Eon iam API

openapi: 3.0.0
info:
  description: The Eon.io REST API
  title: Eon accounts iam API
  version: 1.0.0
servers:
- url: /
security:
- ApiKeyAuth: []
tags:
- name: iam
paths:
  /v1/permissions:
    get:
      description: 'Description: Retrieves a list of user permissions.'
      operationId: listPermissions
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPermissionsResponse'
          description: Permissions retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Permissions
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
  /v1/roles:
    post:
      description: 'Description: Creates a custom role.<br/>


        When creating a role, you''ll specify a list of permissions and, optionally, data access conditions.

        Data access conditions let you restrict the resources a permission is granted for.

        For example, for a particular role, you can set data access conditions to allow access only to resources without PII.

        '
      operationId: createRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateRoleResponse'
          description: Role created.
        '400':
          description: Validation error.
        '409':
          description: A role with the same name already exists.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Create Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - create:account_roles
      x-audit-log:
        action: create
        entityRefs:
        - entityType: role
          in: resBody
          key: id
  /v1/roles/list:
    post:
      description: 'Description: Retrieves a list of user roles.'
      operationId: listRoles
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRolesResponse'
          description: Roles retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Roles
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
  /v1/roles/{roleId}:
    delete:
      description: 'Description: Deletes a role.'
      operationId: deleteRole
      parameters:
      - description: Role ID.
        example: ceaf2281-bf04-542d-a801-a6a4865373ad
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '204':
          description: Role deleted.
        '404':
          description: Role not found
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Delete Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - delete:account_roles
      x-audit-log:
        action: delete
        entityRefs:
        - entityType: role
          in: path
          key: roleId
    get:
      description: 'Description: Retrieves a role.'
      operationId: getRole
      parameters:
      - description: Role ID.
        example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleResponse'
          description: Role retrieved.
        '404':
          description: Role wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Get Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
    put:
      description: 'Description: This API operation updates the details of a role using its unique ID. The request body must contain the updated role details.'
      operationId: updateRole
      parameters:
      - description: ID of the role
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        description: The request body for updating a user
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRoleResponse'
          description: Role updated.
        '404':
          description: Role not found
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Update Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - update:account_roles
      x-audit-log:
        action: update
        entityRefs:
        - entityType: role
          in: path
          key: roleId
  /v1/idps/list:
    post:
      description: 'Description: Retrieves a list of identity providers for the account.'
      operationId: listIdps
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdpsResponse'
          description: Identity providers retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Identity Providers
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - read:idp_configs
      x-audit-log:
        excluded: true
  /v1/idp-groups:
    post:
      description: 'Description: Maps an identity provider group to one or more Eon roles.<br/>


        When users authenticate via SAML and belong to the specified group, they''re granted the assigned roles.

        '
      operationId: createIdpGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIdpGroupRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIdpGroupResponse'
          description: IdP group role assignment created.
        '400':
          description: Validation error.
        '404':
          description: Identity provider not found.
        '409':
          description: A group with the same provider-assigned group ID already exists for the specified identity provider.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Create IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: create
        entityRefs:
        - entityType: idp_group
          in: resBody
          key: group.id
  /v1/idp-groups/list:
    post:
      description: 'Description: Retrieves a list of IdP group role assignments mapped in your Eon account.'
      operationId: listIdpGroups
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdpGroupsResponse'
          description: IdP group role assignments retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List IdP Group Role Assignments
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        excluded: true
  /v1/idp-groups/{groupId}:
    delete:
      description: 'Description: Deletes an IdP group role assignment.<br/>


        After deletion, users are no longer assigned roles from their membership in the specified group.

        '
      operationId: deleteIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        example: ceaf2281-bf04-542d-a801-a6a4865373ad
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '204':
          description: IdP group role assignment deleted.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Delete IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: delete
        entityRefs:
        - entityType: idp_group
          in: path
          key: groupId
    get:
      description: 'Description: Retrieves an IdP group role assignment by ID.'
      operationId: getIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIdpGroupResponse'
          description: IdP group role assignment retrieved.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Get IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        excluded: true
    put:
      description: 'Description: Updates the roles assigned to an IdP group.<br/>


        This operation replaces all existing role assignments with the provided list.

        To add a role, include all existing roles plus the new one.

        To remove a role, include all roles except the one to remove.

        '
      operationId: updateIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIdpGroupRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateIdpGroupResponse'
          description: IdP group role assignment updated.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Update IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: update
        entityRefs:
        - entityType: idp_group
          in: path
          key: groupId
components:
  schemas:
    AccountIdCondition:
      example:
        accountIds:
        - accountIds
        - accountIds
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        accountIds:
          items:
            type: string
          type: array
      required:
      - accountIds
      - operator
      type: object
    TagKeyValuesCondition:
      example:
        tagKeyValues:
        - value: value
          key: key
        - value: value
          key: key
        operator: CONTAINS_ANY_OF
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        tagKeyValues:
          items:
            $ref: '#/components/schemas/TagKeyValue'
          type: array
      required:
      - operator
      - tagKeyValues
      type: object
    ListIdpGroupsResponse:
      example:
        nextToken: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
        groups:
        - roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        - roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        totalCount: 0
      properties:
        groups:
          description: List of IdP group role assignments.
          items:
            $ref: '#/components/schemas/IdpGroup'
          type: array
        totalCount:
          description: Total number of IdP group role assignments.
          type: integer
        nextToken:
          description: 'Cursor that points to the first record of the next page of results.

            Pass this value in the next request.

            '
          example: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
          type: string
      required:
      - groups
      type: object
    Provider:
      description: 'Cloud provider.

        `PROVIDER_UNSPECIFIED` is supported only in responses.

        '
      enum:
      - AWS
      - AZURE
      - GCP
      - MONGO_ATLAS
      - GOOGLE_WORKSPACE
      - MICROSOFT_365
      - PROVIDER_UNSPECIFIED
      example: AWS
      type: string
      x-docs-internal-enum:
      - GOOGLE_WORKSPACE
      - MICROSOFT_365
    EnvironmentCondition:
      example:
        environments:
        - PROD
        - PROD
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        environments:
          items:
            $ref: '#/components/schemas/Environment'
          type: array
      required:
      - environments
      - operator
      type: object
    ResourceNameCondition:
      example:
        resourceNames:
        - resourceNames
        - resourceNames
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        resourceNames:
          items:
            type: string
          type: array
      required:
      - operator
      - resourceNames
      type: object
    UpdateIdpGroupResponse:
      example:
        group:
          roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        group:
          $ref: '#/components/schemas/IdpGroup'
      required:
      - group
      type: object
    TagKeysCondition:
      example:
        tagKeys:
        - tagKeys
        - tagKeys
        operator: CONTAINS_ANY_OF
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        tagKeys:
          items:
            type: string
          type: array
      required:
      - operator
      - tagKeys
      type: object
    ListRolesResponse:
      example:
        nextToken: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
        roles:
        - restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        - restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tag

# --- truncated at 32 KB (99 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/eon/refs/heads/main/openapi/eon-iam-api-openapi.yml