{
  "createaccount": {
    "name": "CreateAccount",
    "description": "Grants permission to create an AWS account through the AWS Management Console sign-up flow",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "console",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "authenticate": {
    "name": "Authenticate",
    "description": "Grants permission to authenticate to the AWS Management Console",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "console",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "signin:PrincipalArn"
    ],
    "dependentActions": []
  },
  "authorizeoauth2access": {
    "name": "AuthorizeOAuth2Access",
    "description": "Grants permission to authenticate through a browser and obtain an OAuth 2.0 authorization code for credential exchange",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "console",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "oauth2-public-client-localhost",
        "required": true,
        "conditionKeys": [
          "signin:OAuthClientId",
          "signin:OAuthRedirectUri"
        ],
        "dependentActions": []
      },
      {
        "name": "oauth2-public-client-remote",
        "required": true,
        "conditionKeys": [
          "signin:OAuthClientId",
          "signin:OAuthRedirectUri"
        ],
        "dependentActions": []
      },
      {
        "name": "oauth2-resource-service-principal",
        "required": true,
        "conditionKeys": [
          "signin:OAuthClientId",
          "signin:OAuthRedirectUri"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "createoauth2publicclient": {
    "name": "CreateOAuth2PublicClient",
    "description": "Grants permission to dynamically register an OAuth 2.0 public client for use with AWS Sign-In",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "oauth2-public-client-registration",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "signin:OAuthRedirectUri"
    ],
    "dependentActions": []
  },
  "createoauth2token": {
    "name": "CreateOAuth2Token",
    "description": "Grants permission to exchange an authorization code for OAuth 2.0 access token and refresh token that can be used to access AWS services from developer tools and applications",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "console",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "oauth2-public-client-localhost",
        "required": true,
        "conditionKeys": [
          "signin:OAuthClientAuthentication",
          "signin:OAuthClientId",
          "signin:OAuthGrantType",
          "signin:OAuthRedirectUri"
        ],
        "dependentActions": []
      },
      {
        "name": "oauth2-public-client-remote",
        "required": true,
        "conditionKeys": [
          "signin:OAuthClientAuthentication",
          "signin:OAuthClientId",
          "signin:OAuthGrantType",
          "signin:OAuthRedirectUri"
        ],
        "dependentActions": []
      },
      {
        "name": "oauth2-resource-service-principal",
        "required": true,
        "conditionKeys": [
          "signin:OAuthClientAuthentication",
          "signin:OAuthClientId",
          "signin:OAuthGrantType",
          "signin:OAuthRedirectUri"
        ],
        "dependentActions": []
      }
    ],
    "conditionKeys": [],
    "dependentActions": []
  },
  "createtrustedidentitypropagationapplicationforconsole": {
    "name": "CreateTrustedIdentityPropagationApplicationForConsole",
    "description": "Grants permission to create an Identity Center application that represents the AWS Management Console on an Identity Center organization instance",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deleteconsoleauthorizationconfiguration": {
    "name": "DeleteConsoleAuthorizationConfiguration",
    "description": "Grants permission to disable console authorization configuration for an AWS account or organization",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "deleteresourcepermissionstatement": {
    "name": "DeleteResourcePermissionStatement",
    "description": "Grants permission to remove a permission statement from the account's SignIn Resource Based Policy",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getconsoleauthorizationconfiguration": {
    "name": "GetConsoleAuthorizationConfiguration",
    "description": "Grants permission to retrieve console authorization configuration for an AWS account or organization",
    "accessLevel": "Read",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "getresourcepolicy": {
    "name": "GetResourcePolicy",
    "description": "Grants permission to retrieve SignIn Resource Based Policy document that is attached with your account",
    "accessLevel": "Read",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "introspectoauth2token": {
    "name": "IntrospectOAuth2Token",
    "description": "Grants permission to inspect the metadata and active state of an OAuth 2.0 access token or refresh token",
    "accessLevel": "Read",
    "resourceTypes": [
      {
        "name": "oauth2-public-client-localhost",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "oauth2-public-client-remote",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "oauth2-resource-service-principal",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "signin:OAuthClientId",
      "signin:OAuthTokenType"
    ],
    "dependentActions": []
  },
  "listresourcepermissionstatements": {
    "name": "ListResourcePermissionStatements",
    "description": "Grants permission to list the SignIn Resource Based Policy statements in your account",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "listtrustedidentitypropagationapplicationsforconsole": {
    "name": "ListTrustedIdentityPropagationApplicationsForConsole",
    "description": "Grants permission to list all Identity Center applications that represent the AWS Management Console",
    "accessLevel": "List",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "putconsoleauthorizationconfiguration": {
    "name": "PutConsoleAuthorizationConfiguration",
    "description": "Grants permission to enable console authorization configuration for an AWS account or organization",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "putresourcepermissionstatement": {
    "name": "PutResourcePermissionStatement",
    "description": "Grants permission to create a permission statement in the account's SignIn resource-based policy",
    "accessLevel": "Write",
    "resourceTypes": [],
    "conditionKeys": [],
    "dependentActions": []
  },
  "revokeoauth2token": {
    "name": "RevokeOAuth2Token",
    "description": "Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens",
    "accessLevel": "Write",
    "resourceTypes": [
      {
        "name": "oauth2-public-client-localhost",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "oauth2-public-client-remote",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      },
      {
        "name": "oauth2-resource-service-principal",
        "required": true,
        "conditionKeys": [],
        "dependentActions": []
      }
    ],
    "conditionKeys": [
      "signin:OAuthTokenType"
    ],
    "dependentActions": []
  }
}