aws-sdk-appmesh 1.33.0 → 1.37.0

data/lib/aws-sdk-appmesh/errors.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-appmesh/resource.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-appmesh/types.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 
@@ -13,14 +13,9 @@ module Aws::AppMesh
     # An object that represents the access logging information for a virtual
     # node.
     #
-    # @note When making an API call, you may pass AccessLog
-    #   data as a hash:
+    # @note AccessLog is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         file: {
-    #           path: "FilePath", # required
-    #         },
-    #       }
+    # @note AccessLog is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of AccessLog corresponding to the set member.
     #
     # @!attribute [rw] file
     #   The file object to send virtual node access logs to.
@@ -29,13 +24,18 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/AccessLog AWS API Documentation
     #
     class AccessLog < Struct.new(
-      :file)
+      :file,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class File < AccessLog; end
+      class Unknown < AccessLog; end
     end
 
-    # An object that represents the AWS Cloud Map attribute information for
-    # your virtual node.
+    # An object that represents the Cloud Map attribute information for your
+    # virtual node.
     #
     # <note markdown="1"> AWS Cloud Map is not available in the eu-south-1 Region.
     #
@@ -50,15 +50,15 @@ module Aws::AppMesh
     #       }
     #
     # @!attribute [rw] key
-    #   The name of an AWS Cloud Map service instance attribute key. Any AWS
-    #   Cloud Map service instance that contains the specified key and value
-    #   is returned.
+    #   The name of an Cloud Map service instance attribute key. Any Cloud
+    #   Map service instance that contains the specified key and value is
+    #   returned.
     #   @return [String]
     #
     # @!attribute [rw] value
-    #   The value of an AWS Cloud Map service instance attribute key. Any
-    #   AWS Cloud Map service instance that contains the specified key and
-    #   value is returned.
+    #   The value of an Cloud Map service instance attribute key. Any Cloud
+    #   Map service instance that contains the specified key and value is
+    #   returned.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/AwsCloudMapInstanceAttribute AWS API Documentation
@@ -70,10 +70,10 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # An object that represents the AWS Cloud Map service discovery
-    # information for your virtual node.
+    # An object that represents the Cloud Map service discovery information
+    # for your virtual node.
     #
-    # <note markdown="1"> AWS Cloud Map is not available in the eu-south-1 Region.
+    # <note markdown="1"> Cloud Map is not available in the eu-south-1 Region.
     #
     #  </note>
     #
@@ -99,11 +99,11 @@ module Aws::AppMesh
     #   @return [Array<Types::AwsCloudMapInstanceAttribute>]
     #
     # @!attribute [rw] namespace_name
-    #   The name of the AWS Cloud Map namespace to use.
+    #   The name of the Cloud Map namespace to use.
     #   @return [String]
     #
     # @!attribute [rw] service_name
-    #   The name of the AWS Cloud Map service to use.
+    #   The name of the Cloud Map service to use.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/AwsCloudMapServiceDiscovery AWS API Documentation
@@ -119,30 +119,9 @@ module Aws::AppMesh
     # An object that represents the backends that a virtual node is expected
     # to send outbound traffic to.
     #
-    # @note When making an API call, you may pass Backend
-    #   data as a hash:
+    # @note Backend is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         virtual_service: {
-    #           client_policy: {
-    #             tls: {
-    #               enforce: false,
-    #               ports: [1],
-    #               validation: { # required
-    #                 trust: { # required
-    #                   acm: {
-    #                     certificate_authority_arns: ["Arn"], # required
-    #                   },
-    #                   file: {
-    #                     certificate_chain: "FilePath", # required
-    #                   },
-    #                 },
-    #               },
-    #             },
-    #           },
-    #           virtual_service_name: "ServiceName", # required
-    #         },
-    #       }
+    # @note Backend is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of Backend corresponding to the set member.
     #
     # @!attribute [rw] virtual_service
     #   Specifies a virtual service to use as a backend.
@@ -151,9 +130,14 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/Backend AWS API Documentation
     #
     class Backend < Struct.new(
-      :virtual_service)
+      :virtual_service,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class VirtualService < Backend; end
+      class Unknown < Backend; end
     end
 
     # An object that represents the default properties for a backend.
@@ -164,9 +148,23 @@ module Aws::AppMesh
     #       {
     #         client_policy: {
     #           tls: {
+    #             certificate: {
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #                 private_key: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
+    #             },
     #             enforce: false,
     #             ports: [1],
     #             validation: { # required
+    #               subject_alternative_names: {
+    #                 match: { # required
+    #                   exact: ["SubjectAlternativeName"], # required
+    #                 },
+    #               },
     #               trust: { # required
     #                 acm: {
     #                   certificate_authority_arns: ["Arn"], # required
@@ -174,6 +172,9 @@ module Aws::AppMesh
     #                 file: {
     #                   certificate_chain: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
     #               },
     #             },
     #           },
@@ -213,9 +214,23 @@ module Aws::AppMesh
     #
     #       {
     #         tls: {
+    #           certificate: {
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #               private_key: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
+    #           },
     #           enforce: false,
     #           ports: [1],
     #           validation: { # required
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
     #             trust: { # required
     #               acm: {
     #                 certificate_authority_arns: ["Arn"], # required
@@ -223,6 +238,9 @@ module Aws::AppMesh
     #               file: {
     #                 certificate_chain: "FilePath", # required
     #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
     #             },
     #           },
     #         },
@@ -248,9 +266,23 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         certificate: {
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #             private_key: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
+    #         },
     #         enforce: false,
     #         ports: [1],
     #         validation: { # required
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
     #           trust: { # required
     #             acm: {
     #               certificate_authority_arns: ["Arn"], # required
@@ -258,10 +290,18 @@ module Aws::AppMesh
     #             file: {
     #               certificate_chain: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
     #           },
     #         },
     #       }
     #
+    # @!attribute [rw] certificate
+    #   A reference to an object that represents a client's TLS
+    #   certificate.
+    #   @return [Types::ClientTlsCertificate]
+    #
     # @!attribute [rw] enforce
     #   Whether the policy is enforced. The default is `True`, if a value
     #   isn't specified.
@@ -278,6 +318,7 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ClientPolicyTls AWS API Documentation
     #
     class ClientPolicyTls < Struct.new(
+      :certificate,
       :enforce,
       :ports,
       :validation)
@@ -285,6 +326,43 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the client's certificate.
+    #
+    # @note ClientTlsCertificate is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note ClientTlsCertificate is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of ClientTlsCertificate corresponding to the set member.
+    #
+    # @!attribute [rw] file
+    #   An object that represents a local file certificate. The certificate
+    #   must meet specific requirements and you must have proxy
+    #   authorization enabled. For more information, see [Transport Layer
+    #   Security (TLS)][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #   @return [Types::ListenerTlsFileCertificate]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a client's TLS Secret
+    #   Discovery Service certificate.
+    #   @return [Types::ListenerTlsSdsCertificate]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ClientTlsCertificate AWS API Documentation
+    #
+    class ClientTlsCertificate < Struct.new(
+      :file,
+      :sds,
+      :unknown)
+      SENSITIVE = []
+      include Aws::Structure
+      include Aws::Structure::Union
+
+      class File < ClientTlsCertificate; end
+      class Sds < ClientTlsCertificate; end
+      class Unknown < ClientTlsCertificate; end
+    end
+
     # The request contains a client token that was used for a previous
     # update resource call with different specifications. Try the request
     # again with a new client token.
@@ -311,6 +389,11 @@ module Aws::AppMesh
     #         spec: { # required
     #           grpc_route: {
     #             action: { # required
+    #               rewrite: {
+    #                 hostname: {
+    #                   default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #                 },
+    #               },
     #               target: { # required
     #                 virtual_service: { # required
     #                   virtual_service_name: "ResourceName", # required
@@ -318,11 +401,43 @@ module Aws::AppMesh
     #               },
     #             },
     #             match: { # required
+    #               hostname: {
+    #                 exact: "ExactHostName",
+    #                 suffix: "SuffixHostname",
+    #               },
+    #               metadata: [
+    #                 {
+    #                   invert: false,
+    #                   match: {
+    #                     exact: "HeaderMatch",
+    #                     prefix: "HeaderMatch",
+    #                     range: {
+    #                       end: 1, # required
+    #                       start: 1, # required
+    #                     },
+    #                     regex: "HeaderMatch",
+    #                     suffix: "HeaderMatch",
+    #                   },
+    #                   name: "HeaderName", # required
+    #                 },
+    #               ],
     #               service_name: "ServiceName",
     #             },
     #           },
     #           http2_route: {
     #             action: { # required
+    #               rewrite: {
+    #                 hostname: {
+    #                   default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #                 },
+    #                 path: {
+    #                   exact: "HttpPathExact",
+    #                 },
+    #                 prefix: {
+    #                   default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #                   value: "HttpGatewayRoutePrefix",
+    #                 },
+    #               },
     #               target: { # required
     #                 virtual_service: { # required
     #                   virtual_service_name: "ResourceName", # required
@@ -330,11 +445,56 @@ module Aws::AppMesh
     #               },
     #             },
     #             match: { # required
-    #               prefix: "String", # required
+    #               headers: [
+    #                 {
+    #                   invert: false,
+    #                   match: {
+    #                     exact: "HeaderMatch",
+    #                     prefix: "HeaderMatch",
+    #                     range: {
+    #                       end: 1, # required
+    #                       start: 1, # required
+    #                     },
+    #                     regex: "HeaderMatch",
+    #                     suffix: "HeaderMatch",
+    #                   },
+    #                   name: "HeaderName", # required
+    #                 },
+    #               ],
+    #               hostname: {
+    #                 exact: "ExactHostName",
+    #                 suffix: "SuffixHostname",
+    #               },
+    #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #             },
     #           },
     #           http_route: {
     #             action: { # required
+    #               rewrite: {
+    #                 hostname: {
+    #                   default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #                 },
+    #                 path: {
+    #                   exact: "HttpPathExact",
+    #                 },
+    #                 prefix: {
+    #                   default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #                   value: "HttpGatewayRoutePrefix",
+    #                 },
+    #               },
     #               target: { # required
     #                 virtual_service: { # required
     #                   virtual_service_name: "ResourceName", # required
@@ -342,9 +502,43 @@ module Aws::AppMesh
     #               },
     #             },
     #             match: { # required
-    #               prefix: "String", # required
+    #               headers: [
+    #                 {
+    #                   invert: false,
+    #                   match: {
+    #                     exact: "HeaderMatch",
+    #                     prefix: "HeaderMatch",
+    #                     range: {
+    #                       end: 1, # required
+    #                       start: 1, # required
+    #                     },
+    #                     regex: "HeaderMatch",
+    #                     suffix: "HeaderMatch",
+    #                   },
+    #                   name: "HeaderName", # required
+    #                 },
+    #               ],
+    #               hostname: {
+    #                 exact: "ExactHostName",
+    #                 suffix: "SuffixHostname",
+    #               },
+    #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #             },
     #           },
+    #           priority: 1,
     #         },
     #         tags: [
     #           {
@@ -594,7 +788,19 @@ module Aws::AppMesh
     #                 },
     #               ],
     #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #               prefix: "String", # required
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #               scheme: "http", # accepts http, https
     #             },
     #             retry_policy: {
@@ -644,7 +850,19 @@ module Aws::AppMesh
     #                 },
     #               ],
     #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #               prefix: "String", # required
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #               scheme: "http", # accepts http, https
     #             },
     #             retry_policy: {
@@ -782,9 +1000,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -792,6 +1024,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -833,8 +1068,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -937,9 +1190,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -947,6 +1214,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -957,9 +1227,23 @@ module Aws::AppMesh
     #               virtual_service: {
     #                 client_policy: {
     #                   tls: {
+    #                     certificate: {
+    #                       file: {
+    #                         certificate_chain: "FilePath", # required
+    #                         private_key: "FilePath", # required
+    #                       },
+    #                       sds: {
+    #                         secret_name: "SdsSecretName", # required
+    #                       },
+    #                     },
     #                     enforce: false,
     #                     ports: [1],
     #                     validation: { # required
+    #                       subject_alternative_names: {
+    #                         match: { # required
+    #                           exact: ["SubjectAlternativeName"], # required
+    #                         },
+    #                       },
     #                       trust: { # required
     #                         acm: {
     #                           certificate_authority_arns: ["Arn"], # required
@@ -967,6 +1251,9 @@ module Aws::AppMesh
     #                         file: {
     #                           certificate_chain: "FilePath", # required
     #                         },
+    #                         sds: {
+    #                           secret_name: "SdsSecretName", # required
+    #                         },
     #                       },
     #                     },
     #                   },
@@ -1064,8 +1351,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -1089,6 +1394,7 @@ module Aws::AppMesh
     #             },
     #             dns: {
     #               hostname: "Hostname", # required
+    #               response_type: "LOADBALANCER", # accepts LOADBALANCER, ENDPOINTS
     #             },
     #           },
     #         },
@@ -1582,9 +1888,7 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # <zonbook />
-    #
-    # <xhtml />
+    # Deletes a virtual node input.
     #
     # @note When making an API call, you may pass DeleteVirtualNodeInput
     #   data as a hash:
@@ -2161,16 +2465,22 @@ module Aws::AppMesh
     #
     #       {
     #         hostname: "Hostname", # required
+    #         response_type: "LOADBALANCER", # accepts LOADBALANCER, ENDPOINTS
     #       }
     #
     # @!attribute [rw] hostname
     #   Specifies the DNS service discovery hostname for the virtual node.
     #   @return [String]
     #
+    # @!attribute [rw] response_type
+    #   Specifies the DNS response type for the virtual node.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/DnsServiceDiscovery AWS API Documentation
     #
     class DnsServiceDiscovery < Struct.new(
-      :hostname)
+      :hostname,
+      :response_type)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -2214,9 +2524,10 @@ module Aws::AppMesh
     # @!attribute [rw] type
     #   The egress filter type. By default, the type is `DROP_ALL`, which
     #   allows egress only from virtual nodes to other defined resources in
-    #   the service mesh (and any traffic to `*.amazonaws.com` for AWS API
-    #   calls). You can set the egress filter type to `ALLOW_ALL` to allow
-    #   egress to any endpoint inside or outside of the service mesh.
+    #   the service mesh (and any traffic to `*.amazonaws.com` for Amazon
+    #   Web Services API calls). You can set the egress filter type to
+    #   `ALLOW_ALL` to allow egress to any endpoint inside or outside of the
+    #   service mesh.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/EgressFilter AWS API Documentation
@@ -2311,6 +2622,54 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object representing the gateway route host name to match.
+    #
+    # @note When making an API call, you may pass GatewayRouteHostnameMatch
+    #   data as a hash:
+    #
+    #       {
+    #         exact: "ExactHostName",
+    #         suffix: "SuffixHostname",
+    #       }
+    #
+    # @!attribute [rw] exact
+    #   The exact host name to match on.
+    #   @return [String]
+    #
+    # @!attribute [rw] suffix
+    #   The specified ending characters of the host name to match on.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GatewayRouteHostnameMatch AWS API Documentation
+    #
+    class GatewayRouteHostnameMatch < Struct.new(
+      :exact,
+      :suffix)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object representing the gateway route host name to rewrite.
+    #
+    # @note When making an API call, you may pass GatewayRouteHostnameRewrite
+    #   data as a hash:
+    #
+    #       {
+    #         default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #       }
+    #
+    # @!attribute [rw] default_target_hostname
+    #   The default target host name to write to.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GatewayRouteHostnameRewrite AWS API Documentation
+    #
+    class GatewayRouteHostnameRewrite < Struct.new(
+      :default_target_hostname)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # An object that represents a gateway route returned by a list
     # operation.
     #
@@ -2392,6 +2751,11 @@ module Aws::AppMesh
     #       {
     #         grpc_route: {
     #           action: { # required
+    #             rewrite: {
+    #               hostname: {
+    #                 default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #               },
+    #             },
     #             target: { # required
     #               virtual_service: { # required
     #                 virtual_service_name: "ResourceName", # required
@@ -2399,11 +2763,43 @@ module Aws::AppMesh
     #             },
     #           },
     #           match: { # required
-    #             service_name: "ServiceName",
-    #           },
+    #             hostname: {
+    #               exact: "ExactHostName",
+    #               suffix: "SuffixHostname",
+    #             },
+    #             metadata: [
+    #               {
+    #                 invert: false,
+    #                 match: {
+    #                   exact: "HeaderMatch",
+    #                   prefix: "HeaderMatch",
+    #                   range: {
+    #                     end: 1, # required
+    #                     start: 1, # required
+    #                   },
+    #                   regex: "HeaderMatch",
+    #                   suffix: "HeaderMatch",
+    #                 },
+    #                 name: "HeaderName", # required
+    #               },
+    #             ],
+    #             service_name: "ServiceName",
+    #           },
     #         },
     #         http2_route: {
     #           action: { # required
+    #             rewrite: {
+    #               hostname: {
+    #                 default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #               },
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #               },
+    #               prefix: {
+    #                 default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #                 value: "HttpGatewayRoutePrefix",
+    #               },
+    #             },
     #             target: { # required
     #               virtual_service: { # required
     #                 virtual_service_name: "ResourceName", # required
@@ -2411,11 +2807,56 @@ module Aws::AppMesh
     #             },
     #           },
     #           match: { # required
-    #             prefix: "String", # required
+    #             headers: [
+    #               {
+    #                 invert: false,
+    #                 match: {
+    #                   exact: "HeaderMatch",
+    #                   prefix: "HeaderMatch",
+    #                   range: {
+    #                     end: 1, # required
+    #                     start: 1, # required
+    #                   },
+    #                   regex: "HeaderMatch",
+    #                   suffix: "HeaderMatch",
+    #                 },
+    #                 name: "HeaderName", # required
+    #               },
+    #             ],
+    #             hostname: {
+    #               exact: "ExactHostName",
+    #               suffix: "SuffixHostname",
+    #             },
+    #             method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #             path: {
+    #               exact: "HttpPathExact",
+    #               regex: "HttpPathRegex",
+    #             },
+    #             prefix: "String",
+    #             query_parameters: [
+    #               {
+    #                 match: {
+    #                   exact: "String",
+    #                 },
+    #                 name: "QueryParameterName", # required
+    #               },
+    #             ],
     #           },
     #         },
     #         http_route: {
     #           action: { # required
+    #             rewrite: {
+    #               hostname: {
+    #                 default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #               },
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #               },
+    #               prefix: {
+    #                 default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #                 value: "HttpGatewayRoutePrefix",
+    #               },
+    #             },
     #             target: { # required
     #               virtual_service: { # required
     #                 virtual_service_name: "ResourceName", # required
@@ -2423,9 +2864,43 @@ module Aws::AppMesh
     #             },
     #           },
     #           match: { # required
-    #             prefix: "String", # required
+    #             headers: [
+    #               {
+    #                 invert: false,
+    #                 match: {
+    #                   exact: "HeaderMatch",
+    #                   prefix: "HeaderMatch",
+    #                   range: {
+    #                     end: 1, # required
+    #                     start: 1, # required
+    #                   },
+    #                   regex: "HeaderMatch",
+    #                   suffix: "HeaderMatch",
+    #                 },
+    #                 name: "HeaderName", # required
+    #               },
+    #             ],
+    #             hostname: {
+    #               exact: "ExactHostName",
+    #               suffix: "SuffixHostname",
+    #             },
+    #             method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #             path: {
+    #               exact: "HttpPathExact",
+    #               regex: "HttpPathRegex",
+    #             },
+    #             prefix: "String",
+    #             query_parameters: [
+    #               {
+    #                 match: {
+    #                   exact: "String",
+    #                 },
+    #                 name: "QueryParameterName", # required
+    #               },
+    #             ],
     #           },
     #         },
+    #         priority: 1,
     #       }
     #
     # @!attribute [rw] grpc_route
@@ -2442,12 +2917,17 @@ module Aws::AppMesh
     #   route.
     #   @return [Types::HttpGatewayRoute]
     #
+    # @!attribute [rw] priority
+    #   The ordering of the gateway routes spec.
+    #   @return [Integer]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GatewayRouteSpec AWS API Documentation
     #
     class GatewayRouteSpec < Struct.new(
       :grpc_route,
       :http2_route,
-      :http_route)
+      :http_route,
+      :priority)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -2518,6 +2998,11 @@ module Aws::AppMesh
     #
     #       {
     #         action: { # required
+    #           rewrite: {
+    #             hostname: {
+    #               default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #             },
+    #           },
     #           target: { # required
     #             virtual_service: { # required
     #               virtual_service_name: "ResourceName", # required
@@ -2525,6 +3010,26 @@ module Aws::AppMesh
     #           },
     #         },
     #         match: { # required
+    #           hostname: {
+    #             exact: "ExactHostName",
+    #             suffix: "SuffixHostname",
+    #           },
+    #           metadata: [
+    #             {
+    #               invert: false,
+    #               match: {
+    #                 exact: "HeaderMatch",
+    #                 prefix: "HeaderMatch",
+    #                 range: {
+    #                   end: 1, # required
+    #                   start: 1, # required
+    #                 },
+    #                 regex: "HeaderMatch",
+    #                 suffix: "HeaderMatch",
+    #               },
+    #               name: "HeaderName", # required
+    #             },
+    #           ],
     #           service_name: "ServiceName",
     #         },
     #       }
@@ -2554,6 +3059,11 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         rewrite: {
+    #           hostname: {
+    #             default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #           },
+    #         },
     #         target: { # required
     #           virtual_service: { # required
     #             virtual_service_name: "ResourceName", # required
@@ -2561,6 +3071,10 @@ module Aws::AppMesh
     #         },
     #       }
     #
+    # @!attribute [rw] rewrite
+    #   The gateway route action to rewrite.
+    #   @return [Types::GrpcGatewayRouteRewrite]
+    #
     # @!attribute [rw] target
     #   An object that represents the target that traffic is routed to when
     #   a request matches the gateway route.
@@ -2569,6 +3083,7 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GrpcGatewayRouteAction AWS API Documentation
     #
     class GrpcGatewayRouteAction < Struct.new(
+      :rewrite,
       :target)
       SENSITIVE = []
       include Aws::Structure
@@ -2581,9 +3096,37 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         hostname: {
+    #           exact: "ExactHostName",
+    #           suffix: "SuffixHostname",
+    #         },
+    #         metadata: [
+    #           {
+    #             invert: false,
+    #             match: {
+    #               exact: "HeaderMatch",
+    #               prefix: "HeaderMatch",
+    #               range: {
+    #                 end: 1, # required
+    #                 start: 1, # required
+    #               },
+    #               regex: "HeaderMatch",
+    #               suffix: "HeaderMatch",
+    #             },
+    #             name: "HeaderName", # required
+    #           },
+    #         ],
     #         service_name: "ServiceName",
     #       }
     #
+    # @!attribute [rw] hostname
+    #   The gateway route host name to be matched on.
+    #   @return [Types::GatewayRouteHostnameMatch]
+    #
+    # @!attribute [rw] metadata
+    #   The gateway route metadata to be matched on.
+    #   @return [Array<Types::GrpcGatewayRouteMetadata>]
+    #
     # @!attribute [rw] service_name
     #   The fully qualified domain name for the service to match from the
     #   request.
@@ -2592,14 +3135,140 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GrpcGatewayRouteMatch AWS API Documentation
     #
     class GrpcGatewayRouteMatch < Struct.new(
+      :hostname,
+      :metadata,
       :service_name)
       SENSITIVE = []
       include Aws::Structure
     end
 
+    # An object representing the metadata of the gateway route.
+    #
+    # @note When making an API call, you may pass GrpcGatewayRouteMetadata
+    #   data as a hash:
+    #
+    #       {
+    #         invert: false,
+    #         match: {
+    #           exact: "HeaderMatch",
+    #           prefix: "HeaderMatch",
+    #           range: {
+    #             end: 1, # required
+    #             start: 1, # required
+    #           },
+    #           regex: "HeaderMatch",
+    #           suffix: "HeaderMatch",
+    #         },
+    #         name: "HeaderName", # required
+    #       }
+    #
+    # @!attribute [rw] invert
+    #   Specify `True` to match anything except the match criteria. The
+    #   default value is `False`.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] match
+    #   The criteria for determining a metadata match.
+    #   @return [Types::GrpcMetadataMatchMethod]
+    #
+    # @!attribute [rw] name
+    #   A name for the gateway route metadata.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GrpcGatewayRouteMetadata AWS API Documentation
+    #
+    class GrpcGatewayRouteMetadata < Struct.new(
+      :invert,
+      :match,
+      :name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the gateway route to rewrite.
+    #
+    # @note When making an API call, you may pass GrpcGatewayRouteRewrite
+    #   data as a hash:
+    #
+    #       {
+    #         hostname: {
+    #           default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #         },
+    #       }
+    #
+    # @!attribute [rw] hostname
+    #   The host name of the gateway route to rewrite.
+    #   @return [Types::GatewayRouteHostnameRewrite]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GrpcGatewayRouteRewrite AWS API Documentation
+    #
+    class GrpcGatewayRouteRewrite < Struct.new(
+      :hostname)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object representing the method header to be matched.
+    #
+    # @note GrpcMetadataMatchMethod is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note GrpcMetadataMatchMethod is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of GrpcMetadataMatchMethod corresponding to the set member.
+    #
+    # @!attribute [rw] exact
+    #   The exact method header to be matched on.
+    #   @return [String]
+    #
+    # @!attribute [rw] prefix
+    #   The specified beginning characters of the method header to be
+    #   matched on.
+    #   @return [String]
+    #
+    # @!attribute [rw] range
+    #   An object that represents the range of values to match on. The first
+    #   character of the range is included in the range, though the last
+    #   character is not. For example, if the range specified were 1-100,
+    #   only values 1-99 would be matched.
+    #   @return [Types::MatchRange]
+    #
+    # @!attribute [rw] regex
+    #   The regex used to match the method header.
+    #   @return [String]
+    #
+    # @!attribute [rw] suffix
+    #   The specified ending characters of the method header to match on.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/GrpcMetadataMatchMethod AWS API Documentation
+    #
+    class GrpcMetadataMatchMethod < Struct.new(
+      :exact,
+      :prefix,
+      :range,
+      :regex,
+      :suffix,
+      :unknown)
+      SENSITIVE = []
+      include Aws::Structure
+      include Aws::Structure::Union
+
+      class Exact < GrpcMetadataMatchMethod; end
+      class Prefix < GrpcMetadataMatchMethod; end
+      class Range < GrpcMetadataMatchMethod; end
+      class Regex < GrpcMetadataMatchMethod; end
+      class Suffix < GrpcMetadataMatchMethod; end
+      class Unknown < GrpcMetadataMatchMethod; end
+    end
+
     # An object that represents a retry policy. Specify at least one value
     # for at least one of the types of `RetryEvents`, a value for
-    # `maxRetries`, and a value for `perRetryTimeout`.
+    # `maxRetries`, and a value for `perRetryTimeout`. Both `server-error`
+    # and `gateway-error` under `httpRetryEvents` include the Envoy `reset`
+    # policy. For more information on the `reset` policy, see the [Envoy
+    # documentation][1].
+    #
+    #
+    #
+    # [1]: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on
     #
     # @note When making an API call, you may pass GrpcRetryPolicy
     #   data as a hash:
@@ -2867,19 +3536,9 @@ module Aws::AppMesh
     # An object that represents the match method. Specify one of the match
     # values.
     #
-    # @note When making an API call, you may pass GrpcRouteMetadataMatchMethod
-    #   data as a hash:
+    # @note GrpcRouteMetadataMatchMethod is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         exact: "HeaderMatch",
-    #         prefix: "HeaderMatch",
-    #         range: {
-    #           end: 1, # required
-    #           start: 1, # required
-    #         },
-    #         regex: "HeaderMatch",
-    #         suffix: "HeaderMatch",
-    #       }
+    # @note GrpcRouteMetadataMatchMethod is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of GrpcRouteMetadataMatchMethod corresponding to the set member.
     #
     # @!attribute [rw] exact
     #   The value sent by the client must match the specified value exactly.
@@ -2909,9 +3568,18 @@ module Aws::AppMesh
       :prefix,
       :range,
       :regex,
-      :suffix)
+      :suffix,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Exact < GrpcRouteMetadataMatchMethod; end
+      class Prefix < GrpcRouteMetadataMatchMethod; end
+      class Range < GrpcRouteMetadataMatchMethod; end
+      class Regex < GrpcRouteMetadataMatchMethod; end
+      class Suffix < GrpcRouteMetadataMatchMethod; end
+      class Unknown < GrpcRouteMetadataMatchMethod; end
     end
 
     # An object that represents types of timeouts.
@@ -2958,19 +3626,9 @@ module Aws::AppMesh
     # An object that represents the method and value to match with the
     # header value sent in a request. Specify one match method.
     #
-    # @note When making an API call, you may pass HeaderMatchMethod
-    #   data as a hash:
+    # @note HeaderMatchMethod is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         exact: "HeaderMatch",
-    #         prefix: "HeaderMatch",
-    #         range: {
-    #           end: 1, # required
-    #           start: 1, # required
-    #         },
-    #         regex: "HeaderMatch",
-    #         suffix: "HeaderMatch",
-    #       }
+    # @note HeaderMatchMethod is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of HeaderMatchMethod corresponding to the set member.
     #
     # @!attribute [rw] exact
     #   The value sent by the client must match the specified value exactly.
@@ -3000,9 +3658,18 @@ module Aws::AppMesh
       :prefix,
       :range,
       :regex,
-      :suffix)
+      :suffix,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Exact < HeaderMatchMethod; end
+      class Prefix < HeaderMatchMethod; end
+      class Range < HeaderMatchMethod; end
+      class Regex < HeaderMatchMethod; end
+      class Suffix < HeaderMatchMethod; end
+      class Unknown < HeaderMatchMethod; end
     end
 
     # An object that represents the health check policy for a virtual
@@ -3041,133 +3708,451 @@ module Aws::AppMesh
     #   match the port defined in the PortMapping for the listener.
     #   @return [Integer]
     #
-    # @!attribute [rw] protocol
-    #   The protocol for the health check request. If you specify `grpc`,
-    #   then your service must conform to the [GRPC Health Checking
-    #   Protocol][1].
+    # @!attribute [rw] protocol
+    #   The protocol for the health check request. If you specify `grpc`,
+    #   then your service must conform to the [GRPC Health Checking
+    #   Protocol][1].
+    #
+    #
+    #
+    #   [1]: https://github.com/grpc/grpc/blob/master/doc/health-checking.md
+    #   @return [String]
+    #
+    # @!attribute [rw] timeout_millis
+    #   The amount of time to wait when receiving a response from the health
+    #   check, in milliseconds.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] unhealthy_threshold
+    #   The number of consecutive failed health checks that must occur
+    #   before declaring a virtual node unhealthy.
+    #   @return [Integer]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HealthCheckPolicy AWS API Documentation
+    #
+    class HealthCheckPolicy < Struct.new(
+      :healthy_threshold,
+      :interval_millis,
+      :path,
+      :port,
+      :protocol,
+      :timeout_millis,
+      :unhealthy_threshold)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents an HTTP gateway route.
+    #
+    # @note When making an API call, you may pass HttpGatewayRoute
+    #   data as a hash:
+    #
+    #       {
+    #         action: { # required
+    #           rewrite: {
+    #             hostname: {
+    #               default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #             },
+    #             path: {
+    #               exact: "HttpPathExact",
+    #             },
+    #             prefix: {
+    #               default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #               value: "HttpGatewayRoutePrefix",
+    #             },
+    #           },
+    #           target: { # required
+    #             virtual_service: { # required
+    #               virtual_service_name: "ResourceName", # required
+    #             },
+    #           },
+    #         },
+    #         match: { # required
+    #           headers: [
+    #             {
+    #               invert: false,
+    #               match: {
+    #                 exact: "HeaderMatch",
+    #                 prefix: "HeaderMatch",
+    #                 range: {
+    #                   end: 1, # required
+    #                   start: 1, # required
+    #                 },
+    #                 regex: "HeaderMatch",
+    #                 suffix: "HeaderMatch",
+    #               },
+    #               name: "HeaderName", # required
+    #             },
+    #           ],
+    #           hostname: {
+    #             exact: "ExactHostName",
+    #             suffix: "SuffixHostname",
+    #           },
+    #           method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #           path: {
+    #             exact: "HttpPathExact",
+    #             regex: "HttpPathRegex",
+    #           },
+    #           prefix: "String",
+    #           query_parameters: [
+    #             {
+    #               match: {
+    #                 exact: "String",
+    #               },
+    #               name: "QueryParameterName", # required
+    #             },
+    #           ],
+    #         },
+    #       }
+    #
+    # @!attribute [rw] action
+    #   An object that represents the action to take if a match is
+    #   determined.
+    #   @return [Types::HttpGatewayRouteAction]
+    #
+    # @!attribute [rw] match
+    #   An object that represents the criteria for determining a request
+    #   match.
+    #   @return [Types::HttpGatewayRouteMatch]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRoute AWS API Documentation
+    #
+    class HttpGatewayRoute < Struct.new(
+      :action,
+      :match)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the action to take if a match is determined.
+    #
+    # @note When making an API call, you may pass HttpGatewayRouteAction
+    #   data as a hash:
+    #
+    #       {
+    #         rewrite: {
+    #           hostname: {
+    #             default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #           },
+    #           path: {
+    #             exact: "HttpPathExact",
+    #           },
+    #           prefix: {
+    #             default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #             value: "HttpGatewayRoutePrefix",
+    #           },
+    #         },
+    #         target: { # required
+    #           virtual_service: { # required
+    #             virtual_service_name: "ResourceName", # required
+    #           },
+    #         },
+    #       }
+    #
+    # @!attribute [rw] rewrite
+    #   The gateway route action to rewrite.
+    #   @return [Types::HttpGatewayRouteRewrite]
+    #
+    # @!attribute [rw] target
+    #   An object that represents the target that traffic is routed to when
+    #   a request matches the gateway route.
+    #   @return [Types::GatewayRouteTarget]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRouteAction AWS API Documentation
+    #
+    class HttpGatewayRouteAction < Struct.new(
+      :rewrite,
+      :target)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the HTTP header in the gateway route.
+    #
+    # @note When making an API call, you may pass HttpGatewayRouteHeader
+    #   data as a hash:
+    #
+    #       {
+    #         invert: false,
+    #         match: {
+    #           exact: "HeaderMatch",
+    #           prefix: "HeaderMatch",
+    #           range: {
+    #             end: 1, # required
+    #             start: 1, # required
+    #           },
+    #           regex: "HeaderMatch",
+    #           suffix: "HeaderMatch",
+    #         },
+    #         name: "HeaderName", # required
+    #       }
+    #
+    # @!attribute [rw] invert
+    #   Specify `True` to match anything except the match criteria. The
+    #   default value is `False`.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] match
+    #   An object that represents the method and value to match with the
+    #   header value sent in a request. Specify one match method.
+    #   @return [Types::HeaderMatchMethod]
+    #
+    # @!attribute [rw] name
+    #   A name for the HTTP header in the gateway route that will be matched
+    #   on.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRouteHeader AWS API Documentation
+    #
+    class HttpGatewayRouteHeader < Struct.new(
+      :invert,
+      :match,
+      :name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the criteria for determining a request
+    # match.
+    #
+    # @note When making an API call, you may pass HttpGatewayRouteMatch
+    #   data as a hash:
+    #
+    #       {
+    #         headers: [
+    #           {
+    #             invert: false,
+    #             match: {
+    #               exact: "HeaderMatch",
+    #               prefix: "HeaderMatch",
+    #               range: {
+    #                 end: 1, # required
+    #                 start: 1, # required
+    #               },
+    #               regex: "HeaderMatch",
+    #               suffix: "HeaderMatch",
+    #             },
+    #             name: "HeaderName", # required
+    #           },
+    #         ],
+    #         hostname: {
+    #           exact: "ExactHostName",
+    #           suffix: "SuffixHostname",
+    #         },
+    #         method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #         path: {
+    #           exact: "HttpPathExact",
+    #           regex: "HttpPathRegex",
+    #         },
+    #         prefix: "String",
+    #         query_parameters: [
+    #           {
+    #             match: {
+    #               exact: "String",
+    #             },
+    #             name: "QueryParameterName", # required
+    #           },
+    #         ],
+    #       }
+    #
+    # @!attribute [rw] headers
+    #   The client request headers to match on.
+    #   @return [Array<Types::HttpGatewayRouteHeader>]
+    #
+    # @!attribute [rw] hostname
+    #   The host name to match on.
+    #   @return [Types::GatewayRouteHostnameMatch]
+    #
+    # @!attribute [rw] method
+    #   The method to match on.
+    #   @return [String]
+    #
+    # @!attribute [rw] path
+    #   The path to match on.
+    #   @return [Types::HttpPathMatch]
+    #
+    # @!attribute [rw] prefix
+    #   Specifies the path to match requests with. This parameter must
+    #   always start with `/`, which by itself matches all requests to the
+    #   virtual service name. You can also match for path-based routing of
+    #   requests. For example, if your virtual service name is
+    #   `my-service.local` and you want the route to match requests to
+    #   `my-service.local/metrics`, your prefix should be `/metrics`.
+    #   @return [String]
+    #
+    # @!attribute [rw] query_parameters
+    #   The query parameter to match on.
+    #   @return [Array<Types::HttpQueryParameter>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRouteMatch AWS API Documentation
+    #
+    class HttpGatewayRouteMatch < Struct.new(
+      :headers,
+      :hostname,
+      :method,
+      :path,
+      :prefix,
+      :query_parameters)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the path to rewrite.
+    #
+    # @note When making an API call, you may pass HttpGatewayRoutePathRewrite
+    #   data as a hash:
+    #
+    #       {
+    #         exact: "HttpPathExact",
+    #       }
+    #
+    # @!attribute [rw] exact
+    #   The exact path to rewrite.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRoutePathRewrite AWS API Documentation
     #
+    class HttpGatewayRoutePathRewrite < Struct.new(
+      :exact)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object representing the beginning characters of the route to
+    # rewrite.
     #
+    # @note When making an API call, you may pass HttpGatewayRoutePrefixRewrite
+    #   data as a hash:
     #
-    #   [1]: https://github.com/grpc/grpc/blob/master/doc/health-checking.md
-    #   @return [String]
+    #       {
+    #         default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #         value: "HttpGatewayRoutePrefix",
+    #       }
     #
-    # @!attribute [rw] timeout_millis
-    #   The amount of time to wait when receiving a response from the health
-    #   check, in milliseconds.
-    #   @return [Integer]
+    # @!attribute [rw] default_prefix
+    #   The default prefix used to replace the incoming route prefix when
+    #   rewritten.
+    #   @return [String]
     #
-    # @!attribute [rw] unhealthy_threshold
-    #   The number of consecutive failed health checks that must occur
-    #   before declaring a virtual node unhealthy.
-    #   @return [Integer]
+    # @!attribute [rw] value
+    #   The value used to replace the incoming route prefix when rewritten.
+    #   @return [String]
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HealthCheckPolicy AWS API Documentation
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRoutePrefixRewrite AWS API Documentation
     #
-    class HealthCheckPolicy < Struct.new(
-      :healthy_threshold,
-      :interval_millis,
-      :path,
-      :port,
-      :protocol,
-      :timeout_millis,
-      :unhealthy_threshold)
+    class HttpGatewayRoutePrefixRewrite < Struct.new(
+      :default_prefix,
+      :value)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents an HTTP gateway route.
+    # An object representing the gateway route to rewrite.
     #
-    # @note When making an API call, you may pass HttpGatewayRoute
+    # @note When making an API call, you may pass HttpGatewayRouteRewrite
     #   data as a hash:
     #
     #       {
-    #         action: { # required
-    #           target: { # required
-    #             virtual_service: { # required
-    #               virtual_service_name: "ResourceName", # required
-    #             },
-    #           },
+    #         hostname: {
+    #           default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
     #         },
-    #         match: { # required
-    #           prefix: "String", # required
+    #         path: {
+    #           exact: "HttpPathExact",
+    #         },
+    #         prefix: {
+    #           default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #           value: "HttpGatewayRoutePrefix",
     #         },
     #       }
     #
-    # @!attribute [rw] action
-    #   An object that represents the action to take if a match is
-    #   determined.
-    #   @return [Types::HttpGatewayRouteAction]
+    # @!attribute [rw] hostname
+    #   The host name to rewrite.
+    #   @return [Types::GatewayRouteHostnameRewrite]
     #
-    # @!attribute [rw] match
-    #   An object that represents the criteria for determining a request
-    #   match.
-    #   @return [Types::HttpGatewayRouteMatch]
+    # @!attribute [rw] path
+    #   The path to rewrite.
+    #   @return [Types::HttpGatewayRoutePathRewrite]
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRoute AWS API Documentation
+    # @!attribute [rw] prefix
+    #   The specified beginning characters to rewrite.
+    #   @return [Types::HttpGatewayRoutePrefixRewrite]
     #
-    class HttpGatewayRoute < Struct.new(
-      :action,
-      :match)
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRouteRewrite AWS API Documentation
+    #
+    class HttpGatewayRouteRewrite < Struct.new(
+      :hostname,
+      :path,
+      :prefix)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents the action to take if a match is determined.
+    # An object representing the path to match in the request.
     #
-    # @note When making an API call, you may pass HttpGatewayRouteAction
+    # @note When making an API call, you may pass HttpPathMatch
     #   data as a hash:
     #
     #       {
-    #         target: { # required
-    #           virtual_service: { # required
-    #             virtual_service_name: "ResourceName", # required
-    #           },
-    #         },
+    #         exact: "HttpPathExact",
+    #         regex: "HttpPathRegex",
     #       }
     #
-    # @!attribute [rw] target
-    #   An object that represents the target that traffic is routed to when
-    #   a request matches the gateway route.
-    #   @return [Types::GatewayRouteTarget]
+    # @!attribute [rw] exact
+    #   The exact path to match on.
+    #   @return [String]
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRouteAction AWS API Documentation
+    # @!attribute [rw] regex
+    #   The regex used to match the path.
+    #   @return [String]
     #
-    class HttpGatewayRouteAction < Struct.new(
-      :target)
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpPathMatch AWS API Documentation
+    #
+    class HttpPathMatch < Struct.new(
+      :exact,
+      :regex)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents the criteria for determining a request
-    # match.
+    # An object that represents the query parameter in the request.
     #
-    # @note When making an API call, you may pass HttpGatewayRouteMatch
+    # @note When making an API call, you may pass HttpQueryParameter
     #   data as a hash:
     #
     #       {
-    #         prefix: "String", # required
+    #         match: {
+    #           exact: "String",
+    #         },
+    #         name: "QueryParameterName", # required
     #       }
     #
-    # @!attribute [rw] prefix
-    #   Specifies the path to match requests with. This parameter must
-    #   always start with `/`, which by itself matches all requests to the
-    #   virtual service name. You can also match for path-based routing of
-    #   requests. For example, if your virtual service name is
-    #   `my-service.local` and you want the route to match requests to
-    #   `my-service.local/metrics`, your prefix should be `/metrics`.
+    # @!attribute [rw] match
+    #   The query parameter to match on.
+    #   @return [Types::QueryParameterMatch]
+    #
+    # @!attribute [rw] name
+    #   A name for the query parameter that will be matched on.
     #   @return [String]
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpGatewayRouteMatch AWS API Documentation
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpQueryParameter AWS API Documentation
     #
-    class HttpGatewayRouteMatch < Struct.new(
-      :prefix)
+    class HttpQueryParameter < Struct.new(
+      :match,
+      :name)
       SENSITIVE = []
       include Aws::Structure
     end
 
     # An object that represents a retry policy. Specify at least one value
     # for at least one of the types of `RetryEvents`, a value for
-    # `maxRetries`, and a value for `perRetryTimeout`.
+    # `maxRetries`, and a value for `perRetryTimeout`. Both `server-error`
+    # and `gateway-error` under `httpRetryEvents` include the Envoy `reset`
+    # policy. For more information on the `reset` policy, see the [Envoy
+    # documentation][1].
+    #
+    #
+    #
+    # [1]: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on
     #
     # @note When making an API call, you may pass HttpRetryPolicy
     #   data as a hash:
@@ -3252,7 +4237,19 @@ module Aws::AppMesh
     #             },
     #           ],
     #           method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #           prefix: "String", # required
+    #           path: {
+    #             exact: "HttpPathExact",
+    #             regex: "HttpPathRegex",
+    #           },
+    #           prefix: "String",
+    #           query_parameters: [
+    #             {
+    #               match: {
+    #                 exact: "String",
+    #               },
+    #               name: "QueryParameterName", # required
+    #             },
+    #           ],
     #           scheme: "http", # accepts http, https
     #         },
     #         retry_policy: {
@@ -3400,18 +4397,34 @@ module Aws::AppMesh
     #           },
     #         ],
     #         method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #         prefix: "String", # required
+    #         path: {
+    #           exact: "HttpPathExact",
+    #           regex: "HttpPathRegex",
+    #         },
+    #         prefix: "String",
+    #         query_parameters: [
+    #           {
+    #             match: {
+    #               exact: "String",
+    #             },
+    #             name: "QueryParameterName", # required
+    #           },
+    #         ],
     #         scheme: "http", # accepts http, https
     #       }
     #
     # @!attribute [rw] headers
-    #   An object that represents the client request headers to match on.
+    #   The client request headers to match on.
     #   @return [Array<Types::HttpRouteHeader>]
     #
     # @!attribute [rw] method
     #   The client request method to match on. Specify only one.
     #   @return [String]
     #
+    # @!attribute [rw] path
+    #   The client request path to match on.
+    #   @return [Types::HttpPathMatch]
+    #
     # @!attribute [rw] prefix
     #   Specifies the path to match requests with. This parameter must
     #   always start with `/`, which by itself matches all requests to the
@@ -3421,8 +4434,13 @@ module Aws::AppMesh
     #   `my-service.local/metrics`, your prefix should be `/metrics`.
     #   @return [String]
     #
+    # @!attribute [rw] query_parameters
+    #   The client request query parameters to match on.
+    #   @return [Array<Types::HttpQueryParameter>]
+    #
     # @!attribute [rw] scheme
-    #   The client request scheme to match on. Specify only one.
+    #   The client request scheme to match on. Specify only one. Applicable
+    #   only for HTTP2 routes.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/HttpRouteMatch AWS API Documentation
@@ -3430,7 +4448,9 @@ module Aws::AppMesh
     class HttpRouteMatch < Struct.new(
       :headers,
       :method,
+      :path,
       :prefix,
+      :query_parameters,
       :scheme)
       SENSITIVE = []
       include Aws::Structure
@@ -4240,8 +5260,26 @@ module Aws::AppMesh
     #               certificate_chain: "FilePath", # required
     #               private_key: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
     #           },
     #           mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #           validation: {
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
+    #             trust: { # required
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
+    #             },
+    #           },
     #         },
     #       }
     #
@@ -4285,47 +5323,9 @@ module Aws::AppMesh
 
     # An object that represents timeouts for different protocols.
     #
-    # @note When making an API call, you may pass ListenerTimeout
-    #   data as a hash:
+    # @note ListenerTimeout is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         grpc: {
-    #           idle: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #           per_request: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #         },
-    #         http: {
-    #           idle: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #           per_request: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #         },
-    #         http2: {
-    #           idle: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #           per_request: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #         },
-    #         tcp: {
-    #           idle: {
-    #             unit: "s", # accepts s, ms
-    #             value: 1,
-    #           },
-    #         },
-    #       }
+    # @note ListenerTimeout is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of ListenerTimeout corresponding to the set member.
     #
     # @!attribute [rw] grpc
     #   An object that represents types of timeouts.
@@ -4349,9 +5349,17 @@ module Aws::AppMesh
       :grpc,
       :http,
       :http2,
-      :tcp)
+      :tcp,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Grpc < ListenerTimeout; end
+      class Http < ListenerTimeout; end
+      class Http2 < ListenerTimeout; end
+      class Tcp < ListenerTimeout; end
+      class Unknown < ListenerTimeout; end
     end
 
     # An object that represents the Transport Layer Security (TLS)
@@ -4369,13 +5377,31 @@ module Aws::AppMesh
     #             certificate_chain: "FilePath", # required
     #             private_key: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
     #         },
     #         mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #         validation: {
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
+    #           trust: { # required
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "SdsSecretName", # required
+    #             },
+    #           },
+    #         },
     #       }
     #
     # @!attribute [rw] certificate
-    #   A reference to an object that represents a listener's TLS
-    #   certificate.
+    #   A reference to an object that represents a listener's Transport
+    #   Layer Security (TLS) certificate.
     #   @return [Types::ListenerTlsCertificate]
     #
     # @!attribute [rw] mode
@@ -4389,11 +5415,17 @@ module Aws::AppMesh
     #   * ****DISABLED – Listener only accepts connections without TLS.
     #   @return [String]
     #
+    # @!attribute [rw] validation
+    #   A reference to an object that represents a listener's Transport
+    #   Layer Security (TLS) validation context.
+    #   @return [Types::ListenerTlsValidationContext]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTls AWS API Documentation
     #
     class ListenerTls < Struct.new(
       :certificate,
-      :mode)
+      :mode,
+      :validation)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4429,18 +5461,9 @@ module Aws::AppMesh
     # An object that represents a listener's Transport Layer Security (TLS)
     # certificate.
     #
-    # @note When making an API call, you may pass ListenerTlsCertificate
-    #   data as a hash:
+    # @note ListenerTlsCertificate is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         acm: {
-    #           certificate_arn: "Arn", # required
-    #         },
-    #         file: {
-    #           certificate_chain: "FilePath", # required
-    #           private_key: "FilePath", # required
-    #         },
-    #       }
+    # @note ListenerTlsCertificate is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of ListenerTlsCertificate corresponding to the set member.
     #
     # @!attribute [rw] acm
     #   A reference to an object that represents an AWS Certicate Manager
@@ -4451,13 +5474,26 @@ module Aws::AppMesh
     #   A reference to an object that represents a local file certificate.
     #   @return [Types::ListenerTlsFileCertificate]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a listener's Secret
+    #   Discovery Service certificate.
+    #   @return [Types::ListenerTlsSdsCertificate]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsCertificate AWS API Documentation
     #
     class ListenerTlsCertificate < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Acm < ListenerTlsCertificate; end
+      class File < ListenerTlsCertificate; end
+      class Sds < ListenerTlsCertificate; end
+      class Unknown < ListenerTlsCertificate; end
     end
 
     # An object that represents a local file certificate. The certificate
@@ -4469,30 +5505,135 @@ module Aws::AppMesh
     #
     # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html#virtual-node-tls-prerequisites
     #
-    # @note When making an API call, you may pass ListenerTlsFileCertificate
-    #   data as a hash:
+    # @note When making an API call, you may pass ListenerTlsFileCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         certificate_chain: "FilePath", # required
+    #         private_key: "FilePath", # required
+    #       }
+    #
+    # @!attribute [rw] certificate_chain
+    #   The certificate chain for the certificate.
+    #   @return [String]
+    #
+    # @!attribute [rw] private_key
+    #   The private key for a certificate stored on the file system of the
+    #   virtual node that the proxy is running on.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsFileCertificate AWS API Documentation
+    #
+    class ListenerTlsFileCertificate < Struct.new(
+      :certificate_chain,
+      :private_key)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the listener's Secret Discovery Service
+    # certificate. The proxy must be configured with a local SDS provider
+    # via a Unix Domain Socket. See App Mesh [TLS documentation][1] for more
+    # info.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass ListenerTlsSdsCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         secret_name: "SdsSecretName", # required
+    #       }
+    #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret
+    #   requested from the Secret Discovery Service provider representing
+    #   Transport Layer Security (TLS) materials like a certificate or
+    #   certificate chain.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsSdsCertificate AWS API Documentation
+    #
+    class ListenerTlsSdsCertificate < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a listener's Transport Layer Security (TLS)
+    # validation context.
+    #
+    # @note When making an API call, you may pass ListenerTlsValidationContext
+    #   data as a hash:
+    #
+    #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
+    #         trust: { # required
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
+    #         },
+    #       }
+    #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a listener's
+    #   Transport Layer Security (TLS) validation context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
+    # @!attribute [rw] trust
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
+    #   @return [Types::ListenerTlsValidationContextTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsValidationContext AWS API Documentation
+    #
+    class ListenerTlsValidationContext < Struct.new(
+      :subject_alternative_names,
+      :trust)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a listener's Transport Layer Security (TLS)
+    # validation context trust.
+    #
+    # @note ListenerTlsValidationContextTrust is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         certificate_chain: "FilePath", # required
-    #         private_key: "FilePath", # required
-    #       }
+    # @note ListenerTlsValidationContextTrust is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of ListenerTlsValidationContextTrust corresponding to the set member.
     #
-    # @!attribute [rw] certificate_chain
-    #   The certificate chain for the certificate.
-    #   @return [String]
+    # @!attribute [rw] file
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
+    #   @return [Types::TlsValidationContextFileTrust]
     #
-    # @!attribute [rw] private_key
-    #   The private key for a certificate stored on the file system of the
-    #   virtual node that the proxy is running on.
-    #   @return [String]
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a listener's Transport
+    #   Layer Security (TLS) Secret Discovery Service validation context
+    #   trust.
+    #   @return [Types::TlsValidationContextSdsTrust]
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsFileCertificate AWS API Documentation
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/ListenerTlsValidationContextTrust AWS API Documentation
     #
-    class ListenerTlsFileCertificate < Struct.new(
-      :certificate_chain,
-      :private_key)
+    class ListenerTlsValidationContextTrust < Struct.new(
+      :file,
+      :sds,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class File < ListenerTlsValidationContextTrust; end
+      class Sds < ListenerTlsValidationContextTrust; end
+      class Unknown < ListenerTlsValidationContextTrust; end
     end
 
     # An object that represents the logging information for a virtual node.
@@ -4767,6 +5908,27 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object representing the query parameter to match.
+    #
+    # @note When making an API call, you may pass QueryParameterMatch
+    #   data as a hash:
+    #
+    #       {
+    #         exact: "String",
+    #       }
+    #
+    # @!attribute [rw] exact
+    #   The exact query parameter to match on.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/QueryParameterMatch AWS API Documentation
+    #
+    class QueryParameterMatch < Struct.new(
+      :exact)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # You can't delete the specified resource because it's in use or
     # required by another resource.
     #
@@ -5036,7 +6198,19 @@ module Aws::AppMesh
     #               },
     #             ],
     #             method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #             prefix: "String", # required
+    #             path: {
+    #               exact: "HttpPathExact",
+    #               regex: "HttpPathRegex",
+    #             },
+    #             prefix: "String",
+    #             query_parameters: [
+    #               {
+    #                 match: {
+    #                   exact: "String",
+    #                 },
+    #                 name: "QueryParameterName", # required
+    #               },
+    #             ],
     #             scheme: "http", # accepts http, https
     #           },
     #           retry_policy: {
@@ -5086,7 +6260,19 @@ module Aws::AppMesh
     #               },
     #             ],
     #             method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #             prefix: "String", # required
+    #             path: {
+    #               exact: "HttpPathExact",
+    #               regex: "HttpPathRegex",
+    #             },
+    #             prefix: "String",
+    #             query_parameters: [
+    #               {
+    #                 match: {
+    #                   exact: "String",
+    #                 },
+    #                 name: "QueryParameterName", # required
+    #               },
+    #             ],
     #             scheme: "http", # accepts http, https
     #           },
     #           retry_policy: {
@@ -5178,27 +6364,12 @@ module Aws::AppMesh
     # An object that represents the service discovery information for a
     # virtual node.
     #
-    # @note When making an API call, you may pass ServiceDiscovery
-    #   data as a hash:
+    # @note ServiceDiscovery is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         aws_cloud_map: {
-    #           attributes: [
-    #             {
-    #               key: "AwsCloudMapInstanceAttributeKey", # required
-    #               value: "AwsCloudMapInstanceAttributeValue", # required
-    #             },
-    #           ],
-    #           namespace_name: "AwsCloudMapName", # required
-    #           service_name: "AwsCloudMapName", # required
-    #         },
-    #         dns: {
-    #           hostname: "Hostname", # required
-    #         },
-    #       }
+    # @note ServiceDiscovery is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of ServiceDiscovery corresponding to the set member.
     #
     # @!attribute [rw] aws_cloud_map
-    #   Specifies any AWS Cloud Map information for the virtual node.
+    #   Specifies any Cloud Map information for the virtual node.
     #   @return [Types::AwsCloudMapServiceDiscovery]
     #
     # @!attribute [rw] dns
@@ -5209,9 +6380,15 @@ module Aws::AppMesh
     #
     class ServiceDiscovery < Struct.new(
       :aws_cloud_map,
-      :dns)
+      :dns,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class AwsCloudMap < ServiceDiscovery; end
+      class Dns < ServiceDiscovery; end
+      class Unknown < ServiceDiscovery; end
     end
 
     # The request has failed due to a temporary failure of the service.
@@ -5227,6 +6404,53 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the methods by which a subject alternative
+    # name on a peer Transport Layer Security (TLS) certificate can be
+    # matched.
+    #
+    # @note When making an API call, you may pass SubjectAlternativeNameMatchers
+    #   data as a hash:
+    #
+    #       {
+    #         exact: ["SubjectAlternativeName"], # required
+    #       }
+    #
+    # @!attribute [rw] exact
+    #   The values sent must match the specified values exactly.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/SubjectAlternativeNameMatchers AWS API Documentation
+    #
+    class SubjectAlternativeNameMatchers < Struct.new(
+      :exact)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents the subject alternative names secured by the
+    # certificate.
+    #
+    # @note When making an API call, you may pass SubjectAlternativeNames
+    #   data as a hash:
+    #
+    #       {
+    #         match: { # required
+    #           exact: ["SubjectAlternativeName"], # required
+    #         },
+    #       }
+    #
+    # @!attribute [rw] match
+    #   An object that represents the criteria for determining a SANs match.
+    #   @return [Types::SubjectAlternativeNameMatchers]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/SubjectAlternativeNames AWS API Documentation
+    #
+    class SubjectAlternativeNames < Struct.new(
+      :match)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Optional metadata that you apply to a resource to assist with
     # categorization and organization. Each tag consists of a key and an
     # optional value, both of which you define. Tag keys can have a maximum
@@ -5398,13 +6622,18 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # An object that represents a Transport Layer Security (TLS) validation
-    # context.
+    # An object that represents how the proxy will validate its peer during
+    # Transport Layer Security (TLS) negotiation.
     #
     # @note When making an API call, you may pass TlsValidationContext
     #   data as a hash:
     #
     #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
     #         trust: { # required
     #           acm: {
     #             certificate_authority_arns: ["Arn"], # required
@@ -5412,24 +6641,33 @@ module Aws::AppMesh
     #           file: {
     #             certificate_chain: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "SdsSecretName", # required
+    #           },
     #         },
     #       }
     #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a Transport
+    #   Layer Security (TLS) validation context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
     # @!attribute [rw] trust
-    #   A reference to an object that represents a TLS validation context
-    #   trust.
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
     #   @return [Types::TlsValidationContextTrust]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/TlsValidationContext AWS API Documentation
     #
     class TlsValidationContext < Struct.new(
+      :subject_alternative_names,
       :trust)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents a TLS validation context trust for an AWS
-    # Certicate Manager (ACM) certificate.
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust for an Certificate Manager certificate.
     #
     # @note When making an API call, you may pass TlsValidationContextAcmTrust
     #   data as a hash:
@@ -5473,38 +6711,74 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # An object that represents a Transport Layer Security (TLS) validation
-    # context trust.
+    # An object that represents a Transport Layer Security (TLS) Secret
+    # Discovery Service validation context trust. The proxy must be
+    # configured with a local SDS provider via a Unix Domain Socket. See App
+    # Mesh [TLS documentation][1] for more info.
+    #
+    #
     #
-    # @note When making an API call, you may pass TlsValidationContextTrust
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass TlsValidationContextSdsTrust
     #   data as a hash:
     #
     #       {
-    #         acm: {
-    #           certificate_authority_arns: ["Arn"], # required
-    #         },
-    #         file: {
-    #           certificate_chain: "FilePath", # required
-    #         },
+    #         secret_name: "SdsSecretName", # required
     #       }
     #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret for
+    #   a Transport Layer Security (TLS) Secret Discovery Service validation
+    #   context trust.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/TlsValidationContextSdsTrust AWS API Documentation
+    #
+    class TlsValidationContextSdsTrust < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust.
+    #
+    # @note TlsValidationContextTrust is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note TlsValidationContextTrust is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of TlsValidationContextTrust corresponding to the set member.
+    #
     # @!attribute [rw] acm
-    #   A reference to an object that represents a TLS validation context
-    #   trust for an AWS Certicate Manager (ACM) certificate.
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) validation context trust for an Certificate Manager
+    #   certificate.
     #   @return [Types::TlsValidationContextAcmTrust]
     #
     # @!attribute [rw] file
-    #   An object that represents a TLS validation context trust for a local
-    #   file.
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
     #   @return [Types::TlsValidationContextFileTrust]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) Secret Discovery Service validation context trust.
+    #   @return [Types::TlsValidationContextSdsTrust]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/TlsValidationContextTrust AWS API Documentation
     #
     class TlsValidationContextTrust < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Acm < TlsValidationContextTrust; end
+      class File < TlsValidationContextTrust; end
+      class Sds < TlsValidationContextTrust; end
+      class Unknown < TlsValidationContextTrust; end
     end
 
     # The maximum request rate permitted by the App Mesh APIs has been
@@ -5586,6 +6860,11 @@ module Aws::AppMesh
     #         spec: { # required
     #           grpc_route: {
     #             action: { # required
+    #               rewrite: {
+    #                 hostname: {
+    #                   default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #                 },
+    #               },
     #               target: { # required
     #                 virtual_service: { # required
     #                   virtual_service_name: "ResourceName", # required
@@ -5593,11 +6872,43 @@ module Aws::AppMesh
     #               },
     #             },
     #             match: { # required
+    #               hostname: {
+    #                 exact: "ExactHostName",
+    #                 suffix: "SuffixHostname",
+    #               },
+    #               metadata: [
+    #                 {
+    #                   invert: false,
+    #                   match: {
+    #                     exact: "HeaderMatch",
+    #                     prefix: "HeaderMatch",
+    #                     range: {
+    #                       end: 1, # required
+    #                       start: 1, # required
+    #                     },
+    #                     regex: "HeaderMatch",
+    #                     suffix: "HeaderMatch",
+    #                   },
+    #                   name: "HeaderName", # required
+    #                 },
+    #               ],
     #               service_name: "ServiceName",
     #             },
     #           },
     #           http2_route: {
     #             action: { # required
+    #               rewrite: {
+    #                 hostname: {
+    #                   default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #                 },
+    #                 path: {
+    #                   exact: "HttpPathExact",
+    #                 },
+    #                 prefix: {
+    #                   default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #                   value: "HttpGatewayRoutePrefix",
+    #                 },
+    #               },
     #               target: { # required
     #                 virtual_service: { # required
     #                   virtual_service_name: "ResourceName", # required
@@ -5605,11 +6916,56 @@ module Aws::AppMesh
     #               },
     #             },
     #             match: { # required
-    #               prefix: "String", # required
+    #               headers: [
+    #                 {
+    #                   invert: false,
+    #                   match: {
+    #                     exact: "HeaderMatch",
+    #                     prefix: "HeaderMatch",
+    #                     range: {
+    #                       end: 1, # required
+    #                       start: 1, # required
+    #                     },
+    #                     regex: "HeaderMatch",
+    #                     suffix: "HeaderMatch",
+    #                   },
+    #                   name: "HeaderName", # required
+    #                 },
+    #               ],
+    #               hostname: {
+    #                 exact: "ExactHostName",
+    #                 suffix: "SuffixHostname",
+    #               },
+    #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #             },
     #           },
     #           http_route: {
     #             action: { # required
+    #               rewrite: {
+    #                 hostname: {
+    #                   default_target_hostname: "ENABLED", # accepts ENABLED, DISABLED
+    #                 },
+    #                 path: {
+    #                   exact: "HttpPathExact",
+    #                 },
+    #                 prefix: {
+    #                   default_prefix: "ENABLED", # accepts ENABLED, DISABLED
+    #                   value: "HttpGatewayRoutePrefix",
+    #                 },
+    #               },
     #               target: { # required
     #                 virtual_service: { # required
     #                   virtual_service_name: "ResourceName", # required
@@ -5617,9 +6973,43 @@ module Aws::AppMesh
     #               },
     #             },
     #             match: { # required
-    #               prefix: "String", # required
+    #               headers: [
+    #                 {
+    #                   invert: false,
+    #                   match: {
+    #                     exact: "HeaderMatch",
+    #                     prefix: "HeaderMatch",
+    #                     range: {
+    #                       end: 1, # required
+    #                       start: 1, # required
+    #                     },
+    #                     regex: "HeaderMatch",
+    #                     suffix: "HeaderMatch",
+    #                   },
+    #                   name: "HeaderName", # required
+    #                 },
+    #               ],
+    #               hostname: {
+    #                 exact: "ExactHostName",
+    #                 suffix: "SuffixHostname",
+    #               },
+    #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #             },
     #           },
+    #           priority: 1,
     #         },
     #         virtual_gateway_name: "ResourceName", # required
     #       }
@@ -5838,7 +7228,19 @@ module Aws::AppMesh
     #                 },
     #               ],
     #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #               prefix: "String", # required
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #               scheme: "http", # accepts http, https
     #             },
     #             retry_policy: {
@@ -5888,7 +7290,19 @@ module Aws::AppMesh
     #                 },
     #               ],
     #               method: "GET", # accepts GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
-    #               prefix: "String", # required
+    #               path: {
+    #                 exact: "HttpPathExact",
+    #                 regex: "HttpPathRegex",
+    #               },
+    #               prefix: "String",
+    #               query_parameters: [
+    #                 {
+    #                   match: {
+    #                     exact: "String",
+    #                   },
+    #                   name: "QueryParameterName", # required
+    #                 },
+    #               ],
     #               scheme: "http", # accepts http, https
     #             },
     #             retry_policy: {
@@ -6009,9 +7423,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -6019,6 +7447,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -6060,8 +7491,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
     #                 },
     #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "VirtualGatewaySdsSecretName", # required
+    #                     },
+    #                   },
+    #                 },
     #               },
     #             },
     #           ],
@@ -6148,9 +7597,23 @@ module Aws::AppMesh
     #           backend_defaults: {
     #             client_policy: {
     #               tls: {
+    #                 certificate: {
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                     private_key: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
     #                 enforce: false,
     #                 ports: [1],
     #                 validation: { # required
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
     #                   trust: { # required
     #                     acm: {
     #                       certificate_authority_arns: ["Arn"], # required
@@ -6158,6 +7621,9 @@ module Aws::AppMesh
     #                     file: {
     #                       certificate_chain: "FilePath", # required
     #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
     #                   },
     #                 },
     #               },
@@ -6168,9 +7634,23 @@ module Aws::AppMesh
     #               virtual_service: {
     #                 client_policy: {
     #                   tls: {
+    #                     certificate: {
+    #                       file: {
+    #                         certificate_chain: "FilePath", # required
+    #                         private_key: "FilePath", # required
+    #                       },
+    #                       sds: {
+    #                         secret_name: "SdsSecretName", # required
+    #                       },
+    #                     },
     #                     enforce: false,
     #                     ports: [1],
     #                     validation: { # required
+    #                       subject_alternative_names: {
+    #                         match: { # required
+    #                           exact: ["SubjectAlternativeName"], # required
+    #                         },
+    #                       },
     #                       trust: { # required
     #                         acm: {
     #                           certificate_authority_arns: ["Arn"], # required
@@ -6178,6 +7658,9 @@ module Aws::AppMesh
     #                         file: {
     #                           certificate_chain: "FilePath", # required
     #                         },
+    #                         sds: {
+    #                           secret_name: "SdsSecretName", # required
+    #                         },
     #                       },
     #                     },
     #                   },
@@ -6275,8 +7758,26 @@ module Aws::AppMesh
     #                     certificate_chain: "FilePath", # required
     #                     private_key: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
+    #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #                 validation: {
+    #                   subject_alternative_names: {
+    #                     match: { # required
+    #                       exact: ["SubjectAlternativeName"], # required
+    #                     },
+    #                   },
+    #                   trust: { # required
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
+    #                   },
     #                 },
-    #                 mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
     #               },
     #             },
     #           ],
@@ -6300,6 +7801,7 @@ module Aws::AppMesh
     #             },
     #             dns: {
     #               hostname: "Hostname", # required
+    #               response_type: "LOADBALANCER", # accepts LOADBALANCER, ENDPOINTS
     #             },
     #           },
     #         },
@@ -6539,14 +8041,9 @@ module Aws::AppMesh
 
     # The access log configuration for a virtual gateway.
     #
-    # @note When making an API call, you may pass VirtualGatewayAccessLog
-    #   data as a hash:
+    # @note VirtualGatewayAccessLog is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         file: {
-    #           path: "FilePath", # required
-    #         },
-    #       }
+    # @note VirtualGatewayAccessLog is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualGatewayAccessLog corresponding to the set member.
     #
     # @!attribute [rw] file
     #   The file object to send virtual gateway access logs to.
@@ -6555,9 +8052,14 @@ module Aws::AppMesh
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayAccessLog AWS API Documentation
     #
     class VirtualGatewayAccessLog < Struct.new(
-      :file)
+      :file,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class File < VirtualGatewayAccessLog; end
+      class Unknown < VirtualGatewayAccessLog; end
     end
 
     # An object that represents the default properties for a backend.
@@ -6568,9 +8070,23 @@ module Aws::AppMesh
     #       {
     #         client_policy: {
     #           tls: {
+    #             certificate: {
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #                 private_key: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "VirtualGatewaySdsSecretName", # required
+    #               },
+    #             },
     #             enforce: false,
     #             ports: [1],
     #             validation: { # required
+    #               subject_alternative_names: {
+    #                 match: { # required
+    #                   exact: ["SubjectAlternativeName"], # required
+    #                 },
+    #               },
     #               trust: { # required
     #                 acm: {
     #                   certificate_authority_arns: ["Arn"], # required
@@ -6578,6 +8094,9 @@ module Aws::AppMesh
     #                 file: {
     #                   certificate_chain: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "VirtualGatewaySdsSecretName", # required
+    #                 },
     #               },
     #             },
     #           },
@@ -6603,9 +8122,23 @@ module Aws::AppMesh
     #
     #       {
     #         tls: {
+    #           certificate: {
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #               private_key: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
+    #           },
     #           enforce: false,
     #           ports: [1],
     #           validation: { # required
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
     #             trust: { # required
     #               acm: {
     #                 certificate_authority_arns: ["Arn"], # required
@@ -6613,6 +8146,9 @@ module Aws::AppMesh
     #               file: {
     #                 certificate_chain: "FilePath", # required
     #               },
+    #               sds: {
+    #                 secret_name: "VirtualGatewaySdsSecretName", # required
+    #               },
     #             },
     #           },
     #         },
@@ -6638,9 +8174,23 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         certificate: {
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #             private_key: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
+    #         },
     #         enforce: false,
     #         ports: [1],
     #         validation: { # required
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
     #           trust: { # required
     #             acm: {
     #               certificate_authority_arns: ["Arn"], # required
@@ -6648,10 +8198,18 @@ module Aws::AppMesh
     #             file: {
     #               certificate_chain: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
     #           },
     #         },
     #       }
     #
+    # @!attribute [rw] certificate
+    #   A reference to an object that represents a virtual gateway's
+    #   client's Transport Layer Security (TLS) certificate.
+    #   @return [Types::VirtualGatewayClientTlsCertificate]
+    #
     # @!attribute [rw] enforce
     #   Whether the policy is enforced. The default is `True`, if a value
     #   isn't specified.
@@ -6662,12 +8220,14 @@ module Aws::AppMesh
     #   @return [Array<Integer>]
     #
     # @!attribute [rw] validation
-    #   A reference to an object that represents a TLS validation context.
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) validation context.
     #   @return [Types::VirtualGatewayTlsValidationContext]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayClientPolicyTls AWS API Documentation
     #
     class VirtualGatewayClientPolicyTls < Struct.new(
+      :certificate,
       :enforce,
       :ports,
       :validation)
@@ -6675,6 +8235,44 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the virtual gateway's client's Transport
+    # Layer Security (TLS) certificate.
+    #
+    # @note VirtualGatewayClientTlsCertificate is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note VirtualGatewayClientTlsCertificate is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualGatewayClientTlsCertificate corresponding to the set member.
+    #
+    # @!attribute [rw] file
+    #   An object that represents a local file certificate. The certificate
+    #   must meet specific requirements and you must have proxy
+    #   authorization enabled. For more information, see [ Transport Layer
+    #   Security (TLS) ][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #   @return [Types::VirtualGatewayListenerTlsFileCertificate]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   client's Secret Discovery Service certificate.
+    #   @return [Types::VirtualGatewayListenerTlsSdsCertificate]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayClientTlsCertificate AWS API Documentation
+    #
+    class VirtualGatewayClientTlsCertificate < Struct.new(
+      :file,
+      :sds,
+      :unknown)
+      SENSITIVE = []
+      include Aws::Structure
+      include Aws::Structure::Union
+
+      class File < VirtualGatewayClientTlsCertificate; end
+      class Sds < VirtualGatewayClientTlsCertificate; end
+      class Unknown < VirtualGatewayClientTlsCertificate; end
+    end
+
     # An object that represents the type of virtual gateway connection pool.
     #
     # Only one protocol is used at a time and should be the same protocol as
@@ -6683,21 +8281,9 @@ module Aws::AppMesh
     # If not present the default value for `maxPendingRequests` is
     # `2147483647`.
     #
-    # @note When making an API call, you may pass VirtualGatewayConnectionPool
-    #   data as a hash:
+    # @note VirtualGatewayConnectionPool is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         grpc: {
-    #           max_requests: 1, # required
-    #         },
-    #         http: {
-    #           max_connections: 1, # required
-    #           max_pending_requests: 1,
-    #         },
-    #         http2: {
-    #           max_requests: 1, # required
-    #         },
-    #       }
+    # @note VirtualGatewayConnectionPool is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualGatewayConnectionPool corresponding to the set member.
     #
     # @!attribute [rw] grpc
     #   An object that represents a type of connection pool.
@@ -6716,9 +8302,16 @@ module Aws::AppMesh
     class VirtualGatewayConnectionPool < Struct.new(
       :grpc,
       :http,
-      :http2)
+      :http2,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Grpc < VirtualGatewayConnectionPool; end
+      class Http < VirtualGatewayConnectionPool; end
+      class Http2 < VirtualGatewayConnectionPool; end
+      class Unknown < VirtualGatewayConnectionPool; end
     end
 
     # An object that represents a virtual gateway returned by a describe
@@ -6965,8 +8558,26 @@ module Aws::AppMesh
     #               certificate_chain: "FilePath", # required
     #               private_key: "FilePath", # required
     #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
     #           },
     #           mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #           validation: {
+    #             subject_alternative_names: {
+    #               match: { # required
+    #                 exact: ["SubjectAlternativeName"], # required
+    #               },
+    #             },
+    #             trust: { # required
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "VirtualGatewaySdsSecretName", # required
+    #               },
+    #             },
+    #           },
     #         },
     #       }
     #
@@ -7013,8 +8624,26 @@ module Aws::AppMesh
     #             certificate_chain: "FilePath", # required
     #             private_key: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
     #         },
     #         mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #         validation: {
+    #           subject_alternative_names: {
+    #             match: { # required
+    #               exact: ["SubjectAlternativeName"], # required
+    #             },
+    #           },
+    #           trust: { # required
+    #             file: {
+    #               certificate_chain: "FilePath", # required
+    #             },
+    #             sds: {
+    #               secret_name: "VirtualGatewaySdsSecretName", # required
+    #             },
+    #           },
+    #         },
     #       }
     #
     # @!attribute [rw] certificate
@@ -7033,16 +8662,22 @@ module Aws::AppMesh
     #   * ****DISABLED – Listener only accepts connections without TLS.
     #   @return [String]
     #
+    # @!attribute [rw] validation
+    #   A reference to an object that represents a virtual gateway's
+    #   listener's Transport Layer Security (TLS) validation context.
+    #   @return [Types::VirtualGatewayListenerTlsValidationContext]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTls AWS API Documentation
     #
     class VirtualGatewayListenerTls < Struct.new(
       :certificate,
-      :mode)
+      :mode,
+      :validation)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents an AWS Certicate Manager (ACM) certificate.
+    # An object that represents an Certificate Manager certificate.
     #
     # @note When making an API call, you may pass VirtualGatewayListenerTlsAcmCertificate
     #   data as a hash:
@@ -7073,35 +8708,39 @@ module Aws::AppMesh
     # An object that represents a listener's Transport Layer Security (TLS)
     # certificate.
     #
-    # @note When making an API call, you may pass VirtualGatewayListenerTlsCertificate
-    #   data as a hash:
+    # @note VirtualGatewayListenerTlsCertificate is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         acm: {
-    #           certificate_arn: "Arn", # required
-    #         },
-    #         file: {
-    #           certificate_chain: "FilePath", # required
-    #           private_key: "FilePath", # required
-    #         },
-    #       }
+    # @note VirtualGatewayListenerTlsCertificate is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualGatewayListenerTlsCertificate corresponding to the set member.
     #
     # @!attribute [rw] acm
-    #   A reference to an object that represents an AWS Certicate Manager
-    #   (ACM) certificate.
+    #   A reference to an object that represents an Certificate Manager
+    #   certificate.
     #   @return [Types::VirtualGatewayListenerTlsAcmCertificate]
     #
     # @!attribute [rw] file
     #   A reference to an object that represents a local file certificate.
     #   @return [Types::VirtualGatewayListenerTlsFileCertificate]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   listener's Secret Discovery Service certificate.
+    #   @return [Types::VirtualGatewayListenerTlsSdsCertificate]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsCertificate AWS API Documentation
     #
     class VirtualGatewayListenerTlsCertificate < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Acm < VirtualGatewayListenerTlsCertificate; end
+      class File < VirtualGatewayListenerTlsCertificate; end
+      class Sds < VirtualGatewayListenerTlsCertificate; end
+      class Unknown < VirtualGatewayListenerTlsCertificate; end
     end
 
     # An object that represents a local file certificate. The certificate
@@ -7139,6 +8778,112 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
+    # An object that represents the virtual gateway's listener's Secret
+    # Discovery Service certificate.The proxy must be configured with a
+    # local SDS provider via a Unix Domain Socket. See App Mesh[TLS
+    # documentation][1] for more info.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass VirtualGatewayListenerTlsSdsCertificate
+    #   data as a hash:
+    #
+    #       {
+    #         secret_name: "VirtualGatewaySdsSecretName", # required
+    #       }
+    #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret
+    #   secret requested from the Secret Discovery Service provider
+    #   representing Transport Layer Security (TLS) materials like a
+    #   certificate or certificate chain.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsSdsCertificate AWS API Documentation
+    #
+    class VirtualGatewayListenerTlsSdsCertificate < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a virtual gateway's listener's Transport
+    # Layer Security (TLS) validation context.
+    #
+    # @note When making an API call, you may pass VirtualGatewayListenerTlsValidationContext
+    #   data as a hash:
+    #
+    #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
+    #         trust: { # required
+    #           file: {
+    #             certificate_chain: "FilePath", # required
+    #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
+    #         },
+    #       }
+    #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a virtual
+    #   gateway listener's Transport Layer Security (TLS) validation
+    #   context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
+    # @!attribute [rw] trust
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
+    #   @return [Types::VirtualGatewayListenerTlsValidationContextTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsValidationContext AWS API Documentation
+    #
+    class VirtualGatewayListenerTlsValidationContext < Struct.new(
+      :subject_alternative_names,
+      :trust)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a virtual gateway's listener's Transport
+    # Layer Security (TLS) validation context trust.
+    #
+    # @note VirtualGatewayListenerTlsValidationContextTrust is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note VirtualGatewayListenerTlsValidationContextTrust is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualGatewayListenerTlsValidationContextTrust corresponding to the set member.
+    #
+    # @!attribute [rw] file
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
+    #   @return [Types::VirtualGatewayTlsValidationContextFileTrust]
+    #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   listener's Transport Layer Security (TLS) Secret Discovery Service
+    #   validation context trust.
+    #   @return [Types::VirtualGatewayTlsValidationContextSdsTrust]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayListenerTlsValidationContextTrust AWS API Documentation
+    #
+    class VirtualGatewayListenerTlsValidationContextTrust < Struct.new(
+      :file,
+      :sds,
+      :unknown)
+      SENSITIVE = []
+      include Aws::Structure
+      include Aws::Structure::Union
+
+      class File < VirtualGatewayListenerTlsValidationContextTrust; end
+      class Sds < VirtualGatewayListenerTlsValidationContextTrust; end
+      class Unknown < VirtualGatewayListenerTlsValidationContextTrust; end
+    end
+
     # An object that represents logging information.
     #
     # @note When making an API call, you may pass VirtualGatewayLogging
@@ -7268,9 +9013,23 @@ module Aws::AppMesh
     #         backend_defaults: {
     #           client_policy: {
     #             tls: {
+    #               certificate: {
+    #                 file: {
+    #                   certificate_chain: "FilePath", # required
+    #                   private_key: "FilePath", # required
+    #                 },
+    #                 sds: {
+    #                   secret_name: "VirtualGatewaySdsSecretName", # required
+    #                 },
+    #               },
     #               enforce: false,
     #               ports: [1],
     #               validation: { # required
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
     #                 trust: { # required
     #                   acm: {
     #                     certificate_authority_arns: ["Arn"], # required
@@ -7278,6 +9037,9 @@ module Aws::AppMesh
     #                   file: {
     #                     certificate_chain: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
     #                 },
     #               },
     #             },
@@ -7319,8 +9081,26 @@ module Aws::AppMesh
     #                   certificate_chain: "FilePath", # required
     #                   private_key: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "VirtualGatewaySdsSecretName", # required
+    #                 },
     #               },
     #               mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #               validation: {
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
+    #                 trust: { # required
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "VirtualGatewaySdsSecretName", # required
+    #                   },
+    #                 },
+    #               },
     #             },
     #           },
     #         ],
@@ -7377,6 +9157,11 @@ module Aws::AppMesh
     #   data as a hash:
     #
     #       {
+    #         subject_alternative_names: {
+    #           match: { # required
+    #             exact: ["SubjectAlternativeName"], # required
+    #           },
+    #         },
     #         trust: { # required
     #           acm: {
     #             certificate_authority_arns: ["Arn"], # required
@@ -7384,24 +9169,34 @@ module Aws::AppMesh
     #           file: {
     #             certificate_chain: "FilePath", # required
     #           },
+    #           sds: {
+    #             secret_name: "VirtualGatewaySdsSecretName", # required
+    #           },
     #         },
     #       }
     #
+    # @!attribute [rw] subject_alternative_names
+    #   A reference to an object that represents the SANs for a virtual
+    #   gateway's listener's Transport Layer Security (TLS) validation
+    #   context.
+    #   @return [Types::SubjectAlternativeNames]
+    #
     # @!attribute [rw] trust
-    #   A reference to an object that represents a TLS validation context
-    #   trust.
+    #   A reference to where to retrieve the trust chain when validating a
+    #   peer’s Transport Layer Security (TLS) certificate.
     #   @return [Types::VirtualGatewayTlsValidationContextTrust]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayTlsValidationContext AWS API Documentation
     #
     class VirtualGatewayTlsValidationContext < Struct.new(
+      :subject_alternative_names,
       :trust)
       SENSITIVE = []
       include Aws::Structure
     end
 
-    # An object that represents a TLS validation context trust for an AWS
-    # Certicate Manager (ACM) certificate.
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust for an Certificate Manager certificate.
     #
     # @note When making an API call, you may pass VirtualGatewayTlsValidationContextAcmTrust
     #   data as a hash:
@@ -7445,38 +9240,75 @@ module Aws::AppMesh
       include Aws::Structure
     end
 
-    # An object that represents a Transport Layer Security (TLS) validation
-    # context trust.
+    # An object that represents a virtual gateway's listener's Transport
+    # Layer Security (TLS) Secret Discovery Service validation context
+    # trust. The proxy must be configured with a local SDS provider via a
+    # Unix Domain Socket. See App Mesh [TLS documentation][1] for more info.
     #
-    # @note When making an API call, you may pass VirtualGatewayTlsValidationContextTrust
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/app-mesh/latest/userguide/tls.html
+    #
+    # @note When making an API call, you may pass VirtualGatewayTlsValidationContextSdsTrust
     #   data as a hash:
     #
     #       {
-    #         acm: {
-    #           certificate_authority_arns: ["Arn"], # required
-    #         },
-    #         file: {
-    #           certificate_chain: "FilePath", # required
-    #         },
+    #         secret_name: "VirtualGatewaySdsSecretName", # required
     #       }
     #
+    # @!attribute [rw] secret_name
+    #   A reference to an object that represents the name of the secret for
+    #   a virtual gateway's Transport Layer Security (TLS) Secret Discovery
+    #   Service validation context trust.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayTlsValidationContextSdsTrust AWS API Documentation
+    #
+    class VirtualGatewayTlsValidationContextSdsTrust < Struct.new(
+      :secret_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # An object that represents a Transport Layer Security (TLS) validation
+    # context trust.
+    #
+    # @note VirtualGatewayTlsValidationContextTrust is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note VirtualGatewayTlsValidationContextTrust is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualGatewayTlsValidationContextTrust corresponding to the set member.
+    #
     # @!attribute [rw] acm
-    #   A reference to an object that represents a TLS validation context
-    #   trust for an AWS Certicate Manager (ACM) certificate.
+    #   A reference to an object that represents a Transport Layer Security
+    #   (TLS) validation context trust for an Certificate Manager
+    #   certificate.
     #   @return [Types::VirtualGatewayTlsValidationContextAcmTrust]
     #
     # @!attribute [rw] file
-    #   An object that represents a TLS validation context trust for a local
-    #   file.
+    #   An object that represents a Transport Layer Security (TLS)
+    #   validation context trust for a local file.
     #   @return [Types::VirtualGatewayTlsValidationContextFileTrust]
     #
+    # @!attribute [rw] sds
+    #   A reference to an object that represents a virtual gateway's
+    #   Transport Layer Security (TLS) Secret Discovery Service validation
+    #   context trust.
+    #   @return [Types::VirtualGatewayTlsValidationContextSdsTrust]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/appmesh-2019-01-25/VirtualGatewayTlsValidationContextTrust AWS API Documentation
     #
     class VirtualGatewayTlsValidationContextTrust < Struct.new(
       :acm,
-      :file)
+      :file,
+      :sds,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Acm < VirtualGatewayTlsValidationContextTrust; end
+      class File < VirtualGatewayTlsValidationContextTrust; end
+      class Sds < VirtualGatewayTlsValidationContextTrust; end
+      class Unknown < VirtualGatewayTlsValidationContextTrust; end
     end
 
     # An object that represents the type of virtual node connection pool.
@@ -7487,24 +9319,9 @@ module Aws::AppMesh
     # If not present the default value for `maxPendingRequests` is
     # `2147483647`.
     #
-    # @note When making an API call, you may pass VirtualNodeConnectionPool
-    #   data as a hash:
+    # @note VirtualNodeConnectionPool is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         grpc: {
-    #           max_requests: 1, # required
-    #         },
-    #         http: {
-    #           max_connections: 1, # required
-    #           max_pending_requests: 1,
-    #         },
-    #         http2: {
-    #           max_requests: 1, # required
-    #         },
-    #         tcp: {
-    #           max_connections: 1, # required
-    #         },
-    #       }
+    # @note VirtualNodeConnectionPool is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualNodeConnectionPool corresponding to the set member.
     #
     # @!attribute [rw] grpc
     #   An object that represents a type of connection pool.
@@ -7528,9 +9345,17 @@ module Aws::AppMesh
       :grpc,
       :http,
       :http2,
-      :tcp)
+      :tcp,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class Grpc < VirtualNodeConnectionPool; end
+      class Http < VirtualNodeConnectionPool; end
+      class Http2 < VirtualNodeConnectionPool; end
+      class Tcp < VirtualNodeConnectionPool; end
+      class Unknown < VirtualNodeConnectionPool; end
     end
 
     # An object that represents a virtual node returned by a describe
@@ -7737,9 +9562,23 @@ module Aws::AppMesh
     #         backend_defaults: {
     #           client_policy: {
     #             tls: {
+    #               certificate: {
+    #                 file: {
+    #                   certificate_chain: "FilePath", # required
+    #                   private_key: "FilePath", # required
+    #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
+    #               },
     #               enforce: false,
     #               ports: [1],
     #               validation: { # required
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
     #                 trust: { # required
     #                   acm: {
     #                     certificate_authority_arns: ["Arn"], # required
@@ -7747,6 +9586,9 @@ module Aws::AppMesh
     #                   file: {
     #                     certificate_chain: "FilePath", # required
     #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
     #                 },
     #               },
     #             },
@@ -7757,9 +9599,23 @@ module Aws::AppMesh
     #             virtual_service: {
     #               client_policy: {
     #                 tls: {
+    #                   certificate: {
+    #                     file: {
+    #                       certificate_chain: "FilePath", # required
+    #                       private_key: "FilePath", # required
+    #                     },
+    #                     sds: {
+    #                       secret_name: "SdsSecretName", # required
+    #                     },
+    #                   },
     #                   enforce: false,
     #                   ports: [1],
     #                   validation: { # required
+    #                     subject_alternative_names: {
+    #                       match: { # required
+    #                         exact: ["SubjectAlternativeName"], # required
+    #                       },
+    #                     },
     #                     trust: { # required
     #                       acm: {
     #                         certificate_authority_arns: ["Arn"], # required
@@ -7767,6 +9623,9 @@ module Aws::AppMesh
     #                       file: {
     #                         certificate_chain: "FilePath", # required
     #                       },
+    #                       sds: {
+    #                         secret_name: "SdsSecretName", # required
+    #                       },
     #                     },
     #                   },
     #                 },
@@ -7864,8 +9723,26 @@ module Aws::AppMesh
     #                   certificate_chain: "FilePath", # required
     #                   private_key: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
     #               },
     #               mode: "STRICT", # required, accepts STRICT, PERMISSIVE, DISABLED
+    #               validation: {
+    #                 subject_alternative_names: {
+    #                   match: { # required
+    #                     exact: ["SubjectAlternativeName"], # required
+    #                   },
+    #                 },
+    #                 trust: { # required
+    #                   file: {
+    #                     certificate_chain: "FilePath", # required
+    #                   },
+    #                   sds: {
+    #                     secret_name: "SdsSecretName", # required
+    #                   },
+    #                 },
+    #               },
     #             },
     #           },
     #         ],
@@ -7889,6 +9766,7 @@ module Aws::AppMesh
     #           },
     #           dns: {
     #             hostname: "Hostname", # required
+    #             response_type: "LOADBALANCER", # accepts LOADBALANCER, ENDPOINTS
     #           },
     #         },
     #       }
@@ -8166,9 +10044,23 @@ module Aws::AppMesh
     #       {
     #         client_policy: {
     #           tls: {
+    #             certificate: {
+    #               file: {
+    #                 certificate_chain: "FilePath", # required
+    #                 private_key: "FilePath", # required
+    #               },
+    #               sds: {
+    #                 secret_name: "SdsSecretName", # required
+    #               },
+    #             },
     #             enforce: false,
     #             ports: [1],
     #             validation: { # required
+    #               subject_alternative_names: {
+    #                 match: { # required
+    #                   exact: ["SubjectAlternativeName"], # required
+    #                 },
+    #               },
     #               trust: { # required
     #                 acm: {
     #                   certificate_authority_arns: ["Arn"], # required
@@ -8176,6 +10068,9 @@ module Aws::AppMesh
     #                 file: {
     #                   certificate_chain: "FilePath", # required
     #                 },
+    #                 sds: {
+    #                   secret_name: "SdsSecretName", # required
+    #                 },
     #               },
     #             },
     #           },
@@ -8239,17 +10134,9 @@ module Aws::AppMesh
 
     # An object that represents the provider for a virtual service.
     #
-    # @note When making an API call, you may pass VirtualServiceProvider
-    #   data as a hash:
+    # @note VirtualServiceProvider is a union - when making an API calls you must set exactly one of the members.
     #
-    #       {
-    #         virtual_node: {
-    #           virtual_node_name: "ResourceName", # required
-    #         },
-    #         virtual_router: {
-    #           virtual_router_name: "ResourceName", # required
-    #         },
-    #       }
+    # @note VirtualServiceProvider is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of VirtualServiceProvider corresponding to the set member.
     #
     # @!attribute [rw] virtual_node
     #   The virtual node associated with a virtual service.
@@ -8263,9 +10150,15 @@ module Aws::AppMesh
     #
     class VirtualServiceProvider < Struct.new(
       :virtual_node,
-      :virtual_router)
+      :virtual_router,
+      :unknown)
       SENSITIVE = []
       include Aws::Structure
+      include Aws::Structure::Union
+
+      class VirtualNode < VirtualServiceProvider; end
+      class VirtualRouter < VirtualServiceProvider; end
+      class Unknown < VirtualServiceProvider; end
     end
 
     # An object that represents a virtual service returned by a list