aws-sdk-appmesh 1.33.0 → 1.34.0

data/lib/aws-sdk-appmesh/client_api.rb

@@ -30,6 +30,7 @@ module Aws::AppMesh
     CertificateAuthorityArns = Shapes::ListShape.new(name: 'CertificateAuthorityArns')
     ClientPolicy = Shapes::StructureShape.new(name: 'ClientPolicy')
     ClientPolicyTls = Shapes::StructureShape.new(name: 'ClientPolicyTls')
+    ClientTlsCertificate = Shapes::StructureShape.new(name: 'ClientTlsCertificate')
     ConflictException = Shapes::StructureShape.new(name: 'ConflictException')
     CreateGatewayRouteInput = Shapes::StructureShape.new(name: 'CreateGatewayRouteInput')
     CreateGatewayRouteOutput = Shapes::StructureShape.new(name: 'CreateGatewayRouteOutput')
@@ -157,6 +158,9 @@ module Aws::AppMesh
     ListenerTlsCertificate = Shapes::StructureShape.new(name: 'ListenerTlsCertificate')
     ListenerTlsFileCertificate = Shapes::StructureShape.new(name: 'ListenerTlsFileCertificate')
     ListenerTlsMode = Shapes::StringShape.new(name: 'ListenerTlsMode')
+    ListenerTlsSdsCertificate = Shapes::StructureShape.new(name: 'ListenerTlsSdsCertificate')
+    ListenerTlsValidationContext = Shapes::StructureShape.new(name: 'ListenerTlsValidationContext')
+    ListenerTlsValidationContextTrust = Shapes::StructureShape.new(name: 'ListenerTlsValidationContextTrust')
     Listeners = Shapes::ListShape.new(name: 'Listeners')
     Logging = Shapes::StructureShape.new(name: 'Logging')
     Long = Shapes::IntegerShape.new(name: 'Long')
@@ -191,10 +195,15 @@ module Aws::AppMesh
     RouteSpec = Shapes::StructureShape.new(name: 'RouteSpec')
     RouteStatus = Shapes::StructureShape.new(name: 'RouteStatus')
     RouteStatusCode = Shapes::StringShape.new(name: 'RouteStatusCode')
+    SdsSecretName = Shapes::StringShape.new(name: 'SdsSecretName')
     ServiceDiscovery = Shapes::StructureShape.new(name: 'ServiceDiscovery')
     ServiceName = Shapes::StringShape.new(name: 'ServiceName')
     ServiceUnavailableException = Shapes::StructureShape.new(name: 'ServiceUnavailableException')
     String = Shapes::StringShape.new(name: 'String')
+    SubjectAlternativeName = Shapes::StringShape.new(name: 'SubjectAlternativeName')
+    SubjectAlternativeNameList = Shapes::ListShape.new(name: 'SubjectAlternativeNameList')
+    SubjectAlternativeNameMatchers = Shapes::StructureShape.new(name: 'SubjectAlternativeNameMatchers')
+    SubjectAlternativeNames = Shapes::StructureShape.new(name: 'SubjectAlternativeNames')
     TagKey = Shapes::StringShape.new(name: 'TagKey')
     TagKeyList = Shapes::ListShape.new(name: 'TagKeyList')
     TagList = Shapes::ListShape.new(name: 'TagList')
@@ -212,6 +221,7 @@ module Aws::AppMesh
     TlsValidationContext = Shapes::StructureShape.new(name: 'TlsValidationContext')
     TlsValidationContextAcmTrust = Shapes::StructureShape.new(name: 'TlsValidationContextAcmTrust')
     TlsValidationContextFileTrust = Shapes::StructureShape.new(name: 'TlsValidationContextFileTrust')
+    TlsValidationContextSdsTrust = Shapes::StructureShape.new(name: 'TlsValidationContextSdsTrust')
     TlsValidationContextTrust = Shapes::StructureShape.new(name: 'TlsValidationContextTrust')
     TooManyRequestsException = Shapes::StructureShape.new(name: 'TooManyRequestsException')
     TooManyTagsException = Shapes::StructureShape.new(name: 'TooManyTagsException')
@@ -236,6 +246,7 @@ module Aws::AppMesh
     VirtualGatewayCertificateAuthorityArns = Shapes::ListShape.new(name: 'VirtualGatewayCertificateAuthorityArns')
     VirtualGatewayClientPolicy = Shapes::StructureShape.new(name: 'VirtualGatewayClientPolicy')
     VirtualGatewayClientPolicyTls = Shapes::StructureShape.new(name: 'VirtualGatewayClientPolicyTls')
+    VirtualGatewayClientTlsCertificate = Shapes::StructureShape.new(name: 'VirtualGatewayClientTlsCertificate')
     VirtualGatewayConnectionPool = Shapes::StructureShape.new(name: 'VirtualGatewayConnectionPool')
     VirtualGatewayData = Shapes::StructureShape.new(name: 'VirtualGatewayData')
     VirtualGatewayFileAccessLog = Shapes::StructureShape.new(name: 'VirtualGatewayFileAccessLog')
@@ -253,17 +264,22 @@ module Aws::AppMesh
     VirtualGatewayListenerTlsCertificate = Shapes::StructureShape.new(name: 'VirtualGatewayListenerTlsCertificate')
     VirtualGatewayListenerTlsFileCertificate = Shapes::StructureShape.new(name: 'VirtualGatewayListenerTlsFileCertificate')
     VirtualGatewayListenerTlsMode = Shapes::StringShape.new(name: 'VirtualGatewayListenerTlsMode')
+    VirtualGatewayListenerTlsSdsCertificate = Shapes::StructureShape.new(name: 'VirtualGatewayListenerTlsSdsCertificate')
+    VirtualGatewayListenerTlsValidationContext = Shapes::StructureShape.new(name: 'VirtualGatewayListenerTlsValidationContext')
+    VirtualGatewayListenerTlsValidationContextTrust = Shapes::StructureShape.new(name: 'VirtualGatewayListenerTlsValidationContextTrust')
     VirtualGatewayListeners = Shapes::ListShape.new(name: 'VirtualGatewayListeners')
     VirtualGatewayLogging = Shapes::StructureShape.new(name: 'VirtualGatewayLogging')
     VirtualGatewayPortMapping = Shapes::StructureShape.new(name: 'VirtualGatewayPortMapping')
     VirtualGatewayPortProtocol = Shapes::StringShape.new(name: 'VirtualGatewayPortProtocol')
     VirtualGatewayRef = Shapes::StructureShape.new(name: 'VirtualGatewayRef')
+    VirtualGatewaySdsSecretName = Shapes::StringShape.new(name: 'VirtualGatewaySdsSecretName')
     VirtualGatewaySpec = Shapes::StructureShape.new(name: 'VirtualGatewaySpec')
     VirtualGatewayStatus = Shapes::StructureShape.new(name: 'VirtualGatewayStatus')
     VirtualGatewayStatusCode = Shapes::StringShape.new(name: 'VirtualGatewayStatusCode')
     VirtualGatewayTlsValidationContext = Shapes::StructureShape.new(name: 'VirtualGatewayTlsValidationContext')
     VirtualGatewayTlsValidationContextAcmTrust = Shapes::StructureShape.new(name: 'VirtualGatewayTlsValidationContextAcmTrust')
     VirtualGatewayTlsValidationContextFileTrust = Shapes::StructureShape.new(name: 'VirtualGatewayTlsValidationContextFileTrust')
+    VirtualGatewayTlsValidationContextSdsTrust = Shapes::StructureShape.new(name: 'VirtualGatewayTlsValidationContextSdsTrust')
     VirtualGatewayTlsValidationContextTrust = Shapes::StructureShape.new(name: 'VirtualGatewayTlsValidationContextTrust')
     VirtualNodeConnectionPool = Shapes::StructureShape.new(name: 'VirtualNodeConnectionPool')
     VirtualNodeData = Shapes::StructureShape.new(name: 'VirtualNodeData')
@@ -327,11 +343,16 @@ module Aws::AppMesh
     ClientPolicy.add_member(:tls, Shapes::ShapeRef.new(shape: ClientPolicyTls, location_name: "tls"))
     ClientPolicy.struct_class = Types::ClientPolicy
 
+    ClientPolicyTls.add_member(:certificate, Shapes::ShapeRef.new(shape: ClientTlsCertificate, location_name: "certificate"))
     ClientPolicyTls.add_member(:enforce, Shapes::ShapeRef.new(shape: Boolean, location_name: "enforce", metadata: {"box"=>true}))
     ClientPolicyTls.add_member(:ports, Shapes::ShapeRef.new(shape: PortSet, location_name: "ports"))
     ClientPolicyTls.add_member(:validation, Shapes::ShapeRef.new(shape: TlsValidationContext, required: true, location_name: "validation"))
     ClientPolicyTls.struct_class = Types::ClientPolicyTls
 
+    ClientTlsCertificate.add_member(:file, Shapes::ShapeRef.new(shape: ListenerTlsFileCertificate, location_name: "file"))
+    ClientTlsCertificate.add_member(:sds, Shapes::ShapeRef.new(shape: ListenerTlsSdsCertificate, location_name: "sds"))
+    ClientTlsCertificate.struct_class = Types::ClientTlsCertificate
+
     ConflictException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
     ConflictException.struct_class = Types::ConflictException
 
@@ -830,6 +851,7 @@ module Aws::AppMesh
 
     ListenerTls.add_member(:certificate, Shapes::ShapeRef.new(shape: ListenerTlsCertificate, required: true, location_name: "certificate"))
     ListenerTls.add_member(:mode, Shapes::ShapeRef.new(shape: ListenerTlsMode, required: true, location_name: "mode"))
+    ListenerTls.add_member(:validation, Shapes::ShapeRef.new(shape: ListenerTlsValidationContext, location_name: "validation"))
     ListenerTls.struct_class = Types::ListenerTls
 
     ListenerTlsAcmCertificate.add_member(:certificate_arn, Shapes::ShapeRef.new(shape: Arn, required: true, location_name: "certificateArn"))
@@ -837,12 +859,24 @@ module Aws::AppMesh
 
     ListenerTlsCertificate.add_member(:acm, Shapes::ShapeRef.new(shape: ListenerTlsAcmCertificate, location_name: "acm"))
     ListenerTlsCertificate.add_member(:file, Shapes::ShapeRef.new(shape: ListenerTlsFileCertificate, location_name: "file"))
+    ListenerTlsCertificate.add_member(:sds, Shapes::ShapeRef.new(shape: ListenerTlsSdsCertificate, location_name: "sds"))
     ListenerTlsCertificate.struct_class = Types::ListenerTlsCertificate
 
     ListenerTlsFileCertificate.add_member(:certificate_chain, Shapes::ShapeRef.new(shape: FilePath, required: true, location_name: "certificateChain"))
     ListenerTlsFileCertificate.add_member(:private_key, Shapes::ShapeRef.new(shape: FilePath, required: true, location_name: "privateKey"))
     ListenerTlsFileCertificate.struct_class = Types::ListenerTlsFileCertificate
 
+    ListenerTlsSdsCertificate.add_member(:secret_name, Shapes::ShapeRef.new(shape: SdsSecretName, required: true, location_name: "secretName"))
+    ListenerTlsSdsCertificate.struct_class = Types::ListenerTlsSdsCertificate
+
+    ListenerTlsValidationContext.add_member(:subject_alternative_names, Shapes::ShapeRef.new(shape: SubjectAlternativeNames, location_name: "subjectAlternativeNames"))
+    ListenerTlsValidationContext.add_member(:trust, Shapes::ShapeRef.new(shape: ListenerTlsValidationContextTrust, required: true, location_name: "trust"))
+    ListenerTlsValidationContext.struct_class = Types::ListenerTlsValidationContext
+
+    ListenerTlsValidationContextTrust.add_member(:file, Shapes::ShapeRef.new(shape: TlsValidationContextFileTrust, location_name: "file"))
+    ListenerTlsValidationContextTrust.add_member(:sds, Shapes::ShapeRef.new(shape: TlsValidationContextSdsTrust, location_name: "sds"))
+    ListenerTlsValidationContextTrust.struct_class = Types::ListenerTlsValidationContextTrust
+
     Listeners.member = Shapes::ShapeRef.new(shape: Listener)
 
     Logging.add_member(:access_log, Shapes::ShapeRef.new(shape: AccessLog, location_name: "accessLog"))
@@ -940,6 +974,14 @@ module Aws::AppMesh
     ServiceUnavailableException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
     ServiceUnavailableException.struct_class = Types::ServiceUnavailableException
 
+    SubjectAlternativeNameList.member = Shapes::ShapeRef.new(shape: SubjectAlternativeName)
+
+    SubjectAlternativeNameMatchers.add_member(:exact, Shapes::ShapeRef.new(shape: SubjectAlternativeNameList, required: true, location_name: "exact"))
+    SubjectAlternativeNameMatchers.struct_class = Types::SubjectAlternativeNameMatchers
+
+    SubjectAlternativeNames.add_member(:match, Shapes::ShapeRef.new(shape: SubjectAlternativeNameMatchers, required: true, location_name: "match"))
+    SubjectAlternativeNames.struct_class = Types::SubjectAlternativeNames
+
     TagKeyList.member = Shapes::ShapeRef.new(shape: TagKey)
 
     TagList.member = Shapes::ShapeRef.new(shape: TagRef)
@@ -966,6 +1008,7 @@ module Aws::AppMesh
     TcpTimeout.add_member(:idle, Shapes::ShapeRef.new(shape: Duration, location_name: "idle"))
     TcpTimeout.struct_class = Types::TcpTimeout
 
+    TlsValidationContext.add_member(:subject_alternative_names, Shapes::ShapeRef.new(shape: SubjectAlternativeNames, location_name: "subjectAlternativeNames"))
     TlsValidationContext.add_member(:trust, Shapes::ShapeRef.new(shape: TlsValidationContextTrust, required: true, location_name: "trust"))
     TlsValidationContext.struct_class = Types::TlsValidationContext
 
@@ -975,8 +1018,12 @@ module Aws::AppMesh
     TlsValidationContextFileTrust.add_member(:certificate_chain, Shapes::ShapeRef.new(shape: FilePath, required: true, location_name: "certificateChain"))
     TlsValidationContextFileTrust.struct_class = Types::TlsValidationContextFileTrust
 
+    TlsValidationContextSdsTrust.add_member(:secret_name, Shapes::ShapeRef.new(shape: SdsSecretName, required: true, location_name: "secretName"))
+    TlsValidationContextSdsTrust.struct_class = Types::TlsValidationContextSdsTrust
+
     TlsValidationContextTrust.add_member(:acm, Shapes::ShapeRef.new(shape: TlsValidationContextAcmTrust, location_name: "acm"))
     TlsValidationContextTrust.add_member(:file, Shapes::ShapeRef.new(shape: TlsValidationContextFileTrust, location_name: "file"))
+    TlsValidationContextTrust.add_member(:sds, Shapes::ShapeRef.new(shape: TlsValidationContextSdsTrust, location_name: "sds"))
     TlsValidationContextTrust.struct_class = Types::TlsValidationContextTrust
 
     TooManyRequestsException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
@@ -1086,11 +1133,16 @@ module Aws::AppMesh
     VirtualGatewayClientPolicy.add_member(:tls, Shapes::ShapeRef.new(shape: VirtualGatewayClientPolicyTls, location_name: "tls"))
     VirtualGatewayClientPolicy.struct_class = Types::VirtualGatewayClientPolicy
 
+    VirtualGatewayClientPolicyTls.add_member(:certificate, Shapes::ShapeRef.new(shape: VirtualGatewayClientTlsCertificate, location_name: "certificate"))
     VirtualGatewayClientPolicyTls.add_member(:enforce, Shapes::ShapeRef.new(shape: Boolean, location_name: "enforce", metadata: {"box"=>true}))
     VirtualGatewayClientPolicyTls.add_member(:ports, Shapes::ShapeRef.new(shape: PortSet, location_name: "ports"))
     VirtualGatewayClientPolicyTls.add_member(:validation, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContext, required: true, location_name: "validation"))
     VirtualGatewayClientPolicyTls.struct_class = Types::VirtualGatewayClientPolicyTls
 
+    VirtualGatewayClientTlsCertificate.add_member(:file, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsFileCertificate, location_name: "file"))
+    VirtualGatewayClientTlsCertificate.add_member(:sds, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsSdsCertificate, location_name: "sds"))
+    VirtualGatewayClientTlsCertificate.struct_class = Types::VirtualGatewayClientTlsCertificate
+
     VirtualGatewayConnectionPool.add_member(:grpc, Shapes::ShapeRef.new(shape: VirtualGatewayGrpcConnectionPool, location_name: "grpc"))
     VirtualGatewayConnectionPool.add_member(:http, Shapes::ShapeRef.new(shape: VirtualGatewayHttpConnectionPool, location_name: "http"))
     VirtualGatewayConnectionPool.add_member(:http2, Shapes::ShapeRef.new(shape: VirtualGatewayHttp2ConnectionPool, location_name: "http2"))
@@ -1135,6 +1187,7 @@ module Aws::AppMesh
 
     VirtualGatewayListenerTls.add_member(:certificate, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsCertificate, required: true, location_name: "certificate"))
     VirtualGatewayListenerTls.add_member(:mode, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsMode, required: true, location_name: "mode"))
+    VirtualGatewayListenerTls.add_member(:validation, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsValidationContext, location_name: "validation"))
     VirtualGatewayListenerTls.struct_class = Types::VirtualGatewayListenerTls
 
     VirtualGatewayListenerTlsAcmCertificate.add_member(:certificate_arn, Shapes::ShapeRef.new(shape: Arn, required: true, location_name: "certificateArn"))
@@ -1142,12 +1195,24 @@ module Aws::AppMesh
 
     VirtualGatewayListenerTlsCertificate.add_member(:acm, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsAcmCertificate, location_name: "acm"))
     VirtualGatewayListenerTlsCertificate.add_member(:file, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsFileCertificate, location_name: "file"))
+    VirtualGatewayListenerTlsCertificate.add_member(:sds, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsSdsCertificate, location_name: "sds"))
     VirtualGatewayListenerTlsCertificate.struct_class = Types::VirtualGatewayListenerTlsCertificate
 
     VirtualGatewayListenerTlsFileCertificate.add_member(:certificate_chain, Shapes::ShapeRef.new(shape: FilePath, required: true, location_name: "certificateChain"))
     VirtualGatewayListenerTlsFileCertificate.add_member(:private_key, Shapes::ShapeRef.new(shape: FilePath, required: true, location_name: "privateKey"))
     VirtualGatewayListenerTlsFileCertificate.struct_class = Types::VirtualGatewayListenerTlsFileCertificate
 
+    VirtualGatewayListenerTlsSdsCertificate.add_member(:secret_name, Shapes::ShapeRef.new(shape: VirtualGatewaySdsSecretName, required: true, location_name: "secretName"))
+    VirtualGatewayListenerTlsSdsCertificate.struct_class = Types::VirtualGatewayListenerTlsSdsCertificate
+
+    VirtualGatewayListenerTlsValidationContext.add_member(:subject_alternative_names, Shapes::ShapeRef.new(shape: SubjectAlternativeNames, location_name: "subjectAlternativeNames"))
+    VirtualGatewayListenerTlsValidationContext.add_member(:trust, Shapes::ShapeRef.new(shape: VirtualGatewayListenerTlsValidationContextTrust, required: true, location_name: "trust"))
+    VirtualGatewayListenerTlsValidationContext.struct_class = Types::VirtualGatewayListenerTlsValidationContext
+
+    VirtualGatewayListenerTlsValidationContextTrust.add_member(:file, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContextFileTrust, location_name: "file"))
+    VirtualGatewayListenerTlsValidationContextTrust.add_member(:sds, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContextSdsTrust, location_name: "sds"))
+    VirtualGatewayListenerTlsValidationContextTrust.struct_class = Types::VirtualGatewayListenerTlsValidationContextTrust
+
     VirtualGatewayListeners.member = Shapes::ShapeRef.new(shape: VirtualGatewayListener)
 
     VirtualGatewayLogging.add_member(:access_log, Shapes::ShapeRef.new(shape: VirtualGatewayAccessLog, location_name: "accessLog"))
@@ -1175,6 +1240,7 @@ module Aws::AppMesh
     VirtualGatewayStatus.add_member(:status, Shapes::ShapeRef.new(shape: VirtualGatewayStatusCode, required: true, location_name: "status"))
     VirtualGatewayStatus.struct_class = Types::VirtualGatewayStatus
 
+    VirtualGatewayTlsValidationContext.add_member(:subject_alternative_names, Shapes::ShapeRef.new(shape: SubjectAlternativeNames, location_name: "subjectAlternativeNames"))
     VirtualGatewayTlsValidationContext.add_member(:trust, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContextTrust, required: true, location_name: "trust"))
     VirtualGatewayTlsValidationContext.struct_class = Types::VirtualGatewayTlsValidationContext
 
@@ -1184,8 +1250,12 @@ module Aws::AppMesh
     VirtualGatewayTlsValidationContextFileTrust.add_member(:certificate_chain, Shapes::ShapeRef.new(shape: FilePath, required: true, location_name: "certificateChain"))
     VirtualGatewayTlsValidationContextFileTrust.struct_class = Types::VirtualGatewayTlsValidationContextFileTrust
 
+    VirtualGatewayTlsValidationContextSdsTrust.add_member(:secret_name, Shapes::ShapeRef.new(shape: VirtualGatewaySdsSecretName, required: true, location_name: "secretName"))
+    VirtualGatewayTlsValidationContextSdsTrust.struct_class = Types::VirtualGatewayTlsValidationContextSdsTrust
+
     VirtualGatewayTlsValidationContextTrust.add_member(:acm, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContextAcmTrust, location_name: "acm"))
     VirtualGatewayTlsValidationContextTrust.add_member(:file, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContextFileTrust, location_name: "file"))
+    VirtualGatewayTlsValidationContextTrust.add_member(:sds, Shapes::ShapeRef.new(shape: VirtualGatewayTlsValidationContextSdsTrust, location_name: "sds"))
     VirtualGatewayTlsValidationContextTrust.struct_class = Types::VirtualGatewayTlsValidationContextTrust
 
     VirtualNodeConnectionPool.add_member(:grpc, Shapes::ShapeRef.new(shape: VirtualNodeGrpcConnectionPool, location_name: "grpc"))

data/lib/aws-sdk-appmesh/types.rb

@@ -126,9 +126,23 @@ module Aws::AppMesh
     #         virtual_service: {
     #           client_policy: {
     #             tls: {
+    #               certificate: {
+    #                 file: {
+    #                   certificate_chain: "FilePath", # required
+    #                   private_key: "FilePath", # required
+    #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
+    #               },
     #               enforce: false,
     #               ports: [1],
     #               validation: { # required
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
     #                 trust: { # required
     #                   acm: {
     #                     certificate_authority_arns: ["Arn"], # required
@@ -136,6 +150,9 @@ module Aws::AppMesh
     #                   file: {
     #                     certificate_chain: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
     #                 },
     #               },
     #             },
@@ -164,9 +181,23 @@ module Aws::AppMesh
     #       {
     #         client_policy: {
     #           tls: {
+    #             certificate: {
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #                 private_key: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
+    #             },
     #             enforce: false,
     #             ports: [1],
     #             validation: { # required
+    #               subject_alternative_names: {
+    #                 match: { # required
+    #                   exact: ["SubjectAlternativeName"], # required
+    #                 },
+    #               },
     #               trust: { # required
     #                 acm: {
     #                   certificate_authority_arns: ["Arn"], # required
@@ -174,6 +205,9 @@ module Aws::AppMesh
     #                 file: {
     #                   certificate_chain: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
     #               },
     #             },
     #           },
@@ -213,9 +247,23 @@ module Aws::AppMesh
     #
     #       {
     #         tls: {
+    #           certificate: {
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #               private_key: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
+    #           },
     #           enforce: false,
     #           ports: [1],
     #           validation: { # required
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
     #             trust: { # required
     #               acm: {
     #                 certificate_authority_arns: ["Arn"], # required
@@ -223,6 +271,9 @@ module Aws::AppMesh
     #               file: {
     #                 certificate_chain: "FilePath", # required
     #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
     #             },
     #           },
     #         },
@@ -248,9 +299,23 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         certificate: {
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #             private_key: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
+    #         },
     #         enforce: false,
     #         ports: [1],
     #         validation: { # required
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
     #           trust: { # required
     #             acm: {
     #               certificate_authority_arns: ["Arn"], # required
@@ -258,10 +323,18 @@ module Aws::AppMesh
     #             file: {
     #               certificate_chain: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
     #           },
     #         },
     #       }
     #
+    # @!attribute [rw] certificate
+    #   A reference to an object that represents a client's TLS
+    #   certificate.
+    #   @return [Types::ClientTlsCertificate]
+    #
     # @!attribute [rw] enforce
     #   Whether the policy is enforced. The default is `True`, if a value
     #   isn't specified.
@@ -278,6 +351,7 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ClientPolicyTls AWS API Documentation
     #
     class ClientPolicyTls < Struct.new(
+      :certificate,
       :enforce,
       :ports,
       :validation)
@@ -285,6 +359,46 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the client's certificate.
+    #
+    # @note When making an API call, you may pass ClientTlsCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         file: {
+    #           certificate_chain: "FilePath", # required
+    #           private_key: "FilePath", # required
+    #         },
+    #         sds: {
+    #           secret_name: "SdsSecretName", # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] file
+    #   An object that represents a local file certificate. The certificate
+    #   must meet specific requirements and you must have proxy
+    #   authorization enabled. For more information, see [Transport Layer
+    #   Security (TLS)][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html#virtual-node-tls-prerequisites
+    #   @return [Types::ListenerTlsFileCertificate]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a client's TLS Secret
+    #   Discovery Service certificate.
+    #   @return [Types::ListenerTlsSdsCertificate]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ClientTlsCertificate AWS API Documentation
+    #
+    class ClientTlsCertificate < Struct.new(
+      :file,
+      :sds)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # The request contains a client token that was used for a previous
     # update resource call with different specifications. Try the request
     # again with a new client token.
@@ -782,9 +896,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -792,6 +920,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -833,8 +964,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -937,9 +1086,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -947,6 +1110,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -957,9 +1123,23 @@ module Aws::AppMesh
     #               virtual_service: {
     #                 client_policy: {
     #                   tls: {
+    #                     certificate: {
+    #                       file: {
+    #                         certificate_chain: "FilePath", # required
+    #                         private_key: "FilePath", # required
+    #                       },
+    #                       sds: {
+    #                         secret_name: "SdsSecretName", # required
+    #                       },
+    #                     },
     #                     enforce: false,
     #                     ports: [1],
     #                     validation: { # required
+    #                       subject_alternative_names: {
+    #                         match: { # required
+    #                           exact: ["SubjectAlternativeName"], # required
+    #                         },
+    #                       },
     #                       trust: { # required
     #                         acm: {
     #                           certificate_authority_arns: ["Arn"], # required
@@ -967,6 +1147,9 @@ module Aws::AppMesh
     #                         file: {
     #                           certificate_chain: "FilePath", # required
     #                         },
+    #                         sds: {
+    #                           secret_name: "SdsSecretName", # required
+    #                         },
     #                       },
     #                     },
     #                   },
@@ -1064,8 +1247,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -4240,8 +4441,26 @@ module Aws::AppMesh
     #               certificate_chain: "FilePath", # required
     #               private_key: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
     #           },
     #           mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #           validation: {
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
+    #             trust: { # required
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
+    #             },
+    #           },
     #         },
     #       }
     #
@@ -4369,13 +4588,31 @@ module Aws::AppMesh
     #             certificate_chain: "FilePath", # required
     #             private_key: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
     #         },
     #         mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #         validation: {
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
+    #           trust: { # required
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
+    #           },
+    #         },
     #       }
     #
     # @!attribute [rw] certificate
-    #   A reference to an object that represents a listener's TLS
-    #   certificate.
+    #   A reference to an object that represents a listener's Transport
+    #   Layer Security (TLS) certificate.
     #   @return [Types::ListenerTlsCertificate]
     #
     # @!attribute [rw] mode
@@ -4389,11 +4626,17 @@ module Aws::AppMesh
     #   * ****DISABLED – Listener only accepts connections without TLS.
     #   @return [String]
     #
+    # @!attribute [rw] validation
+    #   A reference to an object that represents a listener's Transport
+    #   Layer Security (TLS) validation context.
+    #   @return [Types::ListenerTlsValidationContext]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTls AWS API Documentation
     #
     class ListenerTls < Struct.new(
       :certificate,
-      :mode)
+      :mode,
+      :validation)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4440,6 +4683,9 @@ module Aws::AppMesh
     #           certificate_chain: "FilePath", # required
     #           private_key: "FilePath", # required
     #         },
+    #         sds: {
+    #           secret_name: "SdsSecretName", # required
+    #         },
     #       }
     #
     # @!attribute [rw] acm
@@ -4451,11 +4697,17 @@ module Aws::AppMesh
     #   A reference to an object that represents a local file certificate.
     #   @return [Types::ListenerTlsFileCertificate]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a listener's Secret
+    #   Discovery Service certificate.
+    #   @return [Types::ListenerTlsSdsCertificate]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsCertificate AWS API Documentation
     #
     class ListenerTlsCertificate < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4495,6 +4747,113 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the listener's Secret Discovery Service
+    # certificate. The proxy must be configured with a local SDS provider
+    # via a Unix Domain Socket. See App Mesh [TLS documentation][1] for more
+    # info.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass ListenerTlsSdsCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         secret_name: "SdsSecretName", # required
+    #       }
+    #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret
+    #   requested from the Secret Discovery Service provider representing
+    #   Transport Layer Security (TLS) materials like a certificate or
+    #   certificate chain.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsSdsCertificate AWS API Documentation
+    #
+    class ListenerTlsSdsCertificate < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a listener's Transport Layer Security (TLS)
+    # validation context.
+    #
+    # @note When making an API call, you may pass ListenerTlsValidationContext
+    #   data as a hash:
+    #
+    #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
+    #         trust: { # required
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
+    #         },
+    #       }
+    #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a listener's
+    #   Transport Layer Security (TLS) validation context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
+    # @!attribute [rw] trust
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
+    #   @return [Types::ListenerTlsValidationContextTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsValidationContext AWS API Documentation
+    #
+    class ListenerTlsValidationContext < Struct.new(
+      :subject_alternative_names,
+      :trust)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a listener's Transport Layer Security (TLS)
+    # validation context trust.
+    #
+    # @note When making an API call, you may pass ListenerTlsValidationContextTrust
+    #   data as a hash:
+    #
+    #       {
+    #         file: {
+    #           certificate_chain: "FilePath", # required
+    #         },
+    #         sds: {
+    #           secret_name: "SdsSecretName", # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] file
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
+    #   @return [Types::TlsValidationContextFileTrust]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a listener's Transport
+    #   Layer Security (TLS) Secret Discovery Service validation context
+    #   trust.
+    #   @return [Types::TlsValidationContextSdsTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsValidationContextTrust AWS API Documentation
+    #
+    class ListenerTlsValidationContextTrust < Struct.new(
+      :file,
+      :sds)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # An object that represents the logging information for a virtual node.
     #
     # @note When making an API call, you may pass Logging
@@ -5227,6 +5586,53 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the methods by which a subject alternative
+    # name on a peer Transport Layer Security (TLS) certificate can be
+    # matched.
+    #
+    # @note When making an API call, you may pass SubjectAlternativeNameMatchers
+    #   data as a hash:
+    #
+    #       {
+    #         exact: ["SubjectAlternativeName"], # required
+    #       }
+    #
+    # @!attribute [rw] exact
+    #   The values sent must match the specified values exactly.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/SubjectAlternativeNameMatchers AWS API Documentation
+    #
+    class SubjectAlternativeNameMatchers < Struct.new(
+      :exact)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the subject alternative names secured by the
+    # certificate.
+    #
+    # @note When making an API call, you may pass SubjectAlternativeNames
+    #   data as a hash:
+    #
+    #       {
+    #         match: { # required
+    #           exact: ["SubjectAlternativeName"], # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] match
+    #   An object that represents the criteria for determining a SANs match.
+    #   @return [Types::SubjectAlternativeNameMatchers]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/SubjectAlternativeNames AWS API Documentation
+    #
+    class SubjectAlternativeNames < Struct.new(
+      :match)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Optional metadata that you apply to a resource to assist with
     # categorization and organization. Each tag consists of a key and an
     # optional value, both of which you define. Tag keys can have a maximum
@@ -5398,13 +5804,18 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # An object that represents a Transport Layer Security (TLS) validation
-    # context.
+    # An object that represents how the proxy will validate its peer during
+    # Transport Layer Security (TLS) negotiation.
     #
     # @note When making an API call, you may pass TlsValidationContext
     #   data as a hash:
     #
     #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
     #         trust: { # required
     #           acm: {
     #             certificate_authority_arns: ["Arn"], # required
@@ -5412,24 +5823,33 @@ module Aws::AppMesh
     #           file: {
     #             certificate_chain: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
     #         },
     #       }
     #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a Transport
+    #   Layer Security (TLS) validation context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
     # @!attribute [rw] trust
-    #   A reference to an object that represents a TLS validation context
-    #   trust.
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
     #   @return [Types::TlsValidationContextTrust]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/TlsValidationContext AWS API Documentation
     #
     class TlsValidationContext < Struct.new(
+      :subject_alternative_names,
       :trust)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents a TLS validation context trust for an AWS
-    # Certicate Manager (ACM) certificate.
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust for an AWS Certicate Manager (ACM) certificate.
     #
     # @note When making an API call, you may pass TlsValidationContextAcmTrust
     #   data as a hash:
@@ -5473,36 +5893,76 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # An object that represents a Transport Layer Security (TLS) validation
-    # context trust.
+    # An object that represents a Transport Layer Security (TLS) Secret
+    # Discovery Service validation context trust. The proxy must be
+    # configured with a local SDS provider via a Unix Domain Socket. See App
+    # Mesh [TLS documentation][1] for more info.
     #
-    # @note When making an API call, you may pass TlsValidationContextTrust
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass TlsValidationContextSdsTrust
     #   data as a hash:
     #
     #       {
-    #         acm: {
-    #           certificate_authority_arns: ["Arn"], # required
-    #         },
-    #         file: {
-    #           certificate_chain: "FilePath", # required
-    #         },
+    #         secret_name: "SdsSecretName", # required
+    #       }
+    #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret for
+    #   a Transport Layer Security (TLS) Secret Discovery Service validation
+    #   context trust.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/TlsValidationContextSdsTrust AWS API Documentation
+    #
+    class TlsValidationContextSdsTrust < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust.
+    #
+    # @note When making an API call, you may pass TlsValidationContextTrust
+    #   data as a hash:
+    #
+    #       {
+    #         acm: {
+    #           certificate_authority_arns: ["Arn"], # required
+    #         },
+    #         file: {
+    #           certificate_chain: "FilePath", # required
+    #         },
+    #         sds: {
+    #           secret_name: "SdsSecretName", # required
+    #         },
     #       }
     #
     # @!attribute [rw] acm
-    #   A reference to an object that represents a TLS validation context
-    #   trust for an AWS Certicate Manager (ACM) certificate.
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) validation context trust for an AWS Certicate Manager (ACM)
+    #   certificate.
     #   @return [Types::TlsValidationContextAcmTrust]
     #
     # @!attribute [rw] file
-    #   An object that represents a TLS validation context trust for a local
-    #   file.
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
     #   @return [Types::TlsValidationContextFileTrust]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) Secret Discovery Service validation context trust.
+    #   @return [Types::TlsValidationContextSdsTrust]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/TlsValidationContextTrust AWS API Documentation
     #
     class TlsValidationContextTrust < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -6009,9 +6469,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -6019,6 +6493,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -6060,8 +6537,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -6148,9 +6643,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -6158,6 +6667,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -6168,9 +6680,23 @@ module Aws::AppMesh
     #               virtual_service: {
     #                 client_policy: {
     #                   tls: {
+    #                     certificate: {
+    #                       file: {
+    #                         certificate_chain: "FilePath", # required
+    #                         private_key: "FilePath", # required
+    #                       },
+    #                       sds: {
+    #                         secret_name: "SdsSecretName", # required
+    #                       },
+    #                     },
     #                     enforce: false,
     #                     ports: [1],
     #                     validation: { # required
+    #                       subject_alternative_names: {
+    #                         match: { # required
+    #                           exact: ["SubjectAlternativeName"], # required
+    #                         },
+    #                       },
     #                       trust: { # required
     #                         acm: {
     #                           certificate_authority_arns: ["Arn"], # required
@@ -6178,6 +6704,9 @@ module Aws::AppMesh
     #                         file: {
     #                           certificate_chain: "FilePath", # required
     #                         },
+    #                         sds: {
+    #                           secret_name: "SdsSecretName", # required
+    #                         },
     #                       },
     #                     },
     #                   },
@@ -6275,8 +6804,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -6568,9 +7115,23 @@ module Aws::AppMesh
     #       {
     #         client_policy: {
     #           tls: {
+    #             certificate: {
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #                 private_key: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "VirtualGatewaySdsSecretName", # required
+    #               },
+    #             },
     #             enforce: false,
     #             ports: [1],
     #             validation: { # required
+    #               subject_alternative_names: {
+    #                 match: { # required
+    #                   exact: ["SubjectAlternativeName"], # required
+    #                 },
+    #               },
     #               trust: { # required
     #                 acm: {
     #                   certificate_authority_arns: ["Arn"], # required
@@ -6578,6 +7139,9 @@ module Aws::AppMesh
     #                 file: {
     #                   certificate_chain: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "VirtualGatewaySdsSecretName", # required
+    #                 },
     #               },
     #             },
     #           },
@@ -6603,9 +7167,23 @@ module Aws::AppMesh
     #
     #       {
     #         tls: {
+    #           certificate: {
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #               private_key: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
+    #           },
     #           enforce: false,
     #           ports: [1],
     #           validation: { # required
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
     #             trust: { # required
     #               acm: {
     #                 certificate_authority_arns: ["Arn"], # required
@@ -6613,6 +7191,9 @@ module Aws::AppMesh
     #               file: {
     #                 certificate_chain: "FilePath", # required
     #               },
+    #               sds: {
+    #                 secret_name: "VirtualGatewaySdsSecretName", # required
+    #               },
     #             },
     #           },
     #         },
@@ -6638,9 +7219,23 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         certificate: {
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #             private_key: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
+    #         },
     #         enforce: false,
     #         ports: [1],
     #         validation: { # required
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
     #           trust: { # required
     #             acm: {
     #               certificate_authority_arns: ["Arn"], # required
@@ -6648,10 +7243,18 @@ module Aws::AppMesh
     #             file: {
     #               certificate_chain: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
     #           },
     #         },
     #       }
     #
+    # @!attribute [rw] certificate
+    #   A reference to an object that represents a virtual gateway's
+    #   client's Transport Layer Security (TLS) certificate.
+    #   @return [Types::VirtualGatewayClientTlsCertificate]
+    #
     # @!attribute [rw] enforce
     #   Whether the policy is enforced. The default is `True`, if a value
     #   isn't specified.
@@ -6662,12 +7265,14 @@ module Aws::AppMesh
     #   @return [Array<Integer>]
     #
     # @!attribute [rw] validation
-    #   A reference to an object that represents a TLS validation context.
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) validation context.
     #   @return [Types::VirtualGatewayTlsValidationContext]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayClientPolicyTls AWS API Documentation
     #
     class VirtualGatewayClientPolicyTls < Struct.new(
+      :certificate,
       :enforce,
       :ports,
       :validation)
@@ -6675,6 +7280,47 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the virtual gateway's client's Transport
+    # Layer Security (TLS) certificate.
+    #
+    # @note When making an API call, you may pass VirtualGatewayClientTlsCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         file: {
+    #           certificate_chain: "FilePath", # required
+    #           private_key: "FilePath", # required
+    #         },
+    #         sds: {
+    #           secret_name: "VirtualGatewaySdsSecretName", # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] file
+    #   An object that represents a local file certificate. The certificate
+    #   must meet specific requirements and you must have proxy
+    #   authorization enabled. For more information, see [Transport Layer
+    #   Security (TLS)][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html#virtual-node-tls-prerequisites
+    #   @return [Types::VirtualGatewayListenerTlsFileCertificate]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   client's Secret Discovery Service certificate.
+    #   @return [Types::VirtualGatewayListenerTlsSdsCertificate]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayClientTlsCertificate AWS API Documentation
+    #
+    class VirtualGatewayClientTlsCertificate < Struct.new(
+      :file,
+      :sds)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # An object that represents the type of virtual gateway connection pool.
     #
     # Only one protocol is used at a time and should be the same protocol as
@@ -6965,8 +7611,26 @@ module Aws::AppMesh
     #               certificate_chain: "FilePath", # required
     #               private_key: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
     #           },
     #           mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #           validation: {
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
+    #             trust: { # required
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "VirtualGatewaySdsSecretName", # required
+    #               },
+    #             },
+    #           },
     #         },
     #       }
     #
@@ -7013,8 +7677,26 @@ module Aws::AppMesh
     #             certificate_chain: "FilePath", # required
     #             private_key: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
     #         },
     #         mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #         validation: {
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
+    #           trust: { # required
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
+    #           },
+    #         },
     #       }
     #
     # @!attribute [rw] certificate
@@ -7033,11 +7715,17 @@ module Aws::AppMesh
     #   * ****DISABLED – Listener only accepts connections without TLS.
     #   @return [String]
     #
+    # @!attribute [rw] validation
+    #   A reference to an object that represents a virtual gateway's
+    #   listener's Transport Layer Security (TLS) validation context.
+    #   @return [Types::VirtualGatewayListenerTlsValidationContext]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTls AWS API Documentation
     #
     class VirtualGatewayListenerTls < Struct.new(
       :certificate,
-      :mode)
+      :mode,
+      :validation)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -7084,6 +7772,9 @@ module Aws::AppMesh
     #           certificate_chain: "FilePath", # required
     #           private_key: "FilePath", # required
     #         },
+    #         sds: {
+    #           secret_name: "VirtualGatewaySdsSecretName", # required
+    #         },
     #       }
     #
     # @!attribute [rw] acm
@@ -7095,11 +7786,17 @@ module Aws::AppMesh
     #   A reference to an object that represents a local file certificate.
     #   @return [Types::VirtualGatewayListenerTlsFileCertificate]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   listener's Secret Discovery Service certificate.
+    #   @return [Types::VirtualGatewayListenerTlsSdsCertificate]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsCertificate AWS API Documentation
     #
     class VirtualGatewayListenerTlsCertificate < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -7139,6 +7836,114 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the virtual gateway's listener's Secret
+    # Discovery Service certificate.The proxy must be configured with a
+    # local SDS provider via a Unix Domain Socket. See App Mesh [TLS
+    # documentation][1] for more info.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass VirtualGatewayListenerTlsSdsCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         secret_name: "VirtualGatewaySdsSecretName", # required
+    #       }
+    #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret
+    #   secret requested from the Secret Discovery Service provider
+    #   representing Transport Layer Security (TLS) materials like a
+    #   certificate or certificate chain.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsSdsCertificate AWS API Documentation
+    #
+    class VirtualGatewayListenerTlsSdsCertificate < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a virtual gateway's listener's Transport
+    # Layer Security (TLS) validation context.
+    #
+    # @note When making an API call, you may pass VirtualGatewayListenerTlsValidationContext
+    #   data as a hash:
+    #
+    #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
+    #         trust: { # required
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
+    #         },
+    #       }
+    #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a virtual
+    #   gateway listener's Transport Layer Security (TLS) validation
+    #   context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
+    # @!attribute [rw] trust
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
+    #   @return [Types::VirtualGatewayListenerTlsValidationContextTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsValidationContext AWS API Documentation
+    #
+    class VirtualGatewayListenerTlsValidationContext < Struct.new(
+      :subject_alternative_names,
+      :trust)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a virtual gateway's listener's Transport
+    # Layer Security (TLS) validation context trust.
+    #
+    # @note When making an API call, you may pass VirtualGatewayListenerTlsValidationContextTrust
+    #   data as a hash:
+    #
+    #       {
+    #         file: {
+    #           certificate_chain: "FilePath", # required
+    #         },
+    #         sds: {
+    #           secret_name: "VirtualGatewaySdsSecretName", # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] file
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
+    #   @return [Types::VirtualGatewayTlsValidationContextFileTrust]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   listener's Transport Layer Security (TLS) Secret Discovery Service
+    #   validation context trust.
+    #   @return [Types::VirtualGatewayTlsValidationContextSdsTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsValidationContextTrust AWS API Documentation
+    #
+    class VirtualGatewayListenerTlsValidationContextTrust < Struct.new(
+      :file,
+      :sds)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # An object that represents logging information.
     #
     # @note When making an API call, you may pass VirtualGatewayLogging
@@ -7268,9 +8073,23 @@ module Aws::AppMesh
     #         backend_defaults: {
     #           client_policy: {
     #             tls: {
+    #               certificate: {
+    #                 file: {
+    #                   certificate_chain: "FilePath", # required
+    #                   private_key: "FilePath", # required
+    #                 },
+    #                 sds: {
+    #                   secret_name: "VirtualGatewaySdsSecretName", # required
+    #                 },
+    #               },
     #               enforce: false,
     #               ports: [1],
     #               validation: { # required
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
     #                 trust: { # required
     #                   acm: {
     #                     certificate_authority_arns: ["Arn"], # required
@@ -7278,6 +8097,9 @@ module Aws::AppMesh
     #                   file: {
     #                     certificate_chain: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
     #                 },
     #               },
     #             },
@@ -7319,8 +8141,26 @@ module Aws::AppMesh
     #                   certificate_chain: "FilePath", # required
     #                   private_key: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "VirtualGatewaySdsSecretName", # required
+    #                 },
     #               },
     #               mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #               validation: {
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
+    #                 trust: { # required
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
+    #                 },
+    #               },
     #             },
     #           },
     #         ],
@@ -7377,6 +8217,11 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
     #         trust: { # required
     #           acm: {
     #             certificate_authority_arns: ["Arn"], # required
@@ -7384,24 +8229,34 @@ module Aws::AppMesh
     #           file: {
     #             certificate_chain: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
     #         },
     #       }
     #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a virtual
+    #   gateway's listener's Transport Layer Security (TLS) validation
+    #   context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
     # @!attribute [rw] trust
-    #   A reference to an object that represents a TLS validation context
-    #   trust.
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
     #   @return [Types::VirtualGatewayTlsValidationContextTrust]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayTlsValidationContext AWS API Documentation
     #
     class VirtualGatewayTlsValidationContext < Struct.new(
+      :subject_alternative_names,
       :trust)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents a TLS validation context trust for an AWS
-    # Certicate Manager (ACM) certificate.
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust for an AWS Certicate Manager (ACM) certificate.
     #
     # @note When making an API call, you may pass VirtualGatewayTlsValidationContextAcmTrust
     #   data as a hash:
@@ -7445,6 +8300,36 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents a virtual gateway's listener's Transport
+    # Layer Security (TLS) Secret Discovery Service validation context
+    # trust. The proxy must be configured with a local SDS provider via a
+    # Unix Domain Socket. See App Mesh [TLS documentation][1] for more info.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass VirtualGatewayTlsValidationContextSdsTrust
+    #   data as a hash:
+    #
+    #       {
+    #         secret_name: "VirtualGatewaySdsSecretName", # required
+    #       }
+    #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret for
+    #   a virtual gateway's Transport Layer Security (TLS) Secret Discovery
+    #   Service validation context trust.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayTlsValidationContextSdsTrust AWS API Documentation
+    #
+    class VirtualGatewayTlsValidationContextSdsTrust < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # An object that represents a Transport Layer Security (TLS) validation
     # context trust.
     #
@@ -7458,23 +8343,34 @@ module Aws::AppMesh
     #         file: {
     #           certificate_chain: "FilePath", # required
     #         },
+    #         sds: {
+    #           secret_name: "VirtualGatewaySdsSecretName", # required
+    #         },
     #       }
     #
     # @!attribute [rw] acm
-    #   A reference to an object that represents a TLS validation context
-    #   trust for an AWS Certicate Manager (ACM) certificate.
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) validation context trust for an AWS Certicate Manager (ACM)
+    #   certificate.
     #   @return [Types::VirtualGatewayTlsValidationContextAcmTrust]
     #
     # @!attribute [rw] file
-    #   An object that represents a TLS validation context trust for a local
-    #   file.
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
     #   @return [Types::VirtualGatewayTlsValidationContextFileTrust]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   Transport Layer Security (TLS) Secret Discovery Service validation
+    #   context trust.
+    #   @return [Types::VirtualGatewayTlsValidationContextSdsTrust]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayTlsValidationContextTrust AWS API Documentation
     #
     class VirtualGatewayTlsValidationContextTrust < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -7737,9 +8633,23 @@ module Aws::AppMesh
     #         backend_defaults: {
     #           client_policy: {
     #             tls: {
+    #               certificate: {
+    #                 file: {
+    #                   certificate_chain: "FilePath", # required
+    #                   private_key: "FilePath", # required
+    #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
+    #               },
     #               enforce: false,
     #               ports: [1],
     #               validation: { # required
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
     #                 trust: { # required
     #                   acm: {
     #                     certificate_authority_arns: ["Arn"], # required
@@ -7747,6 +8657,9 @@ module Aws::AppMesh
     #                   file: {
     #                     certificate_chain: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
     #                 },
     #               },
     #             },
@@ -7757,9 +8670,23 @@ module Aws::AppMesh
     #             virtual_service: {
     #               client_policy: {
     #                 tls: {
+    #                   certificate: {
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                       private_key: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
+    #                   },
     #                   enforce: false,
     #                   ports: [1],
     #                   validation: { # required
+    #                     subject_alternative_names: {
+    #                       match: { # required
+    #                         exact: ["SubjectAlternativeName"], # required
+    #                       },
+    #                     },
     #                     trust: { # required
     #                       acm: {
     #                         certificate_authority_arns: ["Arn"], # required
@@ -7767,6 +8694,9 @@ module Aws::AppMesh
     #                       file: {
     #                         certificate_chain: "FilePath", # required
     #                       },
+    #                       sds: {
+    #                         secret_name: "SdsSecretName", # required
+    #                       },
     #                     },
     #                   },
     #                 },
@@ -7864,8 +8794,26 @@ module Aws::AppMesh
     #                   certificate_chain: "FilePath", # required
     #                   private_key: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
     #               },
     #               mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #               validation: {
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
+    #                 trust: { # required
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
+    #               },
     #             },
     #           },
     #         ],
@@ -8166,9 +9114,23 @@ module Aws::AppMesh
     #       {
     #         client_policy: {
     #           tls: {
+    #             certificate: {
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #                 private_key: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
+    #             },
     #             enforce: false,
     #             ports: [1],
     #             validation: { # required
+    #               subject_alternative_names: {
+    #                 match: { # required
+    #                   exact: ["SubjectAlternativeName"], # required
+    #                 },
+    #               },
     #               trust: { # required
     #                 acm: {
     #                   certificate_authority_arns: ["Arn"], # required
@@ -8176,6 +9138,9 @@ module Aws::AppMesh
     #                 file: {
     #                   certificate_chain: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
     #               },
     #             },
     #           },