{
  "typeName" : "AWS::DataZone::PolicyGrant",
  "description" : "Policy Grant in AWS DataZone is an explicit authorization assignment that allows a specific principal (user, group, or project) to perform particular actions (such as creating glossary terms, managing projects, or accessing resources) on governed resources within a certain scope (like a Domain Unit or Project). Policy Grants are essentially the mechanism by which DataZone enforces fine-grained, role-based access control beyond what is possible through AWS IAM alone.",
  "definitions" : {
    "AddToProjectMemberPoolPolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "AllDomainUnitsGrantFilter" : {
      "type" : "object",
      "additionalProperties" : false
    },
    "AllUsersGrantFilter" : {
      "type" : "object",
      "additionalProperties" : false
    },
    "CreateAssetTypePolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "CreateDomainUnitPolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "CreateEnvironmentProfilePolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "DomainUnitId" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 1,
          "pattern" : "^[a-z0-9_\\-]+$"
        }
      },
      "additionalProperties" : false
    },
    "CreateFormTypePolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "CreateGlossaryPolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "CreateProjectFromProjectProfilePolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        },
        "ProjectProfiles" : {
          "type" : "array",
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        }
      },
      "additionalProperties" : false
    },
    "CreateProjectPolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "DomainUnitDesignation" : {
      "type" : "string",
      "enum" : [ "OWNER" ]
    },
    "DomainUnitFilterForProject" : {
      "type" : "object",
      "properties" : {
        "DomainUnit" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 1,
          "pattern" : "^[a-z0-9_\\-]+$"
        },
        "IncludeChildDomainUnits" : {
          "type" : "boolean",
          "default" : false
        }
      },
      "required" : [ "DomainUnit" ],
      "additionalProperties" : false
    },
    "DomainUnitGrantFilter" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "AllDomainUnitsGrantFilter",
        "properties" : {
          "AllDomainUnitsGrantFilter" : {
            "$ref" : "#/definitions/AllDomainUnitsGrantFilter"
          }
        },
        "required" : [ "AllDomainUnitsGrantFilter" ],
        "additionalProperties" : false
      } ]
    },
    "DomainUnitPolicyGrantPrincipal" : {
      "type" : "object",
      "properties" : {
        "DomainUnitDesignation" : {
          "$ref" : "#/definitions/DomainUnitDesignation"
        },
        "DomainUnitIdentifier" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 1,
          "pattern" : "^[a-z0-9_\\-]+$"
        },
        "DomainUnitGrantFilter" : {
          "$ref" : "#/definitions/DomainUnitGrantFilter"
        }
      },
      "additionalProperties" : false
    },
    "GroupPolicyGrantPrincipal" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "GroupIdentifier",
        "properties" : {
          "GroupIdentifier" : {
            "type" : "string",
            "pattern" : "(^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$|[\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}\\t\\n\\r  ]+)"
          }
        },
        "required" : [ "GroupIdentifier" ],
        "additionalProperties" : false
      } ]
    },
    "ManagedPolicyType" : {
      "type" : "string",
      "enum" : [ "CREATE_DOMAIN_UNIT", "OVERRIDE_DOMAIN_UNIT_OWNERS", "ADD_TO_PROJECT_MEMBER_POOL", "OVERRIDE_PROJECT_OWNERS", "CREATE_GLOSSARY", "CREATE_FORM_TYPE", "CREATE_ASSET_TYPE", "CREATE_PROJECT", "CREATE_ENVIRONMENT_PROFILE", "DELEGATE_CREATE_ENVIRONMENT_PROFILE", "CREATE_ENVIRONMENT", "CREATE_ENVIRONMENT_FROM_BLUEPRINT", "CREATE_PROJECT_FROM_PROJECT_PROFILE" ]
    },
    "OverrideDomainUnitOwnersPolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "OverrideProjectOwnersPolicyGrantDetail" : {
      "type" : "object",
      "properties" : {
        "IncludeChildDomainUnits" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "PolicyGrantDetail" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "CreateDomainUnit",
        "properties" : {
          "CreateDomainUnit" : {
            "$ref" : "#/definitions/CreateDomainUnitPolicyGrantDetail"
          }
        },
        "required" : [ "CreateDomainUnit" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "OverrideDomainUnitOwners",
        "properties" : {
          "OverrideDomainUnitOwners" : {
            "$ref" : "#/definitions/OverrideDomainUnitOwnersPolicyGrantDetail"
          }
        },
        "required" : [ "OverrideDomainUnitOwners" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "AddToProjectMemberPool",
        "properties" : {
          "AddToProjectMemberPool" : {
            "$ref" : "#/definitions/AddToProjectMemberPoolPolicyGrantDetail"
          }
        },
        "required" : [ "AddToProjectMemberPool" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "OverrideProjectOwners",
        "properties" : {
          "OverrideProjectOwners" : {
            "$ref" : "#/definitions/OverrideProjectOwnersPolicyGrantDetail"
          }
        },
        "required" : [ "OverrideProjectOwners" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateGlossary",
        "properties" : {
          "CreateGlossary" : {
            "$ref" : "#/definitions/CreateGlossaryPolicyGrantDetail"
          }
        },
        "required" : [ "CreateGlossary" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateFormType",
        "properties" : {
          "CreateFormType" : {
            "$ref" : "#/definitions/CreateFormTypePolicyGrantDetail"
          }
        },
        "required" : [ "CreateFormType" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateAssetType",
        "properties" : {
          "CreateAssetType" : {
            "$ref" : "#/definitions/CreateAssetTypePolicyGrantDetail"
          }
        },
        "required" : [ "CreateAssetType" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateProject",
        "properties" : {
          "CreateProject" : {
            "$ref" : "#/definitions/CreateProjectPolicyGrantDetail"
          }
        },
        "required" : [ "CreateProject" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateEnvironmentProfile",
        "properties" : {
          "CreateEnvironmentProfile" : {
            "$ref" : "#/definitions/CreateEnvironmentProfilePolicyGrantDetail"
          }
        },
        "required" : [ "CreateEnvironmentProfile" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "DelegateCreateEnvironmentProfile",
        "properties" : {
          "DelegateCreateEnvironmentProfile" : {
            "$ref" : "#/definitions/Unit"
          }
        },
        "required" : [ "DelegateCreateEnvironmentProfile" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateEnvironment",
        "properties" : {
          "CreateEnvironment" : {
            "$ref" : "#/definitions/Unit"
          }
        },
        "required" : [ "CreateEnvironment" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateEnvironmentFromBlueprint",
        "properties" : {
          "CreateEnvironmentFromBlueprint" : {
            "$ref" : "#/definitions/Unit"
          }
        },
        "required" : [ "CreateEnvironmentFromBlueprint" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "CreateProjectFromProjectProfile",
        "properties" : {
          "CreateProjectFromProjectProfile" : {
            "$ref" : "#/definitions/CreateProjectFromProjectProfilePolicyGrantDetail"
          }
        },
        "required" : [ "CreateProjectFromProjectProfile" ],
        "additionalProperties" : false
      } ]
    },
    "PolicyGrantPrincipal" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "User",
        "properties" : {
          "User" : {
            "$ref" : "#/definitions/UserPolicyGrantPrincipal"
          }
        },
        "required" : [ "User" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "Group",
        "properties" : {
          "Group" : {
            "$ref" : "#/definitions/GroupPolicyGrantPrincipal"
          }
        },
        "required" : [ "Group" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "Project",
        "properties" : {
          "Project" : {
            "$ref" : "#/definitions/ProjectPolicyGrantPrincipal"
          }
        },
        "required" : [ "Project" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "DomainUnit",
        "properties" : {
          "DomainUnit" : {
            "$ref" : "#/definitions/DomainUnitPolicyGrantPrincipal"
          }
        },
        "required" : [ "DomainUnit" ],
        "additionalProperties" : false
      } ]
    },
    "ProjectDesignation" : {
      "type" : "string",
      "enum" : [ "OWNER", "CONTRIBUTOR", "PROJECT_CATALOG_STEWARD" ]
    },
    "ProjectGrantFilter" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "DomainUnitFilter",
        "properties" : {
          "DomainUnitFilter" : {
            "$ref" : "#/definitions/DomainUnitFilterForProject"
          }
        },
        "required" : [ "DomainUnitFilter" ],
        "additionalProperties" : false
      } ]
    },
    "ProjectPolicyGrantPrincipal" : {
      "type" : "object",
      "properties" : {
        "ProjectDesignation" : {
          "$ref" : "#/definitions/ProjectDesignation"
        },
        "ProjectIdentifier" : {
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_-]{1,36}$"
        },
        "ProjectGrantFilter" : {
          "$ref" : "#/definitions/ProjectGrantFilter"
        }
      },
      "additionalProperties" : false
    },
    "TargetEntityType" : {
      "type" : "string",
      "enum" : [ "DOMAIN_UNIT", "ENVIRONMENT_BLUEPRINT_CONFIGURATION", "ENVIRONMENT_PROFILE", "ASSET_TYPE" ]
    },
    "Unit" : {
      "type" : "object",
      "additionalProperties" : false
    },
    "UserPolicyGrantPrincipal" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "UserIdentifier",
        "properties" : {
          "UserIdentifier" : {
            "type" : "string",
            "pattern" : "(^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$|^[a-zA-Z_0-9+=,.@-]+$|^arn:aws[^:]*:iam::\\d{12}:.+$)"
          }
        },
        "required" : [ "UserIdentifier" ],
        "additionalProperties" : false
      }, {
        "type" : "object",
        "title" : "AllUsersGrantFilter",
        "properties" : {
          "AllUsersGrantFilter" : {
            "$ref" : "#/definitions/AllUsersGrantFilter"
          }
        },
        "required" : [ "AllUsersGrantFilter" ],
        "additionalProperties" : false
      } ]
    }
  },
  "properties" : {
    "Detail" : {
      "type" : "object",
      "$ref" : "#/definitions/PolicyGrantDetail"
    },
    "DomainIdentifier" : {
      "type" : "string",
      "pattern" : "^dzd[-_][a-zA-Z0-9_-]{1,36}$"
    },
    "EntityIdentifier" : {
      "type" : "string"
    },
    "EntityType" : {
      "$ref" : "#/definitions/TargetEntityType"
    },
    "GrantId" : {
      "type" : "string",
      "description" : "The unique identifier of the policy grant returned by the AddPolicyGrant API",
      "pattern" : "^[A-Za-z0-9+/]{10}$"
    },
    "CreatedAt" : {
      "description" : "Specifies the timestamp at which policy grant member was created.",
      "type" : "string",
      "format" : "date-time"
    },
    "CreatedBy" : {
      "description" : "Specifies the user who created the policy grant member.",
      "type" : "string"
    },
    "PolicyType" : {
      "$ref" : "#/definitions/ManagedPolicyType"
    },
    "Principal" : {
      "type" : "object",
      "$ref" : "#/definitions/PolicyGrantPrincipal"
    }
  },
  "required" : [ "DomainIdentifier", "EntityIdentifier", "EntityType", "PolicyType" ],
  "readOnlyProperties" : [ "/properties/GrantId", "/properties/CreatedAt", "/properties/CreatedBy" ],
  "writeOnlyProperties" : [ "/properties/Principal/Project/ProjectGrantFilter", "/properties/Principal/Project/ProjectGrantFilter/DomainUnitFilter", "/properties/Principal/Project/ProjectGrantFilter/DomainUnitFilter/DomainUnit", "/properties/Principal/Project/ProjectGrantFilter/DomainUnitFilter/IncludeChildDomainUnits", "/properties/Principal/DomainUnit/DomainUnitGrantFilter", "/properties/Principal/DomainUnit/DomainUnitGrantFilter/AllDomainUnitsGrantFilter" ],
  "createOnlyProperties" : [ "/properties/Detail", "/properties/DomainIdentifier", "/properties/EntityIdentifier", "/properties/EntityType", "/properties/PolicyType", "/properties/Principal" ],
  "primaryIdentifier" : [ "/properties/DomainIdentifier", "/properties/GrantId", "/properties/EntityIdentifier", "/properties/EntityType", "/properties/PolicyType" ],
  "tagging" : {
    "taggable" : false,
    "tagOnCreate" : false,
    "tagUpdatable" : false,
    "cloudFormationSystemTags" : false
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "datazone:AddPolicyGrant", "datazone:GetUserProfile", "datazone:ListPolicyGrants", "iam:GetUser" ]
    },
    "read" : {
      "permissions" : [ "datazone:ListPolicyGrants" ]
    },
    "delete" : {
      "permissions" : [ "datazone:RemovePolicyGrant", "datazone:ListPolicyGrants" ]
    },
    "list" : {
      "permissions" : [ "datazone:ListPolicyGrants" ]
    }
  },
  "additionalProperties" : false
}