{
  "addtagstocertificate": {
    "name": "AddTagsToCertificate",
    "description": "Grants permission to add one or more tags to a certificate",
    "accessLevel": "Tagging, Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "acm:CertificateKeyPairOrigin",
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "createacmedomainvalidation": {
    "name": "CreateAcmeDomainValidation",
    "description": "Grants permission to create an ACME domain validation",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "createacmeendpoint": {
    "name": "CreateAcmeEndpoint",
    "description": "Grants permission to create an ACME endpoint",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "createacmeexternalaccountbinding": {
    "name": "CreateAcmeExternalAccountBinding",
    "description": "Grants permission to create an ACME external account binding",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "deleteacmedomainvalidation": {
    "name": "DeleteAcmeDomainValidation",
    "description": "Grants permission to delete an ACME domain validation",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-domain-validation",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deleteacmeendpoint": {
    "name": "DeleteAcmeEndpoint",
    "description": "Grants permission to delete an ACME endpoint",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deleteacmeexternalaccountbinding": {
    "name": "DeleteAcmeExternalAccountBinding",
    "description": "Grants permission to delete an ACME external account binding",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-external-account-binding",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deletecertificate": {
    "name": "DeleteCertificate",
    "description": "Grants permission to delete a certificate and its associated private key",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "acm:CertificateKeyPairOrigin"
    ],
    "dependentActions": []
  },
  "describeacmeaccount": {
    "name": "DescribeAcmeAccount",
    "description": "Grants permission to retrieve details of an ACME account",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "describeacmedomainvalidation": {
    "name": "DescribeAcmeDomainValidation",
    "description": "Grants permission to retrieve details of an ACME domain validation",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "acme-domain-validation",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "describeacmeendpoint": {
    "name": "DescribeAcmeEndpoint",
    "description": "Grants permission to retrieve details of an ACME endpoint",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "describeacmeexternalaccountbinding": {
    "name": "DescribeAcmeExternalAccountBinding",
    "description": "Grants permission to retrieve details of an ACME external account binding",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "acme-external-account-binding",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "describecertificate": {
    "name": "DescribeCertificate",
    "description": "Grants permission to retreive a certificates and its metadata",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "exportcertificate": {
    "name": "ExportCertificate",
    "description": "Grants permission to export an exportable certificate for use anywhere",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "acm:DomainNames"
    ],
    "dependentActions": []
  },
  "getaccountconfiguration": {
    "name": "GetAccountConfiguration",
    "description": "Grants permission to retrieve account level configuration from AWS Certificate Manager",
    "accessLevel": "Read",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getacmeexternalaccountbindingcredentials": {
    "name": "GetAcmeExternalAccountBindingCredentials",
    "description": "Grants permission to retrieve credentials for an ACME external account binding",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "acme-external-account-binding",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getcertificate": {
    "name": "GetCertificate",
    "description": "Grants permission to retrieve a certificate and certificate chain for a certificate ARN",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "importcertificate": {
    "name": "ImportCertificate",
    "description": "Grants permission to import a 3rd party certificate into AWS Certificate Manager (ACM)",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "listacmeaccounts": {
    "name": "ListAcmeAccounts",
    "description": "Grants permission to list ACME accounts",
    "accessLevel": "List",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listacmedomainvalidations": {
    "name": "ListAcmeDomainValidations",
    "description": "Grants permission to list ACME domain validations",
    "accessLevel": "List",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listacmeendpoints": {
    "name": "ListAcmeEndpoints",
    "description": "Grants permission to list ACME endpoints",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listacmeexternalaccountbindings": {
    "name": "ListAcmeExternalAccountBindings",
    "description": "Grants permission to list ACME external account bindings",
    "accessLevel": "List",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listcertificates": {
    "name": "ListCertificates",
    "description": "Grants permission to retrieve a list of certificates for specific certificate parameters",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listtagsforcertificate": {
    "name": "ListTagsForCertificate",
    "description": "Grants permission to lists the tags that have been associated with a certificate",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listtagsforresource": {
    "name": "ListTagsForResource",
    "description": "Grants permission to list tags for a resource",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "acme-domain-validation",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      },
      {
        "name": "acme-endpoint",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      },
      {
        "name": "acme-external-account-binding",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "putaccountconfiguration": {
    "name": "PutAccountConfiguration",
    "description": "Grants permission to update account level configuration in AWS Certificate Manager",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "removetagsfromcertificate": {
    "name": "RemoveTagsFromCertificate",
    "description": "Grants permission to remove one or more tags from a certificate",
    "accessLevel": "Tagging, Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "renewcertificate": {
    "name": "RenewCertificate",
    "description": "Grants permission to renew an eligible private certificate",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "requestcertificate": {
    "name": "RequestCertificate",
    "description": "Grants permission to requests a public or private certificate",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [
      "acm:CertificateAuthority",
      "acm:CertificateKeyPairOrigin",
      "acm:CertificateTransparencyLogging",
      "acm:DomainNames",
      "acm:Export",
      "acm:KeyAlgorithm",
      "acm:ValidationMethod",
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "resendvalidationemail": {
    "name": "ResendValidationEmail",
    "description": "Grants permission to resend an email to request domain ownership validation",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "revokeacmeaccount": {
    "name": "RevokeAcmeAccount",
    "description": "Grants permission to revoke an ACME account",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "revokeacmeexternalaccountbinding": {
    "name": "RevokeAcmeExternalAccountBinding",
    "description": "Grants permission to revoke an ACME external account binding",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-external-account-binding",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "revokecertificate": {
    "name": "RevokeCertificate",
    "description": "Grants permission to revoke an exportable certificate",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "acm:CertificateKeyPairOrigin",
      "acm:DomainNames"
    ],
    "dependentActions": []
  },
  "searchcertificates": {
    "name": "SearchCertificates",
    "description": "Grants permission to retrieve a list of certificates matching search criteria",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "tagresource": {
    "name": "TagResource",
    "description": "Grants permission to add tags to a resource",
    "accessLevel": "Tagging, Write",
    "resourceTypes": [
      {
        "name": "acme-domain-validation",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      },
      {
        "name": "acme-endpoint",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      },
      {
        "name": "acme-external-account-binding",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:RequestTag/${TagKey}",
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "untagresource": {
    "name": "UntagResource",
    "description": "Grants permission to remove tags from a resource",
    "accessLevel": "Tagging, Write",
    "resourceTypes": [
      {
        "name": "acme-domain-validation",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      },
      {
        "name": "acme-endpoint",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      },
      {
        "name": "acme-external-account-binding",
        "required": false,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "aws:TagKeys"
    ],
    "dependentActions": []
  },
  "updateacmedomainvalidation": {
    "name": "UpdateAcmeDomainValidation",
    "description": "Grants permission to update an ACME domain validation",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-domain-validation",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "updateacmeendpoint": {
    "name": "UpdateAcmeEndpoint",
    "description": "Grants permission to update an ACME endpoint",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "acme-endpoint",
        "required": true,
        "conditionKeys": [
          "aws:ResourceTag/${TagKey}"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "updatecertificate": {
    "name": "UpdateCertificate",
    "description": "Grants permission to update a certificate",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "acm:CertificateKeyPairOrigin"
    ],
    "dependentActions": []
  },
  "updatecertificateoptions": {
    "name": "UpdateCertificateOptions",
    "description": "Grants permission to update a certificate configuration. Use this to specify whether to opt in to or out of certificate transparency logging",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "certificate",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  }
}