{ "openapi": "3.0.1", "info": { "title": "AWS IAM Service Authorization Drift Monitor", "description": "Monitor official AWS Service Authorization Reference JSON for new IAM actions, resources, condition keys, and permission-surface drift.", "version": "0.0", "x-build-id": "eJJnY4ppOFSVUKkGO" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/defenestrator~aws-iam-service-authorization-drift-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-defenestrator-aws-iam-service-authorization-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/defenestrator~aws-iam-service-authorization-drift-monitor/runs": { "post": { "operationId": "runs-sync-defenestrator-aws-iam-service-authorization-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/defenestrator~aws-iam-service-authorization-drift-monitor/run-sync": { "post": { "operationId": "run-sync-defenestrator-aws-iam-service-authorization-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "services": { "title": "AWS services to monitor", "type": "array", "description": "AWS Service Authorization Reference service slugs to monitor. The Actor fetches the official AWS service-list.json and then uses the AWS-provided URL for each selected service; arbitrary user URLs are not fetched.", "items": { "type": "object", "properties": { "label": { "type": "string", "title": "Label", "description": "Human-readable label for this watched AWS service." }, "service": { "type": "string", "title": "Service slug", "description": "AWS Service Authorization Reference slug such as s3, lambda, bedrock, iam, ec2, organizations, or access-analyzer." }, "expectedActionCount": { "type": "integer", "title": "Expected action count", "description": "Optional expected number of IAM actions. A mismatch creates an alert; useful when pinning a known baseline without a previous dataset.", "minimum": 0 }, "expectedPermissionManagementActionCount": { "type": "integer", "title": "Expected permission-management action count", "description": "Optional expected number of actions marked by AWS as permission-management actions. A mismatch creates an alert.", "minimum": 0 }, "expectedResourceTypeCount": { "type": "integer", "title": "Expected resource type count", "description": "Optional expected number of resource types for the service. A mismatch creates an alert.", "minimum": 0 }, "critical": { "type": "boolean", "title": "Critical service", "description": "If true, permission-surface drift for this service is raised as higher priority.", "default": false } } } }, "includeAllServices": { "title": "Include all AWS services", "type": "boolean", "description": "If true, monitor every service in AWS service-list.json up to maxServices. Keep false for normal watchlist runs.", "default": false }, "serviceSearchTerms": { "title": "Service search terms", "type": "array", "description": "Optional terms used to select additional services whose slug contains one of the terms, for example bedrock or s3. Terms are matched only against AWS service-list.json slugs.", "items": { "type": "string" }, "default": [] }, "baselineDataset": { "title": "Previous run dataset", "type": "string", "description": "Optional previous run dataset for drift comparison. Use the picker so this limited-permission Actor receives READ access to the selected private dataset." }, "baselineDatasetId": { "title": "Previous dataset ID (advanced)", "type": "string", "description": "Advanced/API fallback for a previous dataset ID. Prefer the picker under limited permissions." }, "baselineRows": { "title": "Inline previous rows / baseline snapshots", "type": "array", "description": "Optional previous rows or compact baseline snapshots. Include service or rowKey plus semanticHash, actionCount, permissionManagementActionCount, resourceTypeCount, and optionally actionNames for added/removed action details.", "items": { "type": "object" }, "default": [] }, "maxBaselineRows": { "title": "Max baseline rows to read", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Maximum rows to read from the selected baseline dataset.", "default": 2000 }, "maxServices": { "title": "Max services", "minimum": 1, "maximum": 500, "type": "integer", "description": "Maximum number of AWS services to process after watchlist/search/all-service expansion.", "default": 25 }, "maxActionNamesInRow": { "title": "Max action names in each dataset row", "minimum": 0, "maximum": 2000, "type": "integer", "description": "Maximum action names to include directly in each row. Hashes and counts always use the full official action set.", "default": 500 }, "includeUnchangedRows": { "title": "Include unchanged rows", "type": "boolean", "description": "If false, only alert, changed, or error rows are pushed to the dataset. OUTPUT.snapshot still includes every checked service.", "default": true }, "alertOnSemanticHashChange": { "title": "Alert on semantic hash drift", "type": "boolean", "description": "If true, a changed normalized service hash versus the previous baseline produces an alert.", "default": true }, "alertOnNewPermissionManagementActions": { "title": "Alert on new permission-management actions", "type": "boolean", "description": "If true, new AWS actions marked IsPermissionManagement produce a high-priority alert when action names can be compared against a baseline row.", "default": true }, "requestTimeoutSecs": { "title": "Request timeout seconds", "minimum": 3, "maximum": 60, "type": "integer", "description": "Timeout for each official AWS Service Authorization Reference JSON request.", "default": 20 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }