Documentation
¶
Overview ¶
iamref-gen reads AWS's Service Authorization Reference - published as JSON at servicereference.us-east-1.amazonaws.com - and writes live/iam-reference.json: per service, whether the tagging action this fork performs can be scoped by aws:ResourceTag and aws:TagKeys.
It exists because live/MARKERS.md publishes a marker-protection SCP and then admits it cannot vouch for it:
That action list is illustrative, not exhaustive or verified for every admitted type. It has to be, since this fork tracks each type's tagging verb but not its untagging one, so there is no generated artifact to check it against.
Issue #152. The same reference answers the other half - whether an estate grant policy conditioned on aws:ResourceTag/tofu-estate actually constrains a given service (#142).
Nothing here is curated. The service list is derived from live/tag-verbs.json's own roster, and each service's IAM name is resolved from that artifact's iam_prefix_candidates against the reference's index rather than mapped by hand - see tools/tagverbs-gen for why the candidates are a list.
go run ./tools/iamref-gen # cached where possible go run ./tools/iamref-gen -refresh # re-fetch everything
Source Files