feat: generate allowed actions

[nikpivkin]

Added a command to generate a file with actions that do not support resource level permissions. This will allow periodic synchronisation with AWS. There are about 5135 such actions now (vs 3600 in the main branch).

Related issues

• false positive AVD-AWS-0057 for actions that apply only to all resources trivy#5040

[simar7]

How often does this list change? While the logic to auto generate is nice, I'm afraid it adds unnecessary complexity and is prone to breakage, if AWS decides to change their page which is likely as it isn't a contract/API.

[nikpivkin]

@simar7 I found a repository with documentation, but it's already archived. I don't know how often this list changes, but so far more than 1k actions have been added (or changed) compared to the main branch. Is there any idea how we can update the actions?

[nikpivkin]

This repository contains a list of actions and it is updated frequently.

[simar7]

This repository contains a list of actions and it is updated frequently.

Feels a little better than scraping, maybe we can go with this for the meantime since we don't have any better alternatives.

[nikpivkin]

@simar7 I gave the example of this repository to show that changes to AWS services happen quite often. But this repository is not suitable for us because it only contains a list of actions, and we also need information about the resources required for each action.

[simar7]

@simar7 I gave the example of this repository to show that changes to AWS services happen quite often. But this repository is not suitable for us because it only contains a list of actions, and we also need information about the resources required for each action.

I guess it's fine as it is a self contained piece of code with no better alternatives at the moment.

[nikpivkin]

@simar7 Test run of the workflow nikpivkin@7c0ae85

[simar7]

@simar7 Test run of the workflow nikpivkin@7c0ae85

lgtm, should we merge this PR?