Explanation for a vendor on a potential way to represent risky action combinations for their product via yaml

risky-actions-example.yml

### 
# Format is below
#
# risk-name:
#   target-name:  # AND logic
#     - service:actionName
#     - service:act* 
#
####
# List of high priority resource exposure actions here: https://gist.github.com/kmcquade/3161a6737285dc0508a9fa3446e22090
Resource Exposure:
  acm-pca:
    description:
    actions:
      - acm-pca:PutPolicy
      - acm-pca:DeletePolicy
  iam-role:
    description:
    actions:
      - iam:UpdateAssumeRolePolicy
# ...etc.

# List of credentials exfiltration actions here: https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a
Credentials Exfiltration:
  iam-access-key:
    description:
    actions:
      - iam:CreateAccessKey
# ...etc.

Network Exposure:
  manage-security-groups:
    description:
    actions:
      - ec2:AuthorizeSecurityGroupIngress 
      - ec2:RevokeSecurityGroupIngress 
      - ec2:AuthorizeSecurityGroupEgress 
      - ec2:RevokeSecurityGroupEgress 
      - ec2:ModifySecurityGroupRules
      - ec2:UpdateSecurityGroupRuleDescriptionsIngress 
      - ec2:UpdateSecurityGroupRuleDescriptionsEgress
# ...etc.