performance: ondemand yaml parsing

Author: rsteube

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.apply-archive-rule.yaml

@@ -0,0 +1,12 @@
+name: apply-archive-rule
+description: Retroactively applies the archive rule to existing findings that meet the archive rule criteria.
+flags:
+    --analyzer-arn=!: The Amazon resource name (ARN) of the analyzer.
+    --client-token=: A client token.
+    --rule-name=!: The name of the rule to apply.
+documentation:
+    command: Retroactively applies the archive rule to existing findings that meet the archive rule criteria.
+    flag:
+        analyzer-arn: The Amazon resource name (ARN) of the analyzer.
+        client-token: A client token.
+        rule-name: The name of the rule to apply.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.cancel-policy-generation.yaml

@@ -0,0 +1,8 @@
+name: cancel-policy-generation
+description: Cancels the requested policy generation.
+flags:
+    --job-id=!: The `JobId` that is returned by the `StartPolicyGeneration` operation.
+documentation:
+    command: Cancels the requested policy generation.
+    flag:
+        job-id: The `JobId` that is returned by the `StartPolicyGeneration` operation. The `JobId` can be used with `GetGeneratedPolicy` to retrieve the generated policies or used with `CancelPolicyGeneration` to cancel the policy generation request.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.check-access-not-granted.yaml

@@ -0,0 +1,20 @@
+name: check-access-not-granted
+description: Checks whether the specified access isn't allowed by a policy.
+flags:
+    --access=!: An access object containing the permissions that shouldn't be granted by the specified policy.
+    --policy-document=!: The JSON policy document to use as the content for the policy.
+    --policy-type=!: The type of policy.
+completion:
+    flag:
+        policy-type:
+            - IDENTITY_POLICY
+            - RESOURCE_POLICY
+documentation:
+    command: Checks whether the specified access isn't allowed by a policy.
+    flag:
+        access: An access object containing the permissions that shouldn't be granted by the specified policy. If only actions are specified, IAM Access Analyzer checks for access to peform at least one of the actions on any resource in the policy. If only resources are specified, then IAM Access Analyzer checks for access to perform any action on at least one of the resources. If both actions and resources are specified, IAM Access Analyzer checks for access to perform at least one of the specified actions on at least one of the specified resources.
+        policy-document: The JSON policy document to use as the content for the policy.
+        policy-type: |-
+            The type of policy. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.
+
+            Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.check-no-new-access.yaml

@@ -0,0 +1,23 @@
+name: check-no-new-access
+description: Checks whether new access is allowed for an updated policy when compared to the existing policy.
+flags:
+    --existing-policy-document=!: The JSON policy document to use as the content for the existing policy.
+    --new-policy-document=!: The JSON policy document to use as the content for the updated policy.
+    --policy-type=!: The type of policy to compare.
+completion:
+    flag:
+        policy-type:
+            - IDENTITY_POLICY
+            - RESOURCE_POLICY
+documentation:
+    command: |-
+        Checks whether new access is allowed for an updated policy when compared to the existing policy.
+
+        You can find examples for reference policies and learn how to set up and run a custom policy check for new access in the [IAM Access Analyzer custom policy checks samples](https://github.com/aws-samples/iam-access-analyzer-custom-policy-check-samples) repository on GitHub. The reference policies in this repository are meant to be passed to the `existingPolicyDocument` request parameter.
+    flag:
+        existing-policy-document: The JSON policy document to use as the content for the existing policy.
+        new-policy-document: The JSON policy document to use as the content for the updated policy.
+        policy-type: |-
+            The type of policy to compare. Identity policies grant permissions to IAM principals. Identity policies include managed and inline policies for IAM roles, users, and groups.
+
+            Resource policies grant permissions on Amazon Web Services resources. Resource policies include trust policies for IAM roles and bucket policies for Amazon S3 buckets. You can provide a generic input such as identity policy or resource policy or a specific input such as managed policy or Amazon S3 bucket policy.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.check-no-public-access.yaml

@@ -0,0 +1,42 @@
+name: check-no-public-access
+description: Checks whether a resource policy can grant public access to the specified resource type.
+flags:
+    --policy-document=!: The JSON policy document to evaluate for public access.
+    --resource-type=!: The type of resource to evaluate for public access.
+completion:
+    flag:
+        resource-type:
+            - AWS::DynamoDB::Table
+            - AWS::DynamoDB::Stream
+            - AWS::EFS::FileSystem
+            - AWS::OpenSearchService::Domain
+            - AWS::Kinesis::Stream
+            - AWS::Kinesis::StreamConsumer
+            - AWS::KMS::Key
+            - AWS::Lambda::Function
+            - AWS::S3::Bucket
+            - AWS::S3::AccessPoint
+            - AWS::S3Express::DirectoryBucket
+            - AWS::S3::Glacier
+            - AWS::S3Outposts::Bucket
+            - AWS::S3Outposts::AccessPoint
+            - AWS::SecretsManager::Secret
+            - AWS::SNS::Topic
+            - AWS::SQS::Queue
+            - AWS::IAM::AssumeRolePolicyDocument
+            - AWS::S3Tables::TableBucket
+            - AWS::ApiGateway::RestApi
+            - AWS::CodeArtifact::Domain
+            - AWS::Backup::BackupVault
+            - AWS::CloudTrail::Dashboard
+            - AWS::CloudTrail::EventDataStore
+            - AWS::S3Tables::Table
+            - AWS::S3Express::AccessPoint
+documentation:
+    command: Checks whether a resource policy can grant public access to the specified resource type.
+    flag:
+        policy-document: The JSON policy document to evaluate for public access.
+        resource-type: |-
+            The type of resource to evaluate for public access. For example, to check for public access to Amazon S3 buckets, you can choose `AWS::S3::Bucket` for the resource type.
+
+            For resource types not supported as valid values, IAM Access Analyzer will return an error.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.create-access-preview.yaml

@@ -0,0 +1,12 @@
+name: create-access-preview
+description: Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.
+flags:
+    --analyzer-arn=!: The [ARN of the account analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources) used to generate the access preview.
+    --client-token=: A client token.
+    --configurations=!: Access control configuration for your resource that is used to generate the access preview.
+documentation:
+    command: Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.
+    flag:
+        analyzer-arn: The [ARN of the account analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources) used to generate the access preview. You can only create an access preview for analyzers with an `Account` type and `Active` status.
+        client-token: A client token.
+        configurations: Access control configuration for your resource that is used to generate the access preview. The access preview includes findings for external access allowed to the resource with the proposed access control configuration. The configuration must contain exactly one element.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.create-analyzer.yaml

@@ -0,0 +1,32 @@
+name: create-analyzer
+description: Creates an analyzer for your account.
+flags:
+    --analyzer-name=!: The name of the analyzer to create.
+    --archive-rules=: Specifies the archive rules to add for the analyzer.
+    --client-token=: A client token.
+    --configuration=: Specifies the configuration of the analyzer.
+    --tags=: An array of key-value pairs to apply to the analyzer.
+    --type=!: The type of analyzer to create.
+completion:
+    flag:
+        type:
+            - ACCOUNT
+            - ORGANIZATION
+            - ACCOUNT_UNUSED_ACCESS
+            - ORGANIZATION_UNUSED_ACCESS
+            - ACCOUNT_INTERNAL_ACCESS
+            - ORGANIZATION_INTERNAL_ACCESS
+documentation:
+    command: Creates an analyzer for your account.
+    flag:
+        analyzer-name: The name of the analyzer to create.
+        archive-rules: Specifies the archive rules to add for the analyzer. Archive rules automatically archive findings that meet the criteria you define for the rule.
+        client-token: A client token.
+        configuration: Specifies the configuration of the analyzer. If the analyzer is an unused access analyzer, the specified scope of unused access is used for the configuration. If the analyzer is an internal access analyzer, the specified internal access analysis rules are used for the configuration.
+        tags: |-
+            An array of key-value pairs to apply to the analyzer. You can use the set of Unicode letters, digits, whitespace, `_`, `.`, `/`, `=`, `+`, and `-`.
+
+            For the tag key, you can specify a value that is 1 to 128 characters in length and cannot be prefixed with `aws:`.
+
+            For the tag value, you can specify a value that is 0 to 256 characters in length.
+        type: The type of analyzer to create. You can create only one analyzer per account per Region. You can create up to 5 analyzers per organization per Region.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.create-archive-rule.yaml

@@ -0,0 +1,17 @@
+name: create-archive-rule
+description: Creates an archive rule for the specified analyzer.
+flags:
+    --analyzer-name=!: The name of the created analyzer.
+    --client-token=: A client token.
+    --filter=!: The criteria for the rule.
+    --rule-name=!: The name of the rule to create.
+documentation:
+    command: |-
+        Creates an archive rule for the specified analyzer. Archive rules automatically archive new findings that meet the criteria you define when you create the rule.
+
+        To learn about filter keys that you can use to create an archive rule, see [IAM Access Analyzer filter keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-filter-keys.html) in the **IAM User Guide**.
+    flag:
+        analyzer-name: The name of the created analyzer.
+        client-token: A client token.
+        filter: The criteria for the rule.
+        rule-name: The name of the rule to create.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.delete-analyzer.yaml

@@ -0,0 +1,10 @@
+name: delete-analyzer
+description: Deletes the specified analyzer.
+flags:
+    --analyzer-name=!: The name of the analyzer to delete.
+    --client-token=: A client token.
+documentation:
+    command: Deletes the specified analyzer. When you delete an analyzer, IAM Access Analyzer is disabled for the account or organization in the current or specific Region. All findings that were generated by the analyzer are deleted. You cannot undo this action.
+    flag:
+        analyzer-name: The name of the analyzer to delete.
+        client-token: A client token.

cmd/carapace-aws/cmd/botocore/aws.accessanalyzer.delete-archive-rule.yaml

@@ -0,0 +1,12 @@
+name: delete-archive-rule
+description: Deletes the specified archive rule.
+flags:
+    --analyzer-name=!: The name of the analyzer that associated with the archive rule to delete.
+    --client-token=: A client token.
+    --rule-name=!: The name of the rule to delete.
+documentation:
+    command: Deletes the specified archive rule.
+    flag:
+        analyzer-name: The name of the analyzer that associated with the archive rule to delete.
+        client-token: A client token.
+        rule-name: The name of the rule to delete.