Adds latest IAM updates from AWS

CHANGELOG/v0.819.0.md

@@ -0,0 +1,30 @@
+**New actions:**
+
+- acm:ListCertificateDomainValidations
+- iam:GetAccountProperties
+- iam:GetRoleTemplateVersion
+- iam:PutAccountProperties
+- odb:AssociateVirtualMachinesToExadbVmCluster
+- odb:CreateExadbVmCluster
+- odb:CreateExascaleDbStorageVault
+- odb:DeleteExadbVmCluster
+- odb:DeleteExascaleDbStorageVault
+- odb:DisassociateVirtualMachinesFromExadbVmCluster
+- odb:GetExadbVmCluster
+- odb:GetExascaleDbStorageVault
+- odb:ListExadbVmClusters
+- odb:ListExascaleDbStorageVaults
+- odb:ListGiMinorVersions
+- odb:UpdateExadbVmCluster
+- odb:UpdateExascaleDbStorageVault
+
+**New resource types:**
+
+- iam:role-template
+- odb:exadb-vm-cluster
+- odb:exascale-db-storage-vault
+
+**New condition keys:**
+
+- iam:AccountPropertyNamespaces
+- iam:RoleTemplateARN

README.md

@@ -16,9 +16,9 @@
 Support for:
 
 - 455 Services
-- 21705 Actions
-- 2292 Resource Types
-- 2448 Condition keys
+- 21722 Actions
+- 2295 Resource Types
+- 2450 Condition keys
 <!-- /stats -->
 
 ![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**

VERSION

@@ -1 +1 @@
-0.818.0
+0.819.0

docs/source/conf.py

@@ -24,7 +24,7 @@
 author = 'Daniel Schroeder'
 
 # The full version, including alpha/beta/rc tags
-release = '0.818.0'
+release = '0.819.0'
 
 # -- General configuration ---------------------------------------------------
 

docs/source/index.rst

@@ -31,9 +31,9 @@ AWS IAM policy statement generator with fluent interface.
 Support for:
 
 - 455 Services
-- 21705 Actions
-- 2292 Resource Types
-- 2448 Condition keys
+- 21722 Actions
+- 2295 Resource Types
+- 2450 Condition keys
 
 ..
    /stats

lib/generated/policy-statements/acm.ts

@@ -264,6 +264,17 @@ export class Acm extends PolicyStatement {
     return this.to('ListAcmeExternalAccountBindings');
   }
 
+  /**
+   * Grants permission to list domain validation methods for a certificate
+   *
+   * Access Level: List
+   *
+   * https://docs.aws.amazon.com/acm/latest/APIReference/API_ListCertificateDomainValidations.html
+   */
+  public toListCertificateDomainValidations() {
+    return this.to('ListCertificateDomainValidations');
+  }
+
   /**
    * Grants permission to retrieve a list of certificates for specific certificate parameters
    *
@@ -463,7 +474,7 @@ export class Acm extends PolicyStatement {
   }
 
   /**
-   * Grants permission to update a certificate configuration. Use this to specify whether to opt in to or out of certificate transparency logging
+   * Grants permission to update a certificate configuration. Use this to specify whether to opt in to or out of certificate transparency logging or to update the certificate domain validation method
    *
    * Access Level: Write
    *
@@ -523,6 +534,7 @@ export class Acm extends PolicyStatement {
       'ListAcmeDomainValidations',
       'ListAcmeEndpoints',
       'ListAcmeExternalAccountBindings',
+      'ListCertificateDomainValidations',
       'ListCertificates',
       'SearchCertificates'
     ]
@@ -701,6 +713,7 @@ export class Acm extends PolicyStatement {
    *
    * Applies to actions:
    * - .toRequestCertificate()
+   * - .toUpdateCertificateOptions()
    *
    * @param value The value(s) to check
    * @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
@@ -757,6 +770,7 @@ export class Acm extends PolicyStatement {
    * - .toListAcmeAccounts()
    * - .toListAcmeDomainValidations()
    * - .toListAcmeExternalAccountBindings()
+   * - .toListCertificateDomainValidations()
    * - .toListTagsForCertificate()
    * - .toListTagsForResource()
    * - .toRemoveTagsFromCertificate()

lib/generated/policy-statements/iam.ts

@@ -755,6 +755,20 @@ export class Iam extends PolicyStatement {
     return this.to('GetAccountPasswordPolicy');
   }
 
+  /**
+   * Grants permission to retrieve account-level properties for IAM features
+   *
+   * Access Level: Read
+   *
+   * Possible conditions:
+   * - .ifAccountPropertyNamespaces()
+   *
+   * https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountProperties.html
+   */
+  public toGetAccountProperties() {
+    return this.to('GetAccountProperties');
+  }
+
   /**
    * Grants permission to retrieve information about IAM entity usage and IAM quotas in the AWS account
    *
@@ -964,6 +978,17 @@ export class Iam extends PolicyStatement {
     return this.to('GetRolePolicy');
   }
 
+  /**
+   * Grants permission to retrieve information about a specific version of a role template
+   *
+   * Access Level: Read
+   *
+   * https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRoleTemplateVersion.html
+   */
+  public toGetRoleTemplateVersion() {
+    return this.to('GetRoleTemplateVersion');
+  }
+
   /**
    * Grants permission to retrieve the SAML provider metadocument that was uploaded when the IAM SAML provider resource was created or updated
    *
@@ -1473,6 +1498,20 @@ export class Iam extends PolicyStatement {
     return this.to('ListVirtualMFADevices');
   }
 
+  /**
+   * Grants permission to set account-level properties for IAM features
+   *
+   * Access Level: Write
+   *
+   * Possible conditions:
+   * - .ifAccountPropertyNamespaces()
+   *
+   * https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutAccountProperties.html
+   */
+  public toPutAccountProperties() {
+    return this.to('PutAccountProperties');
+  }
+
   /**
    * Grants permission to create or update an inline policy document that is embedded in the specified IAM group
    *
@@ -2139,6 +2178,7 @@ export class Iam extends PolicyStatement {
       'EnableOrganizationsRootCredentialsManagement',
       'EnableOrganizationsRootSessions',
       'EnableOutboundWebIdentityFederation',
+      'PutAccountProperties',
       'PutGroupPolicy',
       'PutRolePermissionsBoundary',
       'PutRolePolicy',
@@ -2227,6 +2267,7 @@ export class Iam extends PolicyStatement {
       'GetAccountEmailAddress',
       'GetAccountName',
       'GetAccountPasswordPolicy',
+      'GetAccountProperties',
       'GetCloudFrontPublicKey',
       'GetContextKeysForCustomPolicy',
       'GetContextKeysForPrincipalPolicy',
@@ -2244,6 +2285,7 @@ export class Iam extends PolicyStatement {
       'GetPolicyVersion',
       'GetRole',
       'GetRolePolicy',
+      'GetRoleTemplateVersion',
       'GetSAMLProvider',
       'GetSSHPublicKey',
       'GetServerCertificate',
@@ -2467,6 +2509,20 @@ export class Iam extends PolicyStatement {
     return this.on(`arn:${ partition ?? this.defaultPartition }:iam::${ account ?? this.defaultAccount }:role/${ roleNameWithPath }`);
   }
 
+  /**
+   * Adds a resource of type role-template to the statement
+   *
+   * https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_role-template.html
+   *
+   * @param aWSServicePrincipal - Identifier for the aWSServicePrincipal.
+   * @param roleTemplateName - Identifier for the roleTemplateName.
+   * @param roleTemplateMajorVersion - Identifier for the roleTemplateMajorVersion.
+   * @param partition - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to `aws`, unless using the CDK, where the default is the current Stack's partition.
+   */
+  public onRoleTemplate(aWSServicePrincipal: string, roleTemplateName: string, roleTemplateMajorVersion: string, partition?: string) {
+    return this.on(`arn:${ partition ?? this.defaultPartition }:iam::aws:role-template/${ aWSServicePrincipal }/${ roleTemplateName }:${ roleTemplateMajorVersion }`);
+  }
+
   /**
    * Adds a resource of type saml-provider to the statement
    *
@@ -2759,6 +2815,22 @@ export class Iam extends PolicyStatement {
     return this.if(`AWSServiceName`, value, operator ?? 'StringLike');
   }
 
+  /**
+   * Filters access by the account property namespaces being read or modified
+   *
+   * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_AccountPropertyNamespaces
+   *
+   * Applies to actions:
+   * - .toGetAccountProperties()
+   * - .toPutAccountProperties()
+   *
+   * @param value The value(s) to check
+   * @param operator Works with [string operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String). **Default:** `StringLike`
+   */
+  public ifAccountPropertyNamespaces(value: string | string[], operator?: Operator | string) {
+    return this.if(`AccountPropertyNamespaces`, value, operator ?? 'StringLike');
+  }
+
   /**
    * Filters access by the resource that the role will be used on behalf of
    *
@@ -3064,6 +3136,26 @@ export class Iam extends PolicyStatement {
     return this.if(`ResourceTag/${ tagKey }`, value, operator ?? 'StringLike');
   }
 
+  /**
+   * Filters access by the role template ARN used in the request
+   *
+   * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_RoleTemplateARN
+   *
+   * Applies to actions:
+   * - .toAttachRolePolicy()
+   * - .toCreateRole()
+   * - .toGetRole()
+   * - .toPutRolePermissionsBoundary()
+   * - .toPutRolePolicy()
+   * - .toTagRole()
+   *
+   * @param value The value(s) to check
+   * @param operator Works with [arn operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN). **Default:** `ArnLike`
+   */
+  public ifRoleTemplateARN(value: string | string[], operator?: Operator | string) {
+    return this.if(`RoleTemplateARN`, value, operator ?? 'ArnLike');
+  }
+
   /**
    * Filters access by the duration until the credential's expiration
    *