{ "allowvendedlogdeliveryforresource": { "name": "AllowVendedLogDeliveryForResource", "isPermissionOnly": true, "description": "Grants permission to configure vended telemetry for a resource", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "payment-manager", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "authorizeaction": { "name": "AuthorizeAction", "isPermissionOnly": true, "description": "Grants permission to evaluate Cedar policies for authorization requests", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "batchcreatememoryrecords": { "name": "BatchCreateMemoryRecords", "description": "Grants permission to create one or more memory records", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:namespace" ], "dependentActions": [] }, "batchdeletememoryrecords": { "name": "BatchDeleteMemoryRecords", "description": "Grants permission to delete one or more memory records", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "batchupdatememoryrecords": { "name": "BatchUpdateMemoryRecords", "description": "Grants permission to update one or more memory records", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:namespace" ], "dependentActions": [] }, "completeresourcetokenauth": { "name": "CompleteResourceTokenAuth", "description": "Grants permission to retrieve access token with OAuth2 for 3LO flow to access external resource", "accessLevel": "Read", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:InboundJwtClaim/iss", "bedrock-agentcore:InboundJwtClaim/sub", "bedrock-agentcore:InboundJwtClaim/aud", "bedrock-agentcore:InboundJwtClaim/scope", "bedrock-agentcore:InboundJwtClaim/client_id", "bedrock-agentcore:userid" ], "dependentActions": [] }, "connectbrowserautomationstream": { "name": "ConnectBrowserAutomationStream", "description": "Grants permission to connect to a browser automation stream", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "connectbrowserliveviewstream": { "name": "ConnectBrowserLiveViewStream", "description": "Grants permission to connect to a browser live view stream", "accessLevel": "Read", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createabtest": { "name": "CreateABTest", "description": "Grants permission to create an A/B test", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "createagentruntime": { "name": "CreateAgentRuntime", "description": "Grants permission to create a new agent runtime", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys", "bedrock-agentcore:subnets", "bedrock-agentcore:securityGroups", "bedrock-agentcore:RuntimeAuthorizerType" ], "dependentActions": [ "iam:PassRole" ] }, "createagentruntimeendpoint": { "name": "CreateAgentRuntimeEndpoint", "description": "Grants permission to create a new agent runtime endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createapikeycredentialprovider": { "name": "CreateApiKeyCredentialProvider", "description": "Grants permission to create a new API Key Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createbrowser": { "name": "CreateBrowser", "description": "Grants permission to create a new custom browser", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys", "bedrock-agentcore:subnets", "bedrock-agentcore:securityGroups" ], "dependentActions": [] }, "createbrowserprofile": { "name": "CreateBrowserProfile", "description": "Grants permission to create a new browser profile", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createcodeinterpreter": { "name": "CreateCodeInterpreter", "description": "Grants permission to create a new custom code interpreter", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys", "bedrock-agentcore:subnets", "bedrock-agentcore:securityGroups" ], "dependentActions": [] }, "createconfigurationbundle": { "name": "CreateConfigurationBundle", "description": "Grants permission to create a new configuration bundle", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createevaluator": { "name": "CreateEvaluator", "description": "Grants permission to create a new evaluator", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:ResourceTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createevent": { "name": "CreateEvent", "description": "Grants permission to create an Event", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "creategateway": { "name": "CreateGateway", "description": "Grants permission to create a new gateway", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [ "iam:PassRole" ] }, "creategatewayrule": { "name": "CreateGatewayRule", "description": "Grants permission to create a new rule in an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "creategatewaytarget": { "name": "CreateGatewayTarget", "description": "Grants permission to create a new target in an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "createharness": { "name": "CreateHarness", "description": "Grants permission to create a new harness", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [ "bedrock-agentcore:CreateAgentRuntime", "bedrock-agentcore:GetAgentRuntime", "iam:PassRole" ] }, "creatememory": { "name": "CreateMemory", "description": "Grants permission to create a Memory resource", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys", "bedrock-agentcore:KmsKeyArn" ], "dependentActions": [ "iam:PassRole" ] }, "createoauth2credentialprovider": { "name": "CreateOauth2CredentialProvider", "description": "Grants permission to create a new Credential Provider to access external resources with OAuth2 protocol", "accessLevel": "Write", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createonlineevaluationconfig": { "name": "CreateOnlineEvaluationConfig", "description": "Grants permission to create a new online evaluation configuration", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:ResourceTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [ "iam:PassRole" ] }, "createpaymentconnector": { "name": "CreatePaymentConnector", "description": "Grants permission to create a new payment connector under a payment manager", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "createpaymentcredentialprovider": { "name": "CreatePaymentCredentialProvider", "description": "Grants permission to create a new Payment Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "paymentcredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createpaymentinstrument": { "name": "CreatePaymentInstrument", "description": "Grants permission to create a new payment instrument", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "createpaymentmanager": { "name": "CreatePaymentManager", "description": "Grants permission to create a new payment manager", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [ "iam:PassRole" ] }, "createpaymentsession": { "name": "CreatePaymentSession", "description": "Grants permission to create a new payment session", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "createpolicy": { "name": "CreatePolicy", "description": "Grants permission to create a new policy within a policy engine", "accessLevel": "Write", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "createpolicyengine": { "name": "CreatePolicyEngine", "description": "Grants permission to create a new policy engine", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "createregistry": { "name": "CreateRegistry", "description": "Grants permission to create a new registry", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "createregistryrecord": { "name": "CreateRegistryRecord", "description": "Grants permission to create a new registry record", "accessLevel": "Write", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "createworkloadidentity": { "name": "CreateWorkloadIdentity", "description": "Grants permission to create a new Workload Identity", "accessLevel": "Write", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:RequestTag/${TagKey}", "aws:TagKeys" ], "dependentActions": [] }, "deleteabtest": { "name": "DeleteABTest", "description": "Grants permission to delete an A/B test", "accessLevel": "Write", "resourceTypes": [ { "name": "ab-test", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteagentruntime": { "name": "DeleteAgentRuntime", "description": "Grants permission to delete an agent runtime", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteagentruntimeendpoint": { "name": "DeleteAgentRuntimeEndpoint", "description": "Grants permission to delete an agent runtime endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteapikeycredentialprovider": { "name": "DeleteApiKeyCredentialProvider", "description": "Grants permission to delete a registered API Key Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletebatchevaluation": { "name": "DeleteBatchEvaluation", "description": "Grants permission to delete a batch evaluation", "accessLevel": "Write", "resourceTypes": [ { "name": "batch-evaluate", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletebrowser": { "name": "DeleteBrowser", "description": "Grants permission to delete a custom browser", "accessLevel": "Write", "resourceTypes": [ { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletebrowserprofile": { "name": "DeleteBrowserProfile", "description": "Grants permission to delete a browser profile", "accessLevel": "Write", "resourceTypes": [ { "name": "browser-profile", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletecodeinterpreter": { "name": "DeleteCodeInterpreter", "description": "Grants permission to delete a custom code interpreter", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteconfigurationbundle": { "name": "DeleteConfigurationBundle", "description": "Grants permission to delete a configuration bundle", "accessLevel": "Write", "resourceTypes": [ { "name": "configuration-bundle", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteevaluator": { "name": "DeleteEvaluator", "description": "Grants permission to delete an evaluator", "accessLevel": "Write", "resourceTypes": [ { "name": "evaluator", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteevent": { "name": "DeleteEvent", "description": "Grants permission to delete an Event", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "deletegateway": { "name": "DeleteGateway", "description": "Grants permission to delete an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletegatewayrule": { "name": "DeleteGatewayRule", "description": "Grants permission to delete an existing gateway rule", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletegatewaytarget": { "name": "DeleteGatewayTarget", "description": "Grants permission to delete an existing gateway target", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteharness": { "name": "DeleteHarness", "description": "Grants permission to delete a harness", "accessLevel": "Write", "resourceTypes": [ { "name": "harness", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "bedrock-agentcore:DeleteAgentRuntime", "bedrock-agentcore:GetAgentRuntime", "iam:PassRole" ] }, "deletememory": { "name": "DeleteMemory", "description": "Grants permission to delete a Memory resource", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletememoryrecord": { "name": "DeleteMemoryRecord", "description": "Grants permission to delete a Memory Record", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteoauth2credentialprovider": { "name": "DeleteOauth2CredentialProvider", "description": "Grants permission to delete a registered OAuth2 Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteonlineevaluationconfig": { "name": "DeleteOnlineEvaluationConfig", "description": "Grants permission to delete an online evaluation configuration", "accessLevel": "Write", "resourceTypes": [ { "name": "online-evaluation-config", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepaymentconnector": { "name": "DeletePaymentConnector", "description": "Grants permission to delete a payment connector", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepaymentcredentialprovider": { "name": "DeletePaymentCredentialProvider", "description": "Grants permission to delete a registered Payment Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "paymentcredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepaymentinstrument": { "name": "DeletePaymentInstrument", "description": "Grants permission to delete a payment instrument", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepaymentmanager": { "name": "DeletePaymentManager", "description": "Grants permission to delete a payment manager", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepaymentsession": { "name": "DeletePaymentSession", "description": "Grants permission to delete a payment session", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepolicy": { "name": "DeletePolicy", "description": "Grants permission to delete a policy", "accessLevel": "Write", "resourceTypes": [ { "name": "policy", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deletepolicyengine": { "name": "DeletePolicyEngine", "description": "Grants permission to delete a policy engine", "accessLevel": "Write", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleterecommendation": { "name": "DeleteRecommendation", "description": "Grants permission to delete a recommendation", "accessLevel": "Write", "resourceTypes": [ { "name": "recommendation", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteregistry": { "name": "DeleteRegistry", "description": "Grants permission to delete an existing registry", "accessLevel": "Write", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteregistryrecord": { "name": "DeleteRegistryRecord", "description": "Grants permission to delete an existing registry record", "accessLevel": "Write", "resourceTypes": [ { "name": "registry-record", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteresourcepolicy": { "name": "DeleteResourcePolicy", "description": "Grants permission to delete the resource-based policy for a Bedrock resource", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "deleteworkloadidentity": { "name": "DeleteWorkloadIdentity", "description": "Grants permission to delete a registered Workload Identity", "accessLevel": "Write", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "evaluate": { "name": "Evaluate", "description": "Grants permission to run an evaluation using an evaluator", "accessLevel": "Write", "resourceTypes": [ { "name": "evaluator", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getabtest": { "name": "GetABTest", "description": "Grants permission to get details of an A/B test", "accessLevel": "Read", "resourceTypes": [ { "name": "ab-test", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getagentcard": { "name": "GetAgentCard", "description": "Grants permission to retrieve an agent card for A2A", "accessLevel": "Read", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getagentruntime": { "name": "GetAgentRuntime", "description": "Grants permission to get details of an agent runtime", "accessLevel": "Read", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getagentruntimeendpoint": { "name": "GetAgentRuntimeEndpoint", "description": "Grants permission to get details of an agent runtime endpoint", "accessLevel": "Read", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getapikeycredentialprovider": { "name": "GetApiKeyCredentialProvider", "description": "Grants permission to fetch a registered API Key Credential Provider by its name", "accessLevel": "Read", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getbatchevaluation": { "name": "GetBatchEvaluation", "description": "Grants permission to get details of a batch evaluation", "accessLevel": "Read", "resourceTypes": [ { "name": "batch-evaluate", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getbrowser": { "name": "GetBrowser", "description": "Grants permission to get details of a browser", "accessLevel": "Read", "resourceTypes": [ { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getbrowserprofile": { "name": "GetBrowserProfile", "description": "Grants permission to get details of a browser profile", "accessLevel": "Read", "resourceTypes": [ { "name": "browser-profile", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getbrowsersession": { "name": "GetBrowserSession", "description": "Grants permission to get details of a browser session", "accessLevel": "Read", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getcodeinterpreter": { "name": "GetCodeInterpreter", "description": "Grants permission to get details of a code interpreter", "accessLevel": "Read", "resourceTypes": [ { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getcodeinterpretersession": { "name": "GetCodeInterpreterSession", "description": "Grants permission to get details of a code interpreter session", "accessLevel": "Read", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getconfigurationbundle": { "name": "GetConfigurationBundle", "description": "Grants permission to get details of a configuration bundle", "accessLevel": "Read", "resourceTypes": [ { "name": "configuration-bundle", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getconfigurationbundleversion": { "name": "GetConfigurationBundleVersion", "description": "Grants permission to get a specific version of a configuration bundle", "accessLevel": "Read", "resourceTypes": [ { "name": "configuration-bundle", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getevaluator": { "name": "GetEvaluator", "description": "Grants permission to get details of an evaluator", "accessLevel": "Read", "resourceTypes": [ { "name": "evaluator", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getevent": { "name": "GetEvent", "description": "Grants permission to fetch an Event", "accessLevel": "Read", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "getgateway": { "name": "GetGateway", "description": "Grants permission to retrieve an existing gateway", "accessLevel": "Read", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getgatewayrule": { "name": "GetGatewayRule", "description": "Grants permission to retrieve an existing gateway rule", "accessLevel": "Read", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getgatewaytarget": { "name": "GetGatewayTarget", "description": "Grants permission to retrieve an existing gateway target", "accessLevel": "Read", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getharness": { "name": "GetHarness", "description": "Grants permission to get details of a harness", "accessLevel": "Read", "resourceTypes": [ { "name": "harness", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getmemory": { "name": "GetMemory", "description": "Grants permission to fetch details for a Memory resource", "accessLevel": "Read", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getmemoryrecord": { "name": "GetMemoryRecord", "description": "Grants permission to fetch a Memory Record", "accessLevel": "Read", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getoauth2credentialprovider": { "name": "GetOauth2CredentialProvider", "description": "Grants permission to fetch a registered OAuth2 Credential Provider by its name", "accessLevel": "Read", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getonlineevaluationconfig": { "name": "GetOnlineEvaluationConfig", "description": "Grants permission to get details of an online evaluation configuration", "accessLevel": "Read", "resourceTypes": [ { "name": "online-evaluation-config", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpaymentconnector": { "name": "GetPaymentConnector", "description": "Grants permission to retrieve details of a payment connector", "accessLevel": "Read", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpaymentcredentialprovider": { "name": "GetPaymentCredentialProvider", "description": "Grants permission to fetch a registered Payment Credential Provider by its name", "accessLevel": "Read", "resourceTypes": [ { "name": "paymentcredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpaymentinstrument": { "name": "GetPaymentInstrument", "description": "Grants permission to retrieve details of a payment instrument", "accessLevel": "Read", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpaymentinstrumentbalance": { "name": "GetPaymentInstrumentBalance", "description": "Grants permission to retrieve the balance of a payment instrument", "accessLevel": "Read", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpaymentmanager": { "name": "GetPaymentManager", "description": "Grants permission to retrieve details of a payment manager", "accessLevel": "Read", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpaymentsession": { "name": "GetPaymentSession", "description": "Grants permission to retrieve details of a payment session", "accessLevel": "Read", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpolicy": { "name": "GetPolicy", "description": "Grants permission to retrieve a policy", "accessLevel": "Read", "resourceTypes": [ { "name": "policy", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpolicyengine": { "name": "GetPolicyEngine", "description": "Grants permission to retrieve a policy engine", "accessLevel": "Read", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpolicyenginesummary": { "name": "GetPolicyEngineSummary", "description": "Grants permission to retrieve a summary of a policy engine", "accessLevel": "Read", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpolicygeneration": { "name": "GetPolicyGeneration", "description": "Grants permission to retrieve status and results of a policy generation request", "accessLevel": "Read", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-generation", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpolicygenerationsummary": { "name": "GetPolicyGenerationSummary", "description": "Grants permission to retrieve a summary of a policy generation request", "accessLevel": "Read", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-generation", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getpolicysummary": { "name": "GetPolicySummary", "description": "Grants permission to retrieve a summary of a policy", "accessLevel": "Read", "resourceTypes": [ { "name": "policy", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getrecommendation": { "name": "GetRecommendation", "description": "Grants permission to get details of a recommendation", "accessLevel": "Read", "resourceTypes": [ { "name": "recommendation", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getregistry": { "name": "GetRegistry", "description": "Grants permission to retrieve an existing registry", "accessLevel": "Read", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getregistryrecord": { "name": "GetRegistryRecord", "description": "Grants permission to retrieve an existing registry record", "accessLevel": "Read", "resourceTypes": [ { "name": "registry-record", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getresourceapikey": { "name": "GetResourceApiKey", "description": "Grants permission to retrieve an API Key associated with an Api Key Credential Provider", "accessLevel": "Read", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getresourceoauth2token": { "name": "GetResourceOauth2Token", "description": "Grants permission to retrieve access token with OAuth2 2LO or 3LO flow to access external resource", "accessLevel": "Read", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getresourcepaymenttoken": { "name": "GetResourcePaymentToken", "description": "Grants permission to retrieve a payment authentication token associated with a Payment Credential Provider", "accessLevel": "Read", "resourceTypes": [ { "name": "paymentcredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getresourcepolicy": { "name": "GetResourcePolicy", "description": "Grants permission to retrieve the resource-based policy for a Bedrock resource", "accessLevel": "Read", "resourceTypes": [ { "name": "gateway", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "gettokenvault": { "name": "GetTokenVault", "description": "Grants permission to fetch the current configuration of the TokenVault, including encryption settings", "accessLevel": "Read", "resourceTypes": [ { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getworkloadaccesstoken": { "name": "GetWorkloadAccessToken", "description": "Grants permission to retrieve an Workload access token for agentic workloads not acting on behalf of a user", "accessLevel": "Write", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "getworkloadaccesstokenforjwt": { "name": "GetWorkloadAccessTokenForJWT", "description": "Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with JWT token", "accessLevel": "Write", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:InboundJwtClaim/iss", "bedrock-agentcore:InboundJwtClaim/sub", "bedrock-agentcore:InboundJwtClaim/aud", "bedrock-agentcore:InboundJwtClaim/scope", "bedrock-agentcore:InboundJwtClaim/client_id" ], "dependentActions": [] }, "getworkloadaccesstokenforuserid": { "name": "GetWorkloadAccessTokenForUserId", "description": "Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with User Id", "accessLevel": "Write", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:userid" ], "dependentActions": [] }, "getworkloadidentity": { "name": "GetWorkloadIdentity", "description": "Grants permission to fetch details for a specific Workload identity, including its name and allowed OAuth2 return URLs", "accessLevel": "Read", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokeagentruntime": { "name": "InvokeAgentRuntime", "description": "Grants permission to invoke an agent runtime endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokeagentruntimecommand": { "name": "InvokeAgentRuntimeCommand", "description": "Grants permission to invoke commands on an agent runtime endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokeagentruntimeforuser": { "name": "InvokeAgentRuntimeForUser", "description": "Grants permission to invoke an agent runtime endpoint with X-Amzn-Bedrock-AgentCore-Runtime-User-Id header", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokeagentruntimewithwebsocketstream": { "name": "InvokeAgentRuntimeWithWebSocketStream", "description": "Grants permission to invoke an agent runtime endpoint with WebSocket stream", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokeagentruntimewithwebsocketstreamforuser": { "name": "InvokeAgentRuntimeWithWebSocketStreamForUser", "description": "Grants permission to invoke an agent runtime endpoint with WebSocket stream and with X-Amzn-Bedrock-AgentCore-Runtime-User-Id header", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokecodeinterpreter": { "name": "InvokeCodeInterpreter", "description": "Grants permission to invoke a code interpreter session", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokegateway": { "name": "InvokeGateway", "isPermissionOnly": true, "description": "Grants permission to invoke a gateway", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "invokeharness": { "name": "InvokeHarness", "description": "Grants permission to invoke a harness", "accessLevel": "Write", "resourceTypes": [ { "name": "harness", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "bedrock-agentcore:InvokeAgentRuntime" ] }, "invokeregistrymcp": { "name": "InvokeRegistryMcp", "description": "Grants permission to invoke an MCP operation against an existing registry", "accessLevel": "Read", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listabtests": { "name": "ListABTests", "description": "Grants permission to list A/B tests", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listactors": { "name": "ListActors", "description": "Grants permission to list Actors", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listagentruntimeendpoints": { "name": "ListAgentRuntimeEndpoints", "description": "Grants permission to list agent runtime endpoints", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listagentruntimeversions": { "name": "ListAgentRuntimeVersions", "description": "Grants permission to list agent runtime versions", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listagentruntimes": { "name": "ListAgentRuntimes", "description": "Grants permission to list agent runtimes", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listapikeycredentialproviders": { "name": "ListApiKeyCredentialProviders", "description": "Grants permission to list all API Key Credential Providers in the Token Vault", "accessLevel": "Read", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listbatchevaluations": { "name": "ListBatchEvaluations", "description": "Grants permission to list batch evaluations", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listbrowserprofiles": { "name": "ListBrowserProfiles", "description": "Grants permission to list browser profiles", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listbrowsersessions": { "name": "ListBrowserSessions", "description": "Grants permission to list browser sessions", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listbrowsers": { "name": "ListBrowsers", "description": "Grants permission to list browsers", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listcodeinterpretersessions": { "name": "ListCodeInterpreterSessions", "description": "Grants permission to list code interpreter sessions", "accessLevel": "List", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listcodeinterpreters": { "name": "ListCodeInterpreters", "description": "Grants permission to list code interpreters", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listconfigurationbundleversions": { "name": "ListConfigurationBundleVersions", "description": "Grants permission to list versions of a configuration bundle", "accessLevel": "List", "resourceTypes": [ { "name": "configuration-bundle", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listconfigurationbundles": { "name": "ListConfigurationBundles", "description": "Grants permission to list configuration bundles", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listevaluators": { "name": "ListEvaluators", "description": "Grants permission to list evaluators", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listevents": { "name": "ListEvents", "description": "Grants permission to list events", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "listgatewayrules": { "name": "ListGatewayRules", "description": "Grants permission to list existing gateway rules", "accessLevel": "List", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listgatewaytargets": { "name": "ListGatewayTargets", "description": "Grants permission to list existing gateway targets", "accessLevel": "List", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listgateways": { "name": "ListGateways", "description": "Grants permission to list existing gateways", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listharnesses": { "name": "ListHarnesses", "description": "Grants permission to list harnesses", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listmemories": { "name": "ListMemories", "description": "Grants permission to list memory resources", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listmemoryextractionjobs": { "name": "ListMemoryExtractionJobs", "description": "Grants permission to list extraction jobs for this memory", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listmemoryrecords": { "name": "ListMemoryRecords", "description": "Grants permission to list memory records", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:namespace", "bedrock-agentcore:strategyId" ], "dependentActions": [] }, "listoauth2credentialproviders": { "name": "ListOauth2CredentialProviders", "description": "Grants permission to list all OAuth2 Credential Providers in the Token Vault", "accessLevel": "Read", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listonlineevaluationconfigs": { "name": "ListOnlineEvaluationConfigs", "description": "Grants permission to list online evaluation configurations", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listpaymentconnectors": { "name": "ListPaymentConnectors", "description": "Grants permission to list payment connectors under a payment manager", "accessLevel": "List", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpaymentcredentialproviders": { "name": "ListPaymentCredentialProviders", "description": "Grants permission to list all Payment Credential Providers in the Token Vault", "accessLevel": "List", "resourceTypes": [ { "name": "paymentcredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpaymentinstruments": { "name": "ListPaymentInstruments", "description": "Grants permission to list payment instruments", "accessLevel": "List", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpaymentmanagers": { "name": "ListPaymentManagers", "description": "Grants permission to list payment managers", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listpaymentsessions": { "name": "ListPaymentSessions", "description": "Grants permission to list payment sessions", "accessLevel": "List", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpolicies": { "name": "ListPolicies", "description": "Grants permission to list policies within a policy engine", "accessLevel": "List", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpolicyenginesummaries": { "name": "ListPolicyEngineSummaries", "description": "Grants permission to list policy engine summaries", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listpolicyengines": { "name": "ListPolicyEngines", "description": "Grants permission to list policy engines", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listpolicygenerationassets": { "name": "ListPolicyGenerationAssets", "description": "Grants permission to list generated policy assets from a generation request", "accessLevel": "List", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-generation", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpolicygenerationsummaries": { "name": "ListPolicyGenerationSummaries", "description": "Grants permission to list policy generation summaries", "accessLevel": "List", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpolicygenerations": { "name": "ListPolicyGenerations", "description": "Grants permission to list policy generation requests", "accessLevel": "List", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listpolicysummaries": { "name": "ListPolicySummaries", "description": "Grants permission to list policy summaries within a policy engine", "accessLevel": "List", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listrecommendations": { "name": "ListRecommendations", "description": "Grants permission to list recommendations", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listregistries": { "name": "ListRegistries", "description": "Grants permission to list existing registries", "accessLevel": "List", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "listregistryrecords": { "name": "ListRegistryRecords", "description": "Grants permission to list existing registry records in a registry", "accessLevel": "List", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listsessions": { "name": "ListSessions", "description": "Grants permission to list sessions", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:actorId" ], "dependentActions": [] }, "listtagsforresource": { "name": "ListTagsForResource", "description": "Grants permission to list tags for a Bedrock-AgentCore resource", "accessLevel": "List", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-profile", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "evaluator", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "gateway", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "harness", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "memory", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "oauth2credentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "online-evaluation-config", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "payment-manager", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "paymentcredentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "listworkloadidentities": { "name": "ListWorkloadIdentities", "description": "Grants permission to list all Workload Identities in the caller's AWS account", "accessLevel": "Read", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "manageadminpolicy": { "name": "ManageAdminPolicy", "isPermissionOnly": true, "description": "Grants permission to create or modify wildcard policies that apply to gateway resources", "accessLevel": "Permissions management", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "manageresourcescopedpolicy": { "name": "ManageResourceScopedPolicy", "isPermissionOnly": true, "description": "Grants permission to create or modify policies that apply to specific gateway resources", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "partiallyauthorizeactions": { "name": "PartiallyAuthorizeActions", "isPermissionOnly": true, "description": "Grants permission to perform partial evaluation of Cedar policies to authorize a caller to list tools they are allowed to call", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "processpayment": { "name": "ProcessPayment", "description": "Grants permission to process a payment transaction", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "putresourcepolicy": { "name": "PutResourcePolicy", "description": "Grants permission to create or update the resource-based policy for a Bedrock resource", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "retrievememoryrecords": { "name": "RetrieveMemoryRecords", "description": "Grants permission to retrieve memory records through sematic query", "accessLevel": "List", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:namespace", "bedrock-agentcore:strategyId" ], "dependentActions": [] }, "savebrowsersessionprofile": { "name": "SaveBrowserSessionProfile", "description": "Grants permission to save a browser session profile", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-profile", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "searchregistryrecords": { "name": "SearchRegistryRecords", "description": "Grants permission to search for registry records", "accessLevel": "Read", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "settokenvaultcmk": { "name": "SetTokenVaultCMK", "description": "Grants permission to associate a Customer Managed Key (CMK) or a Service Managed Key with a specific TokenVault", "accessLevel": "Write", "resourceTypes": [ { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "startbatchevaluation": { "name": "StartBatchEvaluation", "description": "Grants permission to start a batch evaluation", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "startbrowsersession": { "name": "StartBrowserSession", "description": "Grants permission to start a new browser session", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-profile", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "startcodeinterpretersession": { "name": "StartCodeInterpreterSession", "description": "Grants permission to start a new code interpreter session", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "startmemoryextractionjob": { "name": "StartMemoryExtractionJob", "description": "Grants permission to start memory extraction job", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "bedrock-agentcore:strategyId", "bedrock-agentcore:sessionId", "bedrock-agentcore:actorId" ], "dependentActions": [] }, "startpolicygeneration": { "name": "StartPolicyGeneration", "description": "Grants permission to start an AI-powered policy generation request", "accessLevel": "Write", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "startrecommendation": { "name": "StartRecommendation", "description": "Grants permission to start a recommendation", "accessLevel": "Write", "resourceTypes": [], "conditionKeys": [], "dependentActions": [] }, "stopbatchevaluation": { "name": "StopBatchEvaluation", "description": "Grants permission to stop a batch evaluation", "accessLevel": "Write", "resourceTypes": [ { "name": "batch-evaluate", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "stopbrowsersession": { "name": "StopBrowserSession", "description": "Grants permission to stop a browser session", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "stopcodeinterpretersession": { "name": "StopCodeInterpreterSession", "description": "Grants permission to stop a code interpreter session", "accessLevel": "Write", "resourceTypes": [ { "name": "code-interpreter", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "stopruntimesession": { "name": "StopRuntimeSession", "description": "Grants permission to stop a runtime session", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "submitregistryrecordforapproval": { "name": "SubmitRegistryRecordForApproval", "description": "Grants permission to submit a registry record for approval", "accessLevel": "Write", "resourceTypes": [ { "name": "registry-record", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "synchronizegatewaytargets": { "name": "SynchronizeGatewayTargets", "isPermissionOnly": true, "description": "Grants permission to enable search on gateways", "accessLevel": "Permissions management", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "tagresource": { "name": "TagResource", "description": "Grants permission to Tag a Bedrock-AgentCore resource", "accessLevel": "Tagging", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-profile", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "evaluator", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "gateway", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "harness", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "memory", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "oauth2credentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "online-evaluation-config", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "payment-manager", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "paymentcredentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:TagKeys", "aws:RequestTag/${TagKey}" ], "dependentActions": [] }, "untagresource": { "name": "UntagResource", "description": "Grants permission to Untag a Bedrock-AgentCore resource", "accessLevel": "Tagging", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-profile", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "code-interpreter-custom", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "evaluator", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "gateway", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "harness", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "memory", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "oauth2credentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "online-evaluation-config", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "payment-manager", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "paymentcredentialprovider", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity", "required": false, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": false, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [ "aws:TagKeys" ], "dependentActions": [] }, "updateabtest": { "name": "UpdateABTest", "description": "Grants permission to update an A/B test", "accessLevel": "Write", "resourceTypes": [ { "name": "ab-test", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updateagentruntime": { "name": "UpdateAgentRuntime", "description": "Grants permission to update an agent runtime", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] } ], "conditionKeys": [ "bedrock-agentcore:subnets", "bedrock-agentcore:securityGroups", "bedrock-agentcore:RuntimeAuthorizerType" ], "dependentActions": [] }, "updateagentruntimeendpoint": { "name": "UpdateAgentRuntimeEndpoint", "description": "Grants permission to update an agent runtime endpoint", "accessLevel": "Write", "resourceTypes": [ { "name": "runtime", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "runtime-endpoint", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateapikeycredentialprovider": { "name": "UpdateApiKeyCredentialProvider", "description": "Grants permission to update an existing API Key Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "apikeycredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updatebrowserstream": { "name": "UpdateBrowserStream", "description": "Grants permission to update the status of browser session stream", "accessLevel": "Write", "resourceTypes": [ { "name": "browser", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "browser-custom", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateconfigurationbundle": { "name": "UpdateConfigurationBundle", "description": "Grants permission to update a configuration bundle", "accessLevel": "Write", "resourceTypes": [ { "name": "configuration-bundle", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateevaluator": { "name": "UpdateEvaluator", "description": "Grants permission to update an evaluator", "accessLevel": "Write", "resourceTypes": [ { "name": "evaluator", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updategateway": { "name": "UpdateGateway", "description": "Grants permission to update an existing gateway", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updategatewayrule": { "name": "UpdateGatewayRule", "description": "Grants permission to update an existing gateway rule", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updategatewaytarget": { "name": "UpdateGatewayTarget", "description": "Grants permission to update an existing gateway target", "accessLevel": "Write", "resourceTypes": [ { "name": "gateway", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateharness": { "name": "UpdateHarness", "description": "Grants permission to update a harness", "accessLevel": "Write", "resourceTypes": [ { "name": "harness", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:UpdateAgentRuntime", "iam:PassRole" ] }, "updatememory": { "name": "UpdateMemory", "description": "Grants permission to update a Memory resource", "accessLevel": "Write", "resourceTypes": [ { "name": "memory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updateoauth2credentialprovider": { "name": "UpdateOauth2CredentialProvider", "description": "Grants permission to update an existing OAuth2 Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "oauth2credentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateonlineevaluationconfig": { "name": "UpdateOnlineEvaluationConfig", "description": "Grants permission to update an online evaluation configuration", "accessLevel": "Write", "resourceTypes": [ { "name": "online-evaluation-config", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updatepaymentconnector": { "name": "UpdatePaymentConnector", "description": "Grants permission to update an existing payment connector", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updatepaymentcredentialprovider": { "name": "UpdatePaymentCredentialProvider", "description": "Grants permission to update an existing Payment Credential Provider", "accessLevel": "Write", "resourceTypes": [ { "name": "paymentcredentialprovider", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "token-vault", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updatepaymentmanager": { "name": "UpdatePaymentManager", "description": "Grants permission to update an existing payment manager", "accessLevel": "Write", "resourceTypes": [ { "name": "payment-manager", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [ "iam:PassRole" ] }, "updatepolicy": { "name": "UpdatePolicy", "description": "Grants permission to update an existing policy", "accessLevel": "Write", "resourceTypes": [ { "name": "policy", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updatepolicyengine": { "name": "UpdatePolicyEngine", "description": "Grants permission to update a policy engine", "accessLevel": "Write", "resourceTypes": [ { "name": "policy-engine", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateregistry": { "name": "UpdateRegistry", "description": "Grants permission to update an existing registry", "accessLevel": "Write", "resourceTypes": [ { "name": "registry", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateregistryrecord": { "name": "UpdateRegistryRecord", "description": "Grants permission to update an existing registry record", "accessLevel": "Write", "resourceTypes": [ { "name": "registry-record", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateregistryrecordstatus": { "name": "UpdateRegistryRecordStatus", "description": "Grants permission to update the status of a registry record", "accessLevel": "Write", "resourceTypes": [ { "name": "registry-record", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] }, "updateworkloadidentity": { "name": "UpdateWorkloadIdentity", "description": "Grants permission to update the metadata of an existing Workload Identity", "accessLevel": "Write", "resourceTypes": [ { "name": "workload-identity", "required": true, "conditionKeys": [], "dependentActions": [] }, { "name": "workload-identity-directory", "required": true, "conditionKeys": [], "dependentActions": [] } ], "conditionKeys": [], "dependentActions": [] } }