aws-sdk-bedrockagentcorecontrol 1.83.0 → 1.85.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0511e384ef60323afcceb9eec8183165b4101e765db4e16c0a87171a3558b098
-  data.tar.gz: a66cf216a683aedc80089701c5a3d167c15444a980a32a6afa4c57acb3926a7e
+  metadata.gz: 6c8fa872b7b9a52d1934b383a6bab7cf0218cee4dae4967dbe70e3ac47ad0c54
+  data.tar.gz: b729ffda2260d9ae6a13b9dba184875cefb6827e9cc27a4eb4b43dc6c92642c1
 SHA512:
-  metadata.gz: 01b823269f2c74f5cd2f88e4e2b5ecf8dba0ea6db8c9633b5e8c6e00acf0288f2e2b560e0ecc3ce1ea709d256cd2201c930a5d88dd7f7a6276d951c4138a498d
-  data.tar.gz: affd5ca11f265a848f3a8701922ad5ccb5900d8ce7774c9d0081bf25fc3b636d5d5884e4693fbf021dd60909034842269abba3dcb95baa8f176214573b1a57ec
+  metadata.gz: cffd7a666bc93d8aedddd34f7702c72b9bc3bcc6bd874c8aedac2fa8c54af129880bcde2d35296cab68a6889f19e3c294dc1689aaea924969a4cb2ccdadd9151
+  data.tar.gz: 0d9c69cb5a2bdad1078eeb68acda4b38a9337d308cbe0f61e2b60d27c6ea3804d775f24f27b7ce3ef243fc983a2cde56da39346f05734bcc0b16047d9ac6e684

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.85.0 (2026-10-28)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+1.84.0 (2026-10-27)
+------------------
+
+* Feature - Adds the ResetTokenVaultKeyMaterial API, which restores a token vault whose customer managed key was deleted by moving it to an AWS owned key. The reset permanently deletes the stored OAuth 2.0 tokens, users must consent again. Adds on-behalf-of token exchange client authentication override option.
+
 1.83.0 (2026-10-22)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.83.0
+1.85.0

data/lib/aws-sdk-bedrockagentcorecontrol/client.rb

@@ -4418,6 +4418,9 @@ module Aws::BedrockAgentCoreControl
     #             actor_token_content: "NONE", # required, accepts NONE, M2M, AWS_IAM_ID_TOKEN_JWT
     #             actor_token_scopes: ["ScopeType"],
     #           },
+    #           on_behalf_of_authentication_config: {
+    #             client_authentication_method: "NO_CLIENT", # required, accepts NO_CLIENT
+    #           },
     #         },
     #         client_authentication_method: "CLIENT_SECRET_BASIC", # accepts CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT, PRIVATE_KEY_JWT
     #         private_key_jwt_config: {
@@ -4573,6 +4576,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.on_behalf_of_authentication_config.client_authentication_method #=> String, one of "NO_CLIENT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT", "PRIVATE_KEY_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.self_managed_lattice_resource.resource_configuration_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.vpc_identifier #=> String
@@ -8914,6 +8918,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.on_behalf_of_authentication_config.client_authentication_method #=> String, one of "NO_CLIENT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT", "PRIVATE_KEY_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.self_managed_lattice_resource.resource_configuration_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.vpc_identifier #=> String
@@ -12134,6 +12139,57 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Resets the key material for a token vault whose customer managed KMS
+    # key has been deleted, and re-encrypts the token vault with an Amazon
+    # Web Services managed key so that you can use the token vault again.
+    #
+    # This operation can't be undone. The reset permanently deletes the
+    # OAuth2 access tokens and refresh tokens stored in the token vault,
+    # including tokens obtained through all supported flows. After the
+    # reset, your agents must complete these flows again to get new tokens,
+    # and for user-delegated flows your users must authorize access again.
+    # The reset doesn't delete your credential providers or their
+    # configuration.
+    #
+    # You can reset a token vault only if its customer managed key has been
+    # deleted. If the key still exists, including when it's disabled or
+    # scheduled for deletion, this operation returns a
+    # `ValidationException`. To use the token vault again, enable the key or
+    # cancel its scheduled deletion in KMS. To switch to a different key,
+    # use `SetTokenVaultCMK`.
+    #
+    # @option params [required, String] :token_vault_id
+    #   The unique identifier of the token vault to reset. To reset your
+    #   account's default token vault, specify `default`.
+    #
+    # @return [Types::ResetTokenVaultKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ResetTokenVaultKeyMaterialResponse#token_vault_id #token_vault_id} => String
+    #   * {Types::ResetTokenVaultKeyMaterialResponse#kms_configuration #kms_configuration} => Types::KmsConfiguration
+    #   * {Types::ResetTokenVaultKeyMaterialResponse#last_modified_date #last_modified_date} => Time
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.reset_token_vault_key_material({
+    #     token_vault_id: "TokenVaultIdType", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.token_vault_id #=> String
+    #   resp.kms_configuration.key_type #=> String, one of "CustomerManagedKey", "ServiceManagedKey"
+    #   resp.kms_configuration.kms_key_arn #=> String
+    #   resp.last_modified_date #=> Time
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ResetTokenVaultKeyMaterial AWS API Documentation
+    #
+    # @overload reset_token_vault_key_material(params = {})
+    # @param [Hash] params ({})
+    def reset_token_vault_key_material(params = {}, options = {})
+      req = build_request(:reset_token_vault_key_material, params)
+      req.send_request(options)
+    end
+
     # Replaces the service-managed credentials of a payment connector with
     # newly issued credentials.
     #
@@ -16037,6 +16093,9 @@ module Aws::BedrockAgentCoreControl
     #             actor_token_content: "NONE", # required, accepts NONE, M2M, AWS_IAM_ID_TOKEN_JWT
     #             actor_token_scopes: ["ScopeType"],
     #           },
+    #           on_behalf_of_authentication_config: {
+    #             client_authentication_method: "NO_CLIENT", # required, accepts NO_CLIENT
+    #           },
     #         },
     #         client_authentication_method: "CLIENT_SECRET_BASIC", # accepts CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT, PRIVATE_KEY_JWT
     #         private_key_jwt_config: {
@@ -16190,6 +16249,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.on_behalf_of_authentication_config.client_authentication_method #=> String, one of "NO_CLIENT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT", "PRIVATE_KEY_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.self_managed_lattice_resource.resource_configuration_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.vpc_identifier #=> String
@@ -17448,7 +17508,7 @@ module Aws::BedrockAgentCoreControl
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-bedrockagentcorecontrol'
-      context[:gem_version] = '1.83.0'
+      context[:gem_version] = '1.85.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-bedrockagentcorecontrol/client_api.rb

@@ -1013,6 +1013,8 @@ module Aws::BedrockAgentCoreControl
     Oauth2Discovery = Shapes::UnionShape.new(name: 'Oauth2Discovery')
     Oauth2ProviderConfigInput = Shapes::UnionShape.new(name: 'Oauth2ProviderConfigInput')
     Oauth2ProviderConfigOutput = Shapes::UnionShape.new(name: 'Oauth2ProviderConfigOutput')
+    OnBehalfOfAuthenticationConfig = Shapes::StructureShape.new(name: 'OnBehalfOfAuthenticationConfig')
+    OnBehalfOfClientAuthenticationMethod = Shapes::StringShape.new(name: 'OnBehalfOfClientAuthenticationMethod')
     OnBehalfOfTokenExchangeConfigType = Shapes::StructureShape.new(name: 'OnBehalfOfTokenExchangeConfigType')
     OnBehalfOfTokenExchangeGrantTypeType = Shapes::StringShape.new(name: 'OnBehalfOfTokenExchangeGrantTypeType')
     OnlineEvaluationConfigArn = Shapes::StringShape.new(name: 'OnlineEvaluationConfigArn')
@@ -1140,6 +1142,8 @@ module Aws::BedrockAgentCoreControl
     RequestHeaderAllowlist = Shapes::ListShape.new(name: 'RequestHeaderAllowlist')
     RequestHeaderConfiguration = Shapes::UnionShape.new(name: 'RequestHeaderConfiguration')
     RequiredProperties = Shapes::ListShape.new(name: 'RequiredProperties')
+    ResetTokenVaultKeyMaterialRequest = Shapes::StructureShape.new(name: 'ResetTokenVaultKeyMaterialRequest')
+    ResetTokenVaultKeyMaterialResponse = Shapes::StructureShape.new(name: 'ResetTokenVaultKeyMaterialResponse')
     Resource = Shapes::UnionShape.new(name: 'Resource')
     ResourceAssociationArn = Shapes::StringShape.new(name: 'ResourceAssociationArn')
     ResourceConfigurationIdentifier = Shapes::StringShape.new(name: 'ResourceConfigurationIdentifier')
@@ -5130,8 +5134,12 @@ module Aws::BedrockAgentCoreControl
     Oauth2ProviderConfigOutput.add_member_subclass(:unknown, Types::Oauth2ProviderConfigOutput::Unknown)
     Oauth2ProviderConfigOutput.struct_class = Types::Oauth2ProviderConfigOutput
 
+    OnBehalfOfAuthenticationConfig.add_member(:client_authentication_method, Shapes::ShapeRef.new(shape: OnBehalfOfClientAuthenticationMethod, required: true, location_name: "clientAuthenticationMethod"))
+    OnBehalfOfAuthenticationConfig.struct_class = Types::OnBehalfOfAuthenticationConfig
+
     OnBehalfOfTokenExchangeConfigType.add_member(:grant_type, Shapes::ShapeRef.new(shape: OnBehalfOfTokenExchangeGrantTypeType, required: true, location_name: "grantType"))
     OnBehalfOfTokenExchangeConfigType.add_member(:token_exchange_grant_type_config, Shapes::ShapeRef.new(shape: TokenExchangeGrantTypeConfigType, location_name: "tokenExchangeGrantTypeConfig"))
+    OnBehalfOfTokenExchangeConfigType.add_member(:on_behalf_of_authentication_config, Shapes::ShapeRef.new(shape: OnBehalfOfAuthenticationConfig, location_name: "onBehalfOfAuthenticationConfig"))
     OnBehalfOfTokenExchangeConfigType.struct_class = Types::OnBehalfOfTokenExchangeConfigType
 
     OnlineEvaluationConfigSummary.add_member(:online_evaluation_config_arn, Shapes::ShapeRef.new(shape: OnlineEvaluationConfigArn, required: true, location_name: "onlineEvaluationConfigArn"))
@@ -5470,6 +5478,14 @@ module Aws::BedrockAgentCoreControl
 
     RequiredProperties.member = Shapes::ShapeRef.new(shape: String)
 
+    ResetTokenVaultKeyMaterialRequest.add_member(:token_vault_id, Shapes::ShapeRef.new(shape: TokenVaultIdType, required: true, location_name: "tokenVaultId"))
+    ResetTokenVaultKeyMaterialRequest.struct_class = Types::ResetTokenVaultKeyMaterialRequest
+
+    ResetTokenVaultKeyMaterialResponse.add_member(:token_vault_id, Shapes::ShapeRef.new(shape: TokenVaultIdType, required: true, location_name: "tokenVaultId"))
+    ResetTokenVaultKeyMaterialResponse.add_member(:kms_configuration, Shapes::ShapeRef.new(shape: KmsConfiguration, required: true, location_name: "kmsConfiguration"))
+    ResetTokenVaultKeyMaterialResponse.add_member(:last_modified_date, Shapes::ShapeRef.new(shape: Timestamp, required: true, location_name: "lastModifiedDate"))
+    ResetTokenVaultKeyMaterialResponse.struct_class = Types::ResetTokenVaultKeyMaterialResponse
+
     Resource.add_member(:arn, Shapes::ShapeRef.new(shape: BedrockAgentcoreResourceArn, location_name: "arn"))
     Resource.add_member(:unknown, Shapes::ShapeRef.new(shape: nil, location_name: 'unknown'))
     Resource.add_member_subclass(:arn, Types::Resource::Arn)
@@ -7129,6 +7145,7 @@ module Aws::BedrockAgentCoreControl
         o.errors << Shapes::ShapeRef.new(shape: UnauthorizedException)
         o.errors << Shapes::ShapeRef.new(shape: ValidationException)
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
         o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
         o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
         o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
@@ -8775,6 +8792,21 @@ module Aws::BedrockAgentCoreControl
         o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
       end)
 
+      api.add_operation(:reset_token_vault_key_material, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "ResetTokenVaultKeyMaterial"
+        o.http_method = "POST"
+        o.http_request_uri = "/identities/reset-token-vault-key-material"
+        o.input = Shapes::ShapeRef.new(shape: ResetTokenVaultKeyMaterialRequest)
+        o.output = Shapes::ShapeRef.new(shape: ResetTokenVaultKeyMaterialResponse)
+        o.errors << Shapes::ShapeRef.new(shape: UnauthorizedException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+      end)
+
       api.add_operation(:rotate_payment_connector_credentials, Seahorse::Model::Operation.new.tap do |o|
         o.name = "RotatePaymentConnectorCredentials"
         o.http_method = "POST"
@@ -8799,6 +8831,7 @@ module Aws::BedrockAgentCoreControl
         o.errors << Shapes::ShapeRef.new(shape: ConcurrentModificationException)
         o.errors << Shapes::ShapeRef.new(shape: ValidationException)
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
         o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
         o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
         o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
@@ -9276,6 +9309,7 @@ module Aws::BedrockAgentCoreControl
         o.output = Shapes::ShapeRef.new(shape: UpdateWorkloadIdentityResponse)
         o.errors << Shapes::ShapeRef.new(shape: UnauthorizedException)
         o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
         o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
         o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)

data/lib/aws-sdk-bedrockagentcorecontrol/types.rb

@@ -17406,6 +17406,24 @@ module Aws::BedrockAgentCoreControl
       class Unknown < Oauth2ProviderConfigOutput; end
     end
 
+    # Specifies the client authentication method to use for the on-behalf-of
+    # token exchange.
+    #
+    # @!attribute [rw] client_authentication_method
+    #   The client authentication method to use during the on-behalf-of
+    #   token exchange. The `NO_CLIENT` option omits the `clientId` and
+    #   `clientSecret` during the on-behalf-of token exchange with the
+    #   identity provider.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/OnBehalfOfAuthenticationConfig AWS API Documentation
+    #
+    class OnBehalfOfAuthenticationConfig < Struct.new(
+      :client_authentication_method)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Configuration for on-behalf-of token exchange.
     #
     # @!attribute [rw] grant_type
@@ -17416,11 +17434,21 @@ module Aws::BedrockAgentCoreControl
     #   Configuration specific to the TOKEN\_EXCHANGE grant type (RFC 8693).
     #   @return [Types::TokenExchangeGrantTypeConfigType]
     #
+    # @!attribute [rw] on_behalf_of_authentication_config
+    #   Specify the client authentication configuration to use for the
+    #   on-behalf-of token exchange. With this configuration, you override
+    #   the provider level client authentication method for the on-behalf-of
+    #   exchange with the identity provider. If you don't specify this
+    #   configuration, we use the provider level client authentication
+    #   method.
+    #   @return [Types::OnBehalfOfAuthenticationConfig]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/OnBehalfOfTokenExchangeConfigType AWS API Documentation
     #
     class OnBehalfOfTokenExchangeConfigType < Struct.new(
       :grant_type,
-      :token_exchange_grant_type_config)
+      :token_exchange_grant_type_config,
+      :on_behalf_of_authentication_config)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -19037,6 +19065,42 @@ module Aws::BedrockAgentCoreControl
       class Unknown < RequestHeaderConfiguration; end
     end
 
+    # @!attribute [rw] token_vault_id
+    #   The unique identifier of the token vault to reset. To reset your
+    #   account's default token vault, specify `default`.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ResetTokenVaultKeyMaterialRequest AWS API Documentation
+    #
+    class ResetTokenVaultKeyMaterialRequest < Struct.new(
+      :token_vault_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] token_vault_id
+    #   The ID of the token vault.
+    #   @return [String]
+    #
+    # @!attribute [rw] kms_configuration
+    #   The KMS configuration for the token vault after the reset. The token
+    #   vault uses an Amazon Web Services managed key.
+    #   @return [Types::KmsConfiguration]
+    #
+    # @!attribute [rw] last_modified_date
+    #   The timestamp when the token vault was last modified.
+    #   @return [Time]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ResetTokenVaultKeyMaterialResponse AWS API Documentation
+    #
+    class ResetTokenVaultKeyMaterialResponse < Struct.new(
+      :token_vault_id,
+      :kms_configuration,
+      :last_modified_date)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Represents a resource within the AgentCore Policy system. Resources
     # are the targets of policy evaluation. Currently, only AgentCore
     # Gateways are supported as resources for policy enforcement.

data/lib/aws-sdk-bedrockagentcorecontrol.rb

@@ -55,7 +55,7 @@ module Aws::BedrockAgentCoreControl
   autoload :EndpointProvider, 'aws-sdk-bedrockagentcorecontrol/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-bedrockagentcorecontrol/endpoints'
 
-  GEM_VERSION = '1.83.0'
+  GEM_VERSION = '1.85.0'
 
 end
 

data/sig/client.rbs

@@ -2606,6 +2606,18 @@ module Aws
                                ) -> _PutResourcePolicyResponseSuccess
                              | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _PutResourcePolicyResponseSuccess
 
+      interface _ResetTokenVaultKeyMaterialResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::ResetTokenVaultKeyMaterialResponse]
+        def token_vault_id: () -> ::String
+        def kms_configuration: () -> Types::KmsConfiguration
+        def last_modified_date: () -> ::Time
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/BedrockAgentCoreControl/Client.html#reset_token_vault_key_material-instance_method
+      def reset_token_vault_key_material: (
+                                            token_vault_id: ::String
+                                          ) -> _ResetTokenVaultKeyMaterialResponseSuccess
+                                        | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _ResetTokenVaultKeyMaterialResponseSuccess
+
       interface _RotatePaymentConnectorCredentialsResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::RotatePaymentConnectorCredentialsResponse]
         def payment_connector_id: () -> ::String

data/sig/params.rbs

@@ -1061,6 +1061,17 @@ module Aws
       }?
     }
 
+      type on_behalf_of_token_exchange_config_type = {
+      grant_type: ("TOKEN_EXCHANGE" | "JWT_AUTHORIZATION_GRANT"),
+      token_exchange_grant_type_config: {
+        actor_token_content: ("NONE" | "M2M" | "AWS_IAM_ID_TOKEN_JWT"),
+        actor_token_scopes: Array[::String]?
+      }?,
+      on_behalf_of_authentication_config: {
+        client_authentication_method: ("NO_CLIENT")
+      }?
+    }
+
       type private_key_jwt_config = {
       private_key_source: {
         kms_key_source: {
@@ -1081,13 +1092,7 @@ module Aws
         json_key: ::String
       }?,
       client_secret_source: ("MANAGED" | "EXTERNAL")?,
-      on_behalf_of_token_exchange_config: {
-        grant_type: ("TOKEN_EXCHANGE" | "JWT_AUTHORIZATION_GRANT"),
-        token_exchange_grant_type_config: {
-          actor_token_content: ("NONE" | "M2M" | "AWS_IAM_ID_TOKEN_JWT"),
-          actor_token_scopes: Array[::String]?
-        }?
-      }?,
+      on_behalf_of_token_exchange_config: Params::on_behalf_of_token_exchange_config_type?,
       client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT" | "PRIVATE_KEY_JWT")?,
       private_key_jwt_config: Params::private_key_jwt_config?,
       private_endpoint: Params::private_endpoint?,

data/sig/types.rbs

@@ -4796,9 +4796,15 @@ module Aws::BedrockAgentCoreControl
       end
     end
 
+    class OnBehalfOfAuthenticationConfig
+      attr_accessor client_authentication_method: ("NO_CLIENT")
+      SENSITIVE: []
+    end
+
     class OnBehalfOfTokenExchangeConfigType
       attr_accessor grant_type: ("TOKEN_EXCHANGE" | "JWT_AUTHORIZATION_GRANT")
       attr_accessor token_exchange_grant_type_config: Types::TokenExchangeGrantTypeConfigType
+      attr_accessor on_behalf_of_authentication_config: Types::OnBehalfOfAuthenticationConfig
       SENSITIVE: []
     end
 
@@ -5222,6 +5228,18 @@ module Aws::BedrockAgentCoreControl
       end
     end
 
+    class ResetTokenVaultKeyMaterialRequest
+      attr_accessor token_vault_id: ::String
+      SENSITIVE: []
+    end
+
+    class ResetTokenVaultKeyMaterialResponse
+      attr_accessor token_vault_id: ::String
+      attr_accessor kms_configuration: Types::KmsConfiguration
+      attr_accessor last_modified_date: ::Time
+      SENSITIVE: []
+    end
+
     class Resource
       attr_accessor arn: ::String
       attr_accessor unknown: untyped

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-bedrockagentcorecontrol
 version: !ruby/object:Gem::Version
-  version: 1.83.0
+  version: 1.85.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.260.0
+        version: 3.262.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.260.0
+        version: 3.262.0
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
   requirement: !ruby/object:Gem::Requirement