts the specified WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "StopWorkspaces",
                "description": "Stops the specified WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "TerminateWorkspaces",
                "description": "Terminates the specified WorkSpaces.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceid*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateRulesOfIpGroup",
                "description": "Replaces the current rules of the specified IP access control group with the specified rules.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "workspaceipgroup*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "workspacebundle",
                "arn": "arn:${Partition}:workspaces:${Region}:${Account}:workspacebundle/${BundleId}",
                "condition_keys": []
            },
            {
                "resource": "workspaceipgroup",
                "arn": "arn:${Partition}:workspaces:${Region}:${Account}:workspaceipgroup/${GroupId}",
                "condition_keys": []
            },
            {
                "resource": "directoryid",
                "arn": "arn:${Partition}:workspaces:${Region}:${Account}:directory/${DirectoryId}",
                "condition_keys": []
            },
            {
                "resource": "workspaceid",
                "arn": "arn:${Partition}:workspaces:${Region}:${Account}:workspace/${WorkspaceId}",
                "condition_keys": []
            }
        ],
        "conditions": []
    },
    {
        "service_name": "AWS X-Ray",
        "prefix": "xray",
        "privileges": [
            {
                "privilege": "BatchGetTraces",
                "description": "Retrieves a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateGroup",
                "description": "Creates a group resource with a name and a filter expression.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "CreateSamplingRule",
                "description": "Creates a rule to control sampling behavior for instrumented applications.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sampling-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteGroup",
                "description": "Deletes a group resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "DeleteSamplingRule",
                "description": "Deletes a sampling rule.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sampling-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetEncryptionConfig",
                "description": "Retrieves the current encryption configuration for X-Ray data.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroup",
                "description": "Retrieves group resource details.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetGroups",
                "description": "Retrieves all active group details.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSamplingRules",
                "description": "Retrieves all sampling rules.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSamplingStatisticSummaries",
                "description": "Retrieves information about recent sampling results for all sampling rules.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetSamplingTargets",
                "description": "Requests a sampling quota for rules that the service is using to sample requests.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetServiceGraph",
                "description": "Retrieves a document that describes services that process incoming requests, and downstream services that they call as a result.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTimeSeriesServiceStatistics",
                "description": "Get an aggregation of service statistics defined by a specific time range bucketed into time intervals.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTraceGraph",
                "description": "Retrieves a service graph for one or more specific trace IDs.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "GetTraceSummaries",
                "description": "Retrieves IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces.",
                "access_level": "Read",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutEncryptionConfig",
                "description": "Updates the encryption configuration for X-Ray data.",
                "access_level": "Permissions management",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutTelemetryRecords",
                "description": "Used by the AWS X-Ray daemon to send telemetry to the service.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "PutTraceSegments",
                "description": "Uploads segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateGroup",
                "description": "Updates a group resource.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "group*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            },
            {
                "privilege": "UpdateSamplingRule",
                "description": "Modifies a sampling rule's configuration.",
                "access_level": "Write",
                "resource_types": [
                    {
                        "resource_type": "sampling-rule*",
                        "condition_keys": [],
                        "dependent_actions": []
                    }
                ]
            }
        ],
        "resources": [
            {
                "resource": "group",
                "arn": "arn:${Partition}:xray:${Region}:${Account}:group/${GroupName}/${Id}",
                "condition_keys": []
            },
            {
                "resource": "sampling-rule",
                "arn": "arn:${Partition}:xray:${Region}:${Account}:sampling-rule/${SamplingRuleName}",
                "condition_keys": []
            }
        ],
        "conditions": []
    }
]