# Not tested: Overcast v0.0.1-alpha.44 compatibility > No test exists for this operation. The generator declined to write one, and says why. 169 operations. The overview is at https://overcast.sh/compat/index.md. ## Batch - CancelJob: Cancels a job that has not started running. Against a real account the identifier could name a caller's own queued work, and a cancelled Batch job cannot be resumed — it has to be submitted again. - CancelJobs: CancelJobs is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateQuotaShare: CreateQuotaShare is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateServiceEnvironment: CreateServiceEnvironment is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteQuotaShare: DeleteQuotaShare is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteServiceEnvironment: DeleteServiceEnvironment is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - SubmitJob: Submits real, billable work to a job queue: AWS provisions compute for it and charges for what it consumes. Nothing in a scenario undoes a submission, and a probe group has no teardown. - SubmitServiceJob: Submits a SageMaker training service job — the same billable-work objection as SubmitJob, against a service whose training runs are the expensive kind. - TerminateJob: Terminates a running job, killing its container mid-execution. On a real account that is someone's in-flight work, and the job cannot be resumed. - TerminateJobs: TerminateJobs is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TerminateServiceJob: Terminates a running SageMaker training service job, discarding whatever the training run had done so far. - TerminateServiceJobs: TerminateServiceJobs is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateQuotaShare: UpdateQuotaShare is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateServiceEnvironment: UpdateServiceEnvironment is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateServiceJob: Re-prioritises a service job that is already queued or running, which changes the order real work is scheduled in. ## ELBv2 - ApplySecurityGroupsToLoadBalancer: Replaces the security groups of a load balancer wholesale rather than adding to them, so a probe would strip whatever rules the caller's own load balancer relies on. - AttachLoadBalancerToSubnets: Puts a live load balancer into another subnet, which changes where it accepts traffic. - DeregisterInstancesFromLoadBalancer: Takes instances out of service behind a live load balancer. - DetachLoadBalancerFromSubnets: Removes a load balancer from a subnet, and with it every instance in that subnet. - DisableAvailabilityZonesForLoadBalancer: Takes a whole Availability Zone out of a load balancer. AWS documents the instances in it as deregistered and the zone's capacity as lost immediately. - EnableAvailabilityZonesForLoadBalancer: Adds an Availability Zone to a live load balancer, changing where it serves from and what it bills for. - RegisterInstancesWithLoadBalancer: Puts EC2 instances into service behind a live load balancer, sending it traffic it was not meant to receive. - SetLoadBalancerListenerSSLCertificate: Replaces the TLS certificate a live listener serves. - SetLoadBalancerPoliciesForBackendServer: Replaces the policies applied to a backend port wholesale — an empty list removes every one of them. - SetLoadBalancerPoliciesOfListener: Replaces the policies applied to a listener wholesale, which is how a listener loses its stickiness or its cipher policy. ## IAM - AcceptDelegationRequest: AcceptDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - AcquireRole: AcquireRole is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - AddClientIDToOpenIDConnectProvider: AddClientIDToOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - AssociateDelegationRequest: AssociateDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - ChangePassword: Changes the console password of the IAM user whose credentials signed the request, which locks that user out of the console until somebody with the new password says otherwise. - CreateAccountAlias: Sets the account-wide sign-in alias. There is one per account, so the call silently replaces whatever the account already had, and every bookmarked sign-in URL for the old alias stops working. - CreateDelegationRequest: CreateDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateLoginProfile: Gives an IAM user a console password. It turns a programmatic-only identity into one that can sign in to the console, which is a change to the account's attack surface rather than to a test fixture. - CreateOpenIDConnectProvider: CreateOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateSAMLProvider: Registers a SAML identity provider for the account. Everything the provider's assertions are trusted for follows from it, and nothing in a probe group removes it. - CreateServiceLinkedRole: CreateServiceLinkedRole is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - CreateServiceSpecificCredential: CreateServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateVirtualMFADevice: Allocates a virtual MFA device with its own seed. AWS counts it against the account's device quota whether or not anybody ever enables it, and only DeleteVirtualMFADevice reclaims it. - DeactivateMFADevice: Removes the MFA device from a user, so an identity that was protected by a second factor no longer is. - DeleteAccountAlias: Removes the account's sign-in alias, breaking every sign-in URL built on it. - DeleteAccountPasswordPolicy: Deletes the account-wide password policy, so every complexity, rotation and reuse rule the account relied on is gone at once and AWS keeps no copy to restore. - DeleteLoginProfile: Removes an IAM user's console password, locking that user out of the console immediately. - DeleteOpenIDConnectProvider: DeleteOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteSAMLProvider: DeleteSAMLProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteSSHPublicKey: DeleteSSHPublicKey is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteServerCertificate: DeleteServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteServiceLinkedRole: Starts the deletion of a service-linked role. The role is what an AWS service uses to act in the account, so deleting it stops that service working, and the deletion is asynchronous — the call returns a task id and cannot be taken back. - DeleteServiceSpecificCredential: DeleteServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteSigningCertificate: Deletes an X.509 signing certificate from a user. Anything signing requests with that certificate stops being able to authenticate. - DeleteVirtualMFADevice: Deletes a virtual MFA device. AWS keeps no copy of its seed, so the device cannot be recreated and whoever enrolled it has to enrol again. - DisableOrganizationsRootCredentialsManagement: Turns off centralised root-credentials management for the organization, returning root credentials to each member account. It is an organization-wide security posture change made from one API call. - DisableOrganizationsRootSessions: Turns off privileged root sessions for the organization's member accounts, changing what the management account can do in every one of them. - DisableOutboundWebIdentityFederation: Turns off the account's outbound web identity federation, so every external workload that was exchanging this account's identity for a token stops being able to. - EnableMFADevice: Associates an MFA device with a user and requires two consecutive authentication codes to do it. A probe would either enrol a device nobody asked to enrol or spend the user's authentication attempts guessing codes. - EnableOrganizationsRootCredentialsManagement: Turns on centralised root-credentials management across the organization, which takes root credentials away from every member account. - EnableOrganizationsRootSessions: Turns on privileged root sessions across the organization's member accounts. - EnableOutboundWebIdentityFederation: Turns on outbound web identity federation for the account, which starts vending tokens that name this account to external workloads. - GenerateCredentialReport: Starts the account-wide credential report job. It is billed, it is rate limited to one report every four hours, and it collects every credential's age and last-used data into a report a probe has no reason to want. - GenerateOrganizationsAccessReport: GenerateOrganizationsAccessReport is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GenerateServiceLastAccessedDetails: GenerateServiceLastAccessedDetails is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GetAccountProperties: A read, and the one entry here that is not about danger. AWS added GetAccountProperties to the model after every SDK the typed suites pin: aws-sdk-go-v2/service/iam v1.53.7 declares no GetAccountPropertiesInput, so probing it scopes this whole probe group away from go-sdk with go-emit-unsupported, and the java, dotnet and rust emitters — which read the model rather than their SDK — would emit a call those builds cannot compile. It takes no required member, so withholding a curated literal, which is what leaves GetRoleTemplateVersion refused, cannot reach it and this map is the only lever. Delete the entry once the pins carry the operation. - GetRoleTemplateVersion: GetRoleTemplateVersion.TemplateArn (arnType, a string) has no bind, no matching export, no curated value and no derivable literal - PutAccountProperties: Writes account-level IAM properties. There is one set per account, so a probe would overwrite the caller's own settings with no way to know what they were. - RejectDelegationRequest: RejectDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - RemoveClientIDFromOpenIDConnectProvider: RemoveClientIDFromOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - ResetServiceSpecificCredential: ResetServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - ResyncMFADevice: Resynchronises a user's MFA device with two authentication codes, which consumes the user's codes and, on repeated failure, is what an attacker guessing them looks like. - SendDelegationToken: SendDelegationToken is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - SetDefaultPolicyVersion: Changes which version of a managed policy is the operative one. Every principal the policy is attached to gets a different effective permission set the moment the call lands. - SetSecurityTokenServicePreferences: Sets the account-wide STS global endpoint token version, which decides whether tokens the account mints are usable in Regions enabled after the call. - TagMFADevice: TagMFADevice is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TagOpenIDConnectProvider: TagOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TagSAMLProvider: TagSAMLProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TagServerCertificate: TagServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagMFADevice: UntagMFADevice is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagOpenIDConnectProvider: UntagOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagSAMLProvider: UntagSAMLProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagServerCertificate: UntagServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateAccessKey: Activates or deactivates an access key. Deactivating one an application is signing with breaks that application immediately, and a probe cannot know which keys are in use. - UpdateAccountPasswordPolicy: Replaces the account-wide password policy wholesale. Unset members are reset to AWS's defaults rather than left alone, so a partial call silently relaxes rules the account depended on. - UpdateDelegationRequest: UpdateDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateGroup: UpdateGroup is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateLoginProfile: Sets a new console password for an IAM user, locking out whoever held the old one. - UpdateOpenIDConnectProviderThumbprint: UpdateOpenIDConnectProviderThumbprint is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateRoleDescription: UpdateRoleDescription is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateSAMLProvider: Replaces the metadata document of a live SAML provider, which changes which assertions the account trusts. - UpdateSSHPublicKey: UpdateSSHPublicKey is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateServerCertificate: UpdateServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateServiceSpecificCredential: UpdateServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateSigningCertificate: UpdateSigningCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UploadSSHPublicKey: UploadSSHPublicKey is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UploadServerCertificate: Uploads a server certificate and its private key into the account's IAM certificate store. A probe has no key to upload that is not either a real one or a fake the account then holds forever. - UploadSigningCertificate: Uploads an X.509 signing certificate for a user, adding a new way to authenticate as that identity. ## KMS - ConnectCustomKeyStore: Connects a custom key store to its AWS CloudHSM cluster or external key store proxy, which changes whether every KMS key in that store can be used at all. - CreateCustomKeyStore: Creates a custom key store bound to a CloudHSM cluster or an external key manager. Nothing in a probe group removes it, and an orphaned key store keeps its backing cluster associated. - Decrypt: Decrypt is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - DeleteCustomKeyStore: Deletes a custom key store. AWS refuses only while the store still holds KMS keys, so a store emptied by an earlier deletion is destroyed by this call. - DeleteImportedKeyMaterial: Deletes the imported key material of a KMS key. Every ciphertext encrypted under that key becomes undecryptable until the same material is imported again, and AWS keeps no copy of it. - DeriveSharedSecret: Performs an ECDH key agreement with the caller's public key and bills for it. It also takes a raw public key blob, which the IR cannot express. - DisableKeyRotation: Turns off automatic annual rotation for a live KMS key, which is a control an account's compliance posture is usually built on. - DisconnectCustomKeyStore: Disconnects a custom key store from its backing cluster. Every KMS key in the store stops working for cryptographic operations until it is reconnected. - EnableKeyRotation: Turns on automatic annual rotation for a live KMS key. AWS bills for each key version the rotation creates, and rotation cannot be undone for versions already generated. - Encrypt: Encrypt is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - GenerateDataKeyPairWithoutPlaintext: GenerateDataKeyPairWithoutPlaintext is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GenerateMac: GenerateMac is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GetKeyLastUsage: GetKeyLastUsage.KeyId would bind to key.id, a value exported from a resource the run owns; a probe calls an operation the emulator does not implement, so against real AWS it would act on that resource for real. Add a curated literal for KeyId to values.json, or leave the operation refused - ImportKeyMaterial: Replaces the key material of a KMS key with material the caller supplies, which changes what every existing ciphertext under that key decrypts with. - ReEncrypt: ReEncrypt is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - ReplicateKey: Creates a replica of a multi-Region key in another Region. The replica is a KMS key of its own, in a Region nothing in this run looks at, and it can only be removed by scheduling its deletion there. - RotateKeyOnDemand: Creates a new key version of a live KMS key immediately. AWS bills for each version and a version cannot be removed. - Sign: Sign is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - UpdateCustomKeyStore: Changes the cluster, credentials or proxy configuration of a live custom key store, which can leave every KMS key in it unusable. - UpdatePrimaryRegion: Moves the primary of a multi-Region key to another Region, demoting the current primary to a replica. It changes which Region may replicate and manage the key. - Verify: Verify is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - VerifyMac: VerifyMac is implemented (Supported), so it may not be probed, and no recipe resource gives it a role ## Organizations - AcceptHandshake: Accepting a handshake is irreversible: it joins an account to an organization, or enables all features, and AWS documents neither as reversible. - AttachPolicy: A policy attachment takes effect immediately for every account under the target; an SCP attached to a root can deny actions across the whole organization. - CancelHandshake: Cancels an outstanding invitation permanently: AWS moves the handshake to CANCELED, and it cannot be reinstated. - CloseAccount: Closes a member account. AWS suspends it immediately and permanently deletes its resources after the post-closure period; the account cannot be reopened. - CreateAccount: Creates a real, billable AWS account inside the organization. An AWS account can be closed but never deleted, and it counts against the organization's account quota for good. - CreateGovCloudAccount: Creates a linked AWS GovCloud (US) account together with its commercial account; both are real, billable and permanent. - CreateOrganization: Makes the calling account the management account of a new organization. An account can belong to only one organization, so this either fails or permanently changes the caller's own account. - DeclineHandshake: Declines an invitation permanently: AWS moves the handshake to DECLINED, and it can no longer be accepted. - DeleteOrganization: Deletes the organization itself, along with every policy, organizational unit and setting in it. There is no undo. - DeleteResourcePolicy: Deletes the organization's delegation resource policy, which may be the only grant giving delegated administrators their access; the document is not recoverable. - DeregisterDelegatedAdministrator: Immediately withdraws an account's delegated administrator role for a service, and with it that account's access to the service's organization-wide data. - DetachPolicy: Detaching a policy takes effect immediately and can remove the guardrail every account under the target relies on. - DisableAWSServiceAccess: Disables trusted access for a service across the organization. AWS documents that the service loses access to organization data, and that re-enabling it does not restore what the service removed on the way out. - DisablePolicyType: Disabling a policy type in a root detaches every policy of that type from every target beneath it. - EnableAWSServiceAccess: Grants a service organization-wide access and lets it create service-linked roles in member accounts. - EnableAllFeatures: Migrates the organization from consolidated billing to all features. AWS documents the change as one that cannot be reversed. - EnablePolicyType: Enables a policy type in a root, changing what every account beneath it may do; the paired disable then detaches every policy of that type. - InviteAccountToOrganization: Sends a real invitation to another AWS account, which its owner sees and has to act on. Nothing about the call can safely miss. - InviteOrganizationToTransferResponsibility: Starts a transfer of management responsibility to another organization — an ownership and billing change the recipient can accept. - LeaveOrganization: Removes the calling account from its organization. AWS requires the account to be able to operate standalone afterwards, and rejoining needs a fresh invitation. - MoveAccount: Moves an account between roots or organizational units, which immediately changes the policies that apply to everything in it. - PutResourcePolicy: Replaces the organization's delegation resource policy wholesale; the document it overwrites is not recoverable. - RegisterDelegatedAdministrator: Grants an account delegated administrator rights over a service for the entire organization. - RemoveAccountFromOrganization: Removes a member account from the organization. The account must be able to operate standalone, and rejoining needs a fresh invitation. - TerminateResponsibilityTransfer: Terminates an in-flight responsibility transfer; the transfer cannot be resumed afterwards. - UpdateResponsibilityTransfer: Mutates an in-flight responsibility transfer — a billing-ownership change already under way. ## Secrets Manager - RemoveRegionsFromReplication: Deletes a secret's replicas in other Regions. AWS deletes a replica immediately — there is no recovery window for one — so the secret value stops being readable in that Region the moment the call lands, and nothing in a probe group puts it back. - ReplicateSecretToRegions: Creates a copy of the secret in other Regions. Each replica is a separate billed secret that outlives the run, and ForceOverwriteReplicaSecret will overwrite a secret somebody already keeps under that name in the destination Region. - RestoreSecret: RestoreSecret is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - RotateSecret: RotateSecret is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - StopReplicationToReplica: Promotes a replica to a standalone secret and breaks its link to the primary. The split is not reversible — the two secrets diverge from that call onwards — and it is run against the replica, which is somebody's live secret. ## Cloud Map - CreatePrivateDnsNamespace: Creates a namespace and, with it, a Route 53 private hosted zone attached to a VPC in the caller's account. The hosted zone is billed and outlives the run. - CreatePublicDnsNamespace: Creates a namespace and a Route 53 **public** hosted zone, which is billed monthly and answers queries from the internet until somebody deletes it. - DiscoverInstancesRevision: Not refused for danger — it reads and changes nothing — but for what it could assert. Its whole response is one revision counter, and a counter read for a namespace that does not exist says nothing true about the service. It is covered instead by DiscoverInstances on the service the run owns. - UpdateInstanceCustomHealthStatus: Marks a live instance healthy or unhealthy, which is what decides whether clients are given it at all. - UpdatePrivateDnsNamespace: Rewrites the SOA record of the private hosted zone behind a live namespace, changing how long every negative answer under it is cached. - UpdatePublicDnsNamespace: The same rewrite against a public hosted zone, where the cached answers are the internet's. ## SNS - AddPermission: Adds a statement to a live topic's access policy, granting the named AWS accounts the named actions on it. Nothing in a probe group removes what it adds, and the result is another account holding rights over the caller's topic. - CreatePlatformApplication: Registers push credentials (an APNs certificate, an FCM server key) as a platform application in the caller's account. The credentials are stored, the application is billable to use, and nothing here deletes it. - CreatePlatformEndpoint: Registers a device token against a platform application, which is what makes a device a push target. A probe would enrol a device nobody asked to enrol. - CreateSMSSandboxPhoneNumber: Starts SMS-sandbox verification for a phone number, which sends a one-time password by SMS to whoever holds it. A probe would text a stranger. - DeleteEndpoint: Removes a platform endpoint, so the device behind it stops receiving push notifications. AWS documents the call as idempotent, which means it reports nothing when it has destroyed something. - DeletePlatformApplication: Deletes a platform application and every endpoint under it, so every device registered against it stops receiving notifications at once. - DeleteSMSSandboxPhoneNumber: Removes a verified destination number from the account's SMS sandbox, which stops the account being able to text it until somebody re-verifies it. - OptInPhoneNumber: Opts a phone number back in to receiving SMS from the account after its holder opted out. Opting somebody back in is the one SMS action whose whole purpose is to override a person's stated preference, and AWS allows it only once every 30 days. - PutDataProtectionPolicy: Replaces a live topic's data protection policy wholesale, so the redaction and blocking rules an owner relies on to keep PII out of a topic are gone the moment the call lands. - RemovePermission: Removes a statement from a live topic's access policy by label, so whichever account that statement was for loses its access immediately. - SetEndpointAttributes: Writes attributes onto a live platform endpoint — Enabled among them, which is what decides whether a device is sent anything at all. - SetPlatformApplicationAttributes: Writes attributes onto a live platform application, including the push credentials themselves and the event-notification topics AWS reports delivery failures to. - SetSMSAttributes: Sets the account-wide SMS preferences: the monthly spend limit, the default sender id, the delivery-status role. These are one set per account, so a probe would overwrite the caller's own settings and could not put them back. - VerifySMSSandboxPhoneNumber: Completes SMS-sandbox verification with a one-time password. It is a write against the account's sandbox, and a probe guessing a password is the shape of a brute-force attempt rather than of a read. ## SQS - AddPermission: AddPermission is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CancelMessageMoveTask: CancelMessageMoveTask is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - RemovePermission: RemovePermission is not a read operation; probes call unimplemented operations against a live account and must be side-effect free