IAM, KMS, Secrets Manager, and SSM

These classes map security intent into IAM documents, roles, KMS keys, Secrets Manager secrets, and Systems Manager parameters.

Source: mde/metamodels/psm/awspsm-security.emf.

`IamRole`

Represents iam role in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`roleName`	`String` [1]	For a iam role, the model records the stable name/key/code used for role name. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Transformation role: ETL rule `Principal2IamRole` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `IamRole`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/validation.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `OrdersRuntimeRole`.
`path`	`String` [1]	Stores the data location or endpoint represented by path on the iam role. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Transformation role: ETL rule `Principal2IamRole` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `IamRole`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `/application/`.
`permissionsBoundaryArn`	`String` [1]	Stores the boundary within which permissions boundary arn is interpreted on the iam role. The field records isolation and ownership decisions as an explicit, reviewable input. Semantic validation: `ProductionRoleShouldUsePermissionsBoundary` (production role should use permissions boundary) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `arn:aws:lambda:us-east-1:123456789012:function:orders`.
`maxSessionDuration`	`Integer` [1]	Records the max session duration value for iam role. It keeps an operational boundary that should not be left to provider defaults explicit during review and transformation, so later steps do not have to infer it. Transformation role: ETL rule `Principal2IamRole` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `IamRole`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `30`.
`descriptionText`	`String` [1]	Stores the human explanation of description text on the iam role. The field records human review and generated guidance as an explicit, reviewable input. Transformation role: ETL rule `Principal2IamRole` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `IamRole`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Orders processing`.
`managedPolicyArns`	`String` [*]	Stores the managed policy arns value on the iam role. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A collection of values. Example: [`arn:aws:lambda:us-east-1:123456789012:function:orders`, `arn:aws:lambda:us-east-1:123456789012:function:orders-2`].

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`assumeRolePolicy` → `IamPolicyDocument`	containment, [1]	Contains the iam policy document element(s) that make up this iam role; the contained objects belong to this model element.
`inlinePolicies` → `IamInlinePolicy`	containment, [*]	Contains the iam inline policy element(s) that make up this iam role; the contained objects belong to this model element.
`managedPolicies` → `IamManagedPolicy`	reference, [*]	References the iam managed policy element(s) used as managed policies by this iam role; the target may be shared elsewhere in the model.

`IamInlinePolicy`

Represents iam inline policy in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`policyName`	`String` [1]	Records the stable name/key/code used for policy name for the iam inline policy. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `STANDARD`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`document` → `IamPolicyDocument`	containment, [1]	Contains the iam policy document element(s) that make up this iam inline policy; the contained objects belong to this model element.

`IamPolicy`

Represents iam policy in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`policyName`	`String` [1]	For a iam policy, the model records the stable name/key/code used for policy name. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `STANDARD`.
`rawPolicyJson`	`String` [1]	Records the serialized JSON representation of raw policy for the iam policy. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`document` → `IamPolicyDocument`	containment, [1]	Contains the iam policy document element(s) that make up this iam policy; the contained objects belong to this model element.
`roles` → `IamRole`	reference, [*]	References the iam role element(s) used as roles by this iam policy; the target may be shared elsewhere in the model.

`IamManagedPolicy`

Represents iam managed policy in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`managedPolicyName`	`String` [1]	Stores the stable name/key/code used for managed policy name on the iam managed policy. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `STANDARD`.
`path`	`String` [1]	Records data location or endpoint represented by path for iam managed policy. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `/orders/{orderId}`.
`rawPolicyJson`	`String` [1]	For a iam managed policy, the model records the serialized JSON representation of raw policy. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`document` → `IamPolicyDocument`	containment, [1]	Contains the iam policy document element(s) that make up this iam managed policy; the contained objects belong to this model element.

`IamPolicyDocument`

Represents iam policy document in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`version`	`String` [1]	For a iam policy document, the model records the compatibility/version marker for version. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/contracts.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `1.0`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`statements` → `IamStatement`	containment, [+]	Contains the iam statement element(s) that make up this iam policy document; the contained objects belong to this model element.

`IamStatement`

Represents iam statement in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`sid`	`String` [1]	For a iam statement, the model records the stable name/key/code used for sid. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/iam.eol`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/validation.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `ReadOrdersTable`.
`actions`	`String` [*]	The allowed or denied IAM API operations. Keeping actions explicit is the main least-privilege surface of the statement. Semantic validation: `NoAllowWildcardInProductionWithoutJustification` (no allow wildcard in production without justification) in `mde/validation/psm/rules/security.evl` the rule's diagnostic or remediation guidance refers to this feature. `AvoidNotActionInAllowStatements` (avoid not action in allow statements) in `mde/validation/psm/rules/security.evl` the rule's diagnostic or remediation guidance refers to this feature. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/awspsm2artifacts.egx`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A collection of values. Example: [`dynamodb:GetItem`, `dynamodb:GetItem-2`].
`notActions`	`String` [*]	The IAM operations excluded from the statement's effect. It is a powerful negative permission and therefore receives stricter review than an ordinary action list. Semantic validation: `AvoidNotActionInAllowStatements` (avoid not action in allow statements) in `mde/validation/psm/rules/security.evl` the feature participates in a semantic validation condition. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/iam.eol`.	A collection of values. Example: [`Iam Statement Not Actions`, `Iam Statement Not Actions-2`].
`resources`	`String` [*]	The ARNs to which the actions apply. Resource scope is what turns an otherwise broad action into a least-privilege permission. Semantic validation: `NoAllowWildcardInProductionWithoutJustification` (no allow wildcard in production without justification) in `mde/validation/psm/rules/security.evl` the rule's diagnostic or remediation guidance refers to this feature. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/awspsm2artifacts.egx`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A collection of values. Example: [`arn:aws:dynamodb:us-east-1:123456789012:table/orders`, `arn:aws:dynamodb:us-east-1:123456789012:table/orders-2`].
`notResources`	`String` [*]	The resources excluded from the statement. Negative resource scope must be justified because it is easy to misunderstand during audit. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/iam.eol`.	A collection of values. Example: [`Iam Statement Not Resources`, `Iam Statement Not Resources-2`].
`wildcardAction`	`Boolean` [1]	Whether the statement intentionally uses `*` for actions. The flag makes broad authority visible and gives EVL a place to demand justification. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/validation.eol`.	Either `true` or `false`. Example: `false`.
`wildcardResource`	`Boolean` [1]	Whether the statement intentionally applies to every resource. This is often unavoidable for trust or discovery APIs, but it must not be invisible. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/validation.eol`.	Either `true` or `false`. Example: `false`.
`wildcardJustification`	`String` [1]	The written reason a wildcard permission is safe and necessary, providing the evidence required for least-privilege review. Semantic validation: `NoAllowWildcardInProductionWithoutJustification` (no allow wildcard in production without justification) in `mde/validation/psm/rules/security.evl` the rule's diagnostic or remediation guidance refers to this feature. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/validation.eol`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/templates/infrastructure/iam-policy-rationale.egl`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Iam Statement Wildcard Justification`.
`effect`	`IamEffect` [1]	Records controlled classification or strategy represented by effect for iam statement. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `NoAllowWildcardInProductionWithoutJustification` (no allow wildcard in production without justification) in `mde/validation/psm/rules/security.evl` the feature participates in a semantic validation condition. `AvoidNotActionInAllowStatements` (avoid not action in allow statements) in `mde/validation/psm/rules/security.evl` the feature participates in a semantic validation condition. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/iam.eol`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/values.eol`.	Exactly one of: `ALLOW`, `DENY`. Example: `ALLOW`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`principals` → `IamPrincipal`	containment, [*]	Contains the iam principal element(s) that make up this iam statement; the contained objects belong to this model element.
`conditions` → `IamCondition`	containment, [*]	Contains the iam condition element(s) that make up this iam statement; the contained objects belong to this model element.

`IamPrincipal`

Represents iam principal in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`principalType`	`String` [1]	Records accountable person, team, or identity for principal type for iam principal. It keeps accountability and access review explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `PrincipalHasTypeAndIdentifiers` (principal has type and identifiers) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/iam.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `BUSINESS`.
`identifiers`	`String` [*]	Records the identifiers value for the iam principal. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: `PrincipalHasTypeAndIdentifiers` (principal has type and identifiers) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/iam.eol`.	A collection of values. Example: [`order-123`, `order-123-2`].

Relationships

This class declares no direct relationships.

`IamCondition`

Represents iam condition in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`operator`	`String` [1]	Stores the operator value on the iam condition. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: `ConditionComplete` (condition complete) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `>=`.
`key`	`String` [1]	Records the stable name/key/code used for key for the iam condition. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: `ConditionComplete` (condition complete) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `orderId`.
`values`	`String` [*]	Stores the values value on the iam condition. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: `ConditionComplete` (condition complete) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank.	A collection of values. Example: [`READY`, `READY-2`].

Relationships

This class declares no direct relationships.

`KmsKey`

Represents kms key in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`descriptionText`	`String` [1]	Records human explanation of description text for kms key. It keeps human review and generated guidance explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Orders processing`.
`keyUsage`	`String` [1]	Stores the key usage value on the kms key. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `orderId`.
`keySpec`	`String` [1]	For a kms key, the model records the key spec value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `orderId`.
`enabled`	`Boolean` [1]	Records whether enabled applies to kms key. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `true`.
`enableKeyRotation`	`Boolean` [1]	For a kms key, the model records whether enable key rotation applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `ProductionKmsKeyRotation` (production kms key rotation) in `mde/validation/psm/rules/security.evl` the flag must be enabled for this rule to pass. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Either `true` or `false`. Example: `false`.
`multiRegion`	`Boolean` [1]	Records whether multi region applies to kms key. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Either `true` or `false`. Example: `false`.
`pendingWindowInDays`	`Integer` [1]	Records pending window in days duration or limit, expressed in days for kms key. It keeps an operational boundary that should not be left to provider defaults explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `PendingWindowRange` (pending window range) in `mde/validation/psm/rules/security.evl` the value must remain absent in this modeling situation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `1`.
`keyPolicyJson`	`String` [1]	Records the serialized JSON representation of key policy for the kms key. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`keyPolicy` → `IamPolicyDocument`	containment, [?]	Contains the iam policy document element(s) that make up this kms key; the contained objects belong to this model element.
`aliases` → `KmsAlias`	reference, [*]; opposite `targetKey`	References the kms alias element(s) used as aliases by this kms key; the target may be shared elsewhere in the model.

`KmsAlias`

Represents kms alias in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`aliasName`	`String` [1]	For a kms alias, the model records the stable name/key/code used for alias name. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `KmsAliasNameValid` (kms alias name valid) in `mde/validation/psm/rules/security.evl` the value must satisfy a numeric or ordering boundary.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `alias/orders-key`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`targetKey` → `KmsKey`	reference, [1]; opposite `aliases`	References the kms key element(s) used as target key by this kms alias; the target may be shared elsewhere in the model.

`GenerateSecretStringConfig`

Represents generate secret string config in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`secretStringTemplate`	`String` [1]	Records the secret string template value for the generate secret string config. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Generate Secret String Config Secret String Template`.
`generateStringKey`	`String` [1]	Records stable name/key/code used for generate string key for generate secret string config. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `orderId`.
`passwordLength`	`Integer` [1]	Records the password length value for the generate secret string config. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `1`.
`excludeCharacters`	`String` [1]	For a generate secret string config, the model records the exclude characters value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Generate Secret String Config Exclude Characters`.
`excludeLowercase`	`Boolean` [1]	Records whether exclude lowercase applies to generate secret string config. It preserves an explicit architectural or governance decision through review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.
`excludeUppercase`	`Boolean` [1]	For a generate secret string config, the model records whether exclude uppercase applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.
`excludeNumbers`	`Boolean` [1]	For a generate secret string config, the model records whether exclude numbers applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.
`excludePunctuation`	`Boolean` [1]	Records whether exclude punctuation applies to generate secret string config. The field records an explicit architectural or governance decision as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.
`includeSpace`	`Boolean` [1]	Records whether include space applies to generate secret string config. The field records an explicit architectural or governance decision as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.
`requireEachIncludedType`	`Boolean` [1]	Records whether require each included type applies to generate secret string config. The field records an explicit architectural or governance decision as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.

Relationships

This class declares no direct relationships.

`SecretsManagerSecret`

Represents secrets manager secret in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`secretName`	`String` [1]	Records stable name/key/code used for secret name for secrets manager secret. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SecretsManagerSecret`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `SecretsManagerSecretExample`.
`descriptionText`	`String` [1]	Records the human explanation of description text for the secrets manager secret. This keeps the decision explicit even when the element's class or relationships remain unchanged. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SecretsManagerSecret`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Orders processing`.
`generateSecretStringJson`	`String` [1]	For a secrets manager secret, the model records the serialized JSON representation of generate secret string. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `SecretHasValueOrGenerator` (secret has value or generator) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SecretsManagerSecret`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.
`rotationRequired`	`Boolean` [1]	Records whether rotation required applies to secrets manager secret. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: `RotationRequiredHasSchedule` (rotation required has schedule) in `mde/validation/psm/rules/security.evl` the flag must be enabled for this rule to pass. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SecretsManagerSecret`. ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` reads or derives this feature while refining `SecretsManagerSecret`.	Either `true` or `false`. Example: `true`.
`replicaRegionsJson`	`String` [1]	Records the serialized JSON representation of replica regions for the secrets manager secret. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`secretValue` → `ValueExpression`	containment, [?]	Contains the value expression element(s) that make up this secrets manager secret; the contained objects belong to this model element.
`generateSecretString` → `GenerateSecretStringConfig`	containment, [?]	Contains the generate secret string config element(s) that make up this secrets manager secret; the contained objects belong to this model element.
`kmsKey` → `KmsKey`	reference, [?]	References the kms key element(s) used as kms key by this secrets manager secret; the target may be shared elsewhere in the model.
`rotationSchedule` → `SecretRotationSchedule`	reference, [?]; opposite `secret`	References the secret rotation schedule element(s) used as rotation schedule by this secrets manager secret; the target may be shared elsewhere in the model.
`resourcePolicy` → `SecretsManagerResourcePolicy`	reference, [?]; opposite `secret`	References the secrets manager resource policy element(s) used as resource policy by this secrets manager secret; the target may be shared elsewhere in the model.

`SecretRotationRules`

Represents secret rotation rules in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`automaticallyAfterDays`	`Integer` [1]	Records automatically after days duration or limit, expressed in days for secret rotation rules. It keeps an operational boundary that should not be left to provider defaults explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `1`.
`scheduleExpression`	`String` [1]	Stores the expression or rule that governs schedule expression on the secret rotation rules. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `$.status == 'READY'`.
`durationHours`	`Integer` [1]	For a secret rotation rules, the model records the duration hours duration or limit, expressed in hours. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `30`.

Relationships

This class declares no direct relationships.

`SecretRotationSchedule`

Represents secret rotation schedule in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`rotationRulesJson`	`String` [1]	For a secret rotation schedule, the model records the serialized JSON representation of rotation rules. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `RotationScheduleHasRulesOrLambda` (rotation schedule has rules or lambda) in `mde/validation/psm/rules/security.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`rotationRules` → `SecretRotationRules`	containment, [?]	Contains the secret rotation rules element(s) that make up this secret rotation schedule; the contained objects belong to this model element.
`secret` → `SecretsManagerSecret`	reference, [1]; opposite `rotationSchedule`	References the secrets manager secret element(s) used as secret by this secret rotation schedule; the target may be shared elsewhere in the model.
`rotationLambda` → `AwsResource`	reference, [?]	References the aws resource element(s) used as rotation lambda by this secret rotation schedule; the target may be shared elsewhere in the model.

`SecretsManagerResourcePolicy`

Represents secrets manager resource policy in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`resourcePolicyJson`	`String` [1]	Stores the origin/source selected for resource policy json on the secrets manager resource policy. The field preserves structured provider or contract detail as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`resourcePolicy` → `IamPolicyDocument`	containment, [?]	Contains the iam policy document element(s) that make up this secrets manager resource policy; the contained objects belong to this model element.
`secret` → `SecretsManagerSecret`	reference, [1]; opposite `resourcePolicy`	References the secrets manager secret element(s) used as secret by this secrets manager resource policy; the target may be shared elsewhere in the model.

`SsmParameter`

Represents ssm parameter in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`parameterName`	`String` [1]	Stores the stable name/key/code used for parameter name on the ssm parameter. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: `SecureParameterShouldUseKmsKey` (secure parameter should use kms key) in `mde/validation/psm/rules/security.evl` the rule's diagnostic or remediation guidance refers to this feature. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SsmParameter`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `/orders/prod/database-url`.
`dataType`	`String` [1]	For a ssm parameter, the model records the controlled classification or strategy represented by data type. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SsmParameter`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `BUSINESS`.
`allowedPattern`	`String` [1]	Stores the validation pattern for allowed pattern on the ssm parameter. The field records input/schema validation as an explicit, reviewable input. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SsmParameter`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `^[A-Z][A-Za-z0-9_-]*$`.
`descriptionText`	`String` [1]	Records human explanation of description text for ssm parameter. It keeps human review and generated guidance explicit during review and transformation, so later steps do not have to infer it. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SsmParameter`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Orders processing`.
`parameterType`	`ParameterType` [1]	Records the controlled classification or strategy for parameter type in the ssm parameter. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: `SecureParameterUsesSecureType` (secure parameter uses secure type) in `mde/validation/psm/rules/security.evl` the feature participates in a semantic validation condition. `SecureParameterShouldUseKmsKey` (secure parameter should use kms key) in `mde/validation/psm/rules/security.evl` the feature participates in a semantic validation condition. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SsmParameter`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Exactly one of: `STRING`, `STRING_LIST`, `SECURE_STRING`. Example: `STRING`.
`tier`	`SsmParameterTier` [1]	For a ssm parameter, the model records the controlled classification or strategy represented by tier. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `SsmParameter`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Exactly one of: `STANDARD`, `ADVANCED`, `INTELLIGENT_TIERING`. Example: `STANDARD`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`value` → `ValueExpression`	containment, [?]	Contains the value expression element(s) that make up this ssm parameter; the contained objects belong to this model element.
`kmsKey` → `KmsKey`	reference, [?]	References the kms key element(s) used as kms key by this ssm parameter; the target may be shared elsewhere in the model.

`SsmParameterValueExpression`

Represents ssm parameter value expression in the PSM vocabulary. It specializes ValueExpression with the details needed for this modeling concern.

Direct supertypes: ValueExpression. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

This class declares no attributes of its own. It inherits the attributes of its supertype, if any.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`ssmParameter` → `SsmParameter`	reference, [?]	References the ssm parameter element(s) used as ssm parameter by this ssm parameter value expression; the target may be shared elsewhere in the model.

`SecretValueExpression`

Represents secret value expression in the PSM vocabulary. It specializes ValueExpression with the details needed for this modeling concern.

Direct supertypes: ValueExpression. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

This class declares no attributes of its own. It inherits the attributes of its supertype, if any.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`secretRef` → `SecretsManagerSecret`	reference, [?]	References the secrets manager secret element(s) used as secret ref by this secret value expression; the target may be shared elsewhere in the model.