aws-sdk-ec2 1.627.0 → 1.629.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0121a6ab2ff430ed6203db816eafd2bd51aac1c464d99822634e7062217e590
-  data.tar.gz: ca6bf4efb42ef07012558ea2b1d8ad127c974391cb70ab06a1db23de22e2809d
+  metadata.gz: d0daa7dbc043f3a92ea7543ab66b91b63ded7318f434710d900ce7c047071fc6
+  data.tar.gz: 04a8bcde927606fcaea71edd7fce05f5031543a6c718207670628e34f031f6e2
 SHA512:
-  metadata.gz: e62d8552d66451ba039217815982c7647542ea728b0a5829c979f66cf015c19af75dc2a883c09f7055dbf906169e65ea4a45a27cc2ec044cf1b4047c23b9b091
-  data.tar.gz: 403ec550b1350919a4a5c82653efd5fd93d060f7fcce70394743a53edf7c8821ff4ae4601eaa2dfa18089887cc1f81e52989ea2576b5cc5176ceee2de47e1360
+  metadata.gz: 88c9bcabd40adf4f6a566996452a97a1414466ece6c9ca531e3e144d1c645de9e0905ab055a79449f3103844bae94c49cac11c57adac5b91328c31250947c67a
+  data.tar.gz: 8a6bcc9f0cd78fe97d8bfddfe1835839129c7741dff49d2399c133430b5e160603d70dc509e2585de4f97275180270e8f93ea3cf5b00705e7261b9598baa8803

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.629.0 (2026-07-07)
+------------------
+
+* Feature - This launch surfaces the public SSM parameter associated with public AMIs in the AMI metadata.
+
+1.628.0 (2026-07-01)
+------------------
+
+* Feature - Use declarative policies to enable VPC Encryption Controls across your organization or select accounts. Added AMD SEV-SNP support for EC2 Dedicated Hosts. Managed resource visibility settings control whether AWS-provisioned resources in your account appear in console views and API list operations.
+
 1.627.0 (2026-06-30)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.627.0
+1.629.0

data/lib/aws-sdk-ec2/client.rb

@@ -1253,6 +1253,9 @@ module Aws::EC2
     # @option params [String] :availability_zone_id
     #   The ID of the Availability Zone.
     #
+    # @option params [Types::HostCpuOptionsRequest] :cpu_options
+    #   The CPU configuration options to apply to the Dedicated Host.
+    #
     # @option params [String] :auto_placement
     #   Indicates whether the host accepts any untargeted instance launches
     #   that match its instance type configuration, or if it only accepts Host
@@ -1321,6 +1324,9 @@ module Aws::EC2
     #     host_maintenance: "on", # accepts on, off
     #     asset_ids: ["AssetId"],
     #     availability_zone_id: "AvailabilityZoneId",
+    #     cpu_options: {
+    #       amd_sev_snp: "enabled", # accepts enabled, disabled
+    #     },
     #     auto_placement: "on", # accepts on, off
     #     client_token: "String",
     #     instance_type: "String",
@@ -4376,26 +4382,29 @@ module Aws::EC2
     #
     # * `assessing`
     #
-    # * `scheduled`
+    # * `scheduled` — requires a cancellation quote. Use
+    #   `CreateCapacityReservationCancellationQuote` to generate a quote,
+    #   then pass the quote ID with `ApplyCancellationCharges` set to
+    #   `commitment-wind-down`. The cancellation charge depends on how close
+    #   the reservation is to its start date.
     #
     # * `active` and there is no commitment duration or the commitment
     #   duration has elapsed.
     #
-    # * `active` during the commitment duration, if you provide a
-    #   cancellation quote ID and accept the cancellation charges. Use
-    #   `CreateCapacityReservationCancellationQuote` to generate a quote.
-    #   The Capacity Reservation transitions to `cancelling` while charges
-    #   are applied.
+    # * `active` during the commitment duration — requires a cancellation
+    #   quote. Use `CreateCapacityReservationCancellationQuote` to generate
+    #   a quote, then pass the quote ID with `ApplyCancellationCharges` set
+    #   to `commitment-wind-down`. The Capacity Reservation transitions to
+    #   `cancelling` while charges are applied.
+    #
+    # * `delayed` — the commitment duration is waived, so no cancellation
+    #   charge applies.
     #
     # <note markdown="1"> You can't modify or cancel a Capacity Block. For more information,
     # see [Capacity Blocks for ML][1].
     #
     #  </note>
     #
-    # If a future-dated Capacity Reservation enters the `delayed` state, the
-    # commitment duration is waived, and you can cancel it as soon as it
-    # enters the `active` state.
-    #
     # Instances running in the reserved capacity continue running until you
     # stop them. Stopped instances that target the Capacity Reservation can
     # no longer launch. Modify these instances to either target a different
@@ -13501,8 +13510,8 @@ module Aws::EC2
     # instances in different partitions, where instances in one partition do
     # not share the same hardware with instances in another partition. A
     # `precision-time` placement group places instances on supported
-    # hardware with direct access to high-precision time sources in AWS
-    # infrastructure.
+    # hardware with direct access to high-precision time sources in Amazon
+    # Web Services infrastructure.
     #
     # For more information, see [Placement groups][1] in the *Amazon EC2
     # User Guide*.
@@ -24991,6 +25000,58 @@ module Aws::EC2
       req.send_request(options)
     end
 
+    # Describes the account-level VPC Encryption Control configuration for
+    # your account. VPC Encryption Control enables you to enforce encryption
+    # for all data in transit within and between VPCs to meet compliance
+    # requirements.
+    #
+    # For more information, see [Enforce VPC encryption in transit][1] in
+    # the *Amazon VPC User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html
+    #
+    # @option params [Boolean] :dry_run
+    #   Checks whether you have the required permissions for the action,
+    #   without actually making the request, and provides an error response.
+    #   If you have the required permissions, the error response is
+    #   `DryRunOperation`. Otherwise, it is `UnauthorizedOperation`.
+    #
+    # @return [Types::DescribeAccountVpcEncryptionControlResult] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DescribeAccountVpcEncryptionControlResult#account_vpc_encryption_control #account_vpc_encryption_control} => Types::AccountVpcEncryptionControl
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.describe_account_vpc_encryption_control({
+    #     dry_run: false,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.account_vpc_encryption_control.state #=> String, one of "default-state", "transitions-in-progress", "transitions-partially-successful", "transitions-successful", "transitions-failed"
+    #   resp.account_vpc_encryption_control.mode #=> String, one of "unmanaged", "attempt-monitor", "attempt-enforce"
+    #   resp.account_vpc_encryption_control.exclusions.internet_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.egress_only_internet_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.nat_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.virtual_private_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.vpc_peering #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.lambda #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.vpc_lattice #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.elastic_file_system #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.managed_by #=> String, one of "account", "declarative-policy"
+    #   resp.account_vpc_encryption_control.last_update_timestamp #=> Time
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeAccountVpcEncryptionControl AWS API Documentation
+    #
+    # @overload describe_account_vpc_encryption_control(params = {})
+    # @param [Hash] params ({})
+    def describe_account_vpc_encryption_control(params = {}, options = {})
+      req = build_request(:describe_account_vpc_encryption_control, params)
+      req.send_request(options)
+    end
+
     # Describes an Elastic IP address transfer. For more information, see
     # [Transfer Elastic IP addresses][1] in the *Amazon VPC User Guide*.
     #
@@ -29449,7 +29510,7 @@ module Aws::EC2
     #   resp.hosts[0].instances[0].instance_id #=> String
     #   resp.hosts[0].instances[0].instance_type #=> String
     #   resp.hosts[0].instances[0].owner_id #=> String
-    #   resp.hosts[0].state #=> String, one of "available", "under-assessment", "permanent-failure", "released", "released-permanent-failure", "pending"
+    #   resp.hosts[0].state #=> String, one of "available", "under-assessment", "permanent-failure", "released", "released-permanent-failure", "pending", "configuring"
     #   resp.hosts[0].allocation_time #=> Time
     #   resp.hosts[0].release_time #=> Time
     #   resp.hosts[0].tags #=> Array
@@ -29463,6 +29524,7 @@ module Aws::EC2
     #   resp.hosts[0].outpost_arn #=> String
     #   resp.hosts[0].host_maintenance #=> String, one of "on", "off"
     #   resp.hosts[0].asset_id #=> String
+    #   resp.hosts[0].cpu_options.amd_sev_snp #=> String, one of "enabled", "disabled"
     #   resp.next_token #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeHosts AWS API Documentation
@@ -30281,6 +30343,27 @@ module Aws::EC2
     #
     #   * `image-id` - The ID of the image.
     #
+    #   * `image-watermark.source-image-creation-time` - The creation date of
+    #     the source AMI, in the ISO 8601 format in the UTC time zone (`
+    #     YYYY-MM-DDTHH:MM:SS.ssssss+HH:MM `). You can use a wildcard (`*`),
+    #     for example, `2021-09-29T*`, which matches an entire day.
+    #
+    #   * `image-watermark.source-image-id` - The ID of the AMI to which the
+    #     watermark was originally attached.
+    #
+    #   * `image-watermark.source-image-region` - The Region where the
+    #     watermark was originally attached.
+    #
+    #   * `image-watermark.watermark-creation-time` - The date and time the
+    #     watermark was attached to the AMI, in the ISO 8601 format in the UTC
+    #     time zone (` YYYY-MM-DDTHH:MM:SS.ssssss+HH:MM `). You can use a
+    #     wildcard (`*`), for example, `2021-09-29T*`, which matches an entire
+    #     day.
+    #
+    #   * `image-watermark.watermark-key` - The watermark identifier, in
+    #     `accountId:watermarkName` format (for example,
+    #     `123456789012:approvedAmi`).
+    #
     #   * `image-type` - The image type (`machine` \| `kernel` \| `ramdisk`).
     #
     #   * `is-public` - A Boolean that indicates whether the image is public.
@@ -30307,6 +30390,12 @@ module Aws::EC2
     #
     #   * `product-code.type` - The type of the product code (`marketplace`).
     #
+    #   * `public-ssm-parameter-name` - The name of a public Systems Manager
+    #     parameter associated with the AMI. The parameter must be in a
+    #     trusted Amazon Web Services namespace under `aws/service/`. Returns
+    #     all AMIs that have ever been associated with the parameter,
+    #     including previous versions.
+    #
     #   * `ramdisk-id` - The RAM disk ID.
     #
     #   * `root-device-name` - The device name of the root device volume (for
@@ -30469,6 +30558,7 @@ module Aws::EC2
     #   resp.images[0].source_image_id #=> String
     #   resp.images[0].source_image_region #=> String
     #   resp.images[0].free_tier_eligible #=> Boolean
+    #   resp.images[0].public_ssm_parameter_name #=> String
     #   resp.images[0].image_watermarks #=> Array
     #   resp.images[0].image_watermarks[0].watermark_key #=> String
     #   resp.images[0].image_watermarks[0].source_image_region #=> String
@@ -45803,6 +45893,12 @@ module Aws::EC2
     #
     #   [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Query-Requests.html#api-pagination
     #
+    # @option params [Boolean] :include_managed_resources
+    #   Indicates whether to include managed resources in the output. If this
+    #   parameter is set to `true`, the output includes resources that are
+    #   managed by Amazon Web Services services, even if managed resource
+    #   visibility is set to hidden.
+    #
     # @return [Types::DescribeVolumesModificationsResult] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::DescribeVolumesModificationsResult#next_token #next_token} => String
@@ -45823,6 +45919,7 @@ module Aws::EC2
     #     ],
     #     next_token: "String",
     #     max_results: 1,
+    #     include_managed_resources: false,
     #   })
     #
     # @example Response structure
@@ -45845,6 +45942,9 @@ module Aws::EC2
     #   resp.volumes_modifications[0].progress #=> Integer
     #   resp.volumes_modifications[0].start_time #=> Time
     #   resp.volumes_modifications[0].end_time #=> Time
+    #   resp.volumes_modifications[0].operator.managed #=> Boolean
+    #   resp.volumes_modifications[0].operator.principal #=> String
+    #   resp.volumes_modifications[0].operator.hidden_by_default #=> Boolean
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVolumesModifications AWS API Documentation
     #
@@ -58180,6 +58280,103 @@ module Aws::EC2
       req.send_request(options)
     end
 
+    # Modifies the account-level VPC Encryption Control configuration. This
+    # sets the encryption control mode and resource exclusions that apply to
+    # the VPCs in your account. VPC Encryption Control enables you to
+    # enforce encryption for all data in transit within and between VPCs to
+    # meet compliance requirements.
+    #
+    # For more information, see [Enforce VPC encryption in transit][1] in
+    # the *Amazon VPC User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html
+    #
+    # @option params [Boolean] :dry_run
+    #   Checks whether you have the required permissions for the action,
+    #   without actually making the request, and provides an error response.
+    #   If you have the required permissions, the error response is
+    #   `DryRunOperation`. Otherwise, it is `UnauthorizedOperation`.
+    #
+    # @option params [String] :mode
+    #   The encryption mode for the account encryption control configuration.
+    #
+    # @option params [String] :internet_gateway
+    #   Specifies whether to exclude internet gateway resource from
+    #   account-level encryption enforcement.
+    #
+    # @option params [String] :egress_only_internet_gateway
+    #   Specifies whether to exclude egress-only internet gateway resource
+    #   from account-level encryption enforcement.
+    #
+    # @option params [String] :nat_gateway
+    #   Specifies whether to exclude NAT gateway resource from account-level
+    #   encryption enforcement.
+    #
+    # @option params [String] :virtual_private_gateway
+    #   Specifies whether to exclude virtual private gateway resource from
+    #   account-level encryption enforcement.
+    #
+    # @option params [String] :vpc_peering
+    #   Specifies whether to exclude VPC peering connection resource from
+    #   account-level encryption enforcement.
+    #
+    # @option params [String] :lambda
+    #   Specifies whether to exclude Lambda service from account-level
+    #   encryption enforcement.
+    #
+    # @option params [String] :vpc_lattice
+    #   Specifies whether to exclude VPC Lattice service from account-level
+    #   encryption enforcement.
+    #
+    # @option params [String] :elastic_file_system
+    #   Specifies whether to exclude Elastic File System service from
+    #   account-level encryption enforcement.
+    #
+    # @return [Types::ModifyAccountVpcEncryptionControlResult] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ModifyAccountVpcEncryptionControlResult#account_vpc_encryption_control #account_vpc_encryption_control} => Types::AccountVpcEncryptionControl
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.modify_account_vpc_encryption_control({
+    #     dry_run: false,
+    #     mode: "unmanaged", # accepts unmanaged, attempt-monitor, attempt-enforce
+    #     internet_gateway: "enable", # accepts enable, disable
+    #     egress_only_internet_gateway: "enable", # accepts enable, disable
+    #     nat_gateway: "enable", # accepts enable, disable
+    #     virtual_private_gateway: "enable", # accepts enable, disable
+    #     vpc_peering: "enable", # accepts enable, disable
+    #     lambda: "enable", # accepts enable, disable
+    #     vpc_lattice: "enable", # accepts enable, disable
+    #     elastic_file_system: "enable", # accepts enable, disable
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.account_vpc_encryption_control.state #=> String, one of "default-state", "transitions-in-progress", "transitions-partially-successful", "transitions-successful", "transitions-failed"
+    #   resp.account_vpc_encryption_control.mode #=> String, one of "unmanaged", "attempt-monitor", "attempt-enforce"
+    #   resp.account_vpc_encryption_control.exclusions.internet_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.egress_only_internet_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.nat_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.virtual_private_gateway #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.vpc_peering #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.lambda #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.vpc_lattice #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.exclusions.elastic_file_system #=> String, one of "enabling", "enabled", "disabling", "disabled"
+    #   resp.account_vpc_encryption_control.managed_by #=> String, one of "account", "declarative-policy"
+    #   resp.account_vpc_encryption_control.last_update_timestamp #=> Time
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyAccountVpcEncryptionControl AWS API Documentation
+    #
+    # @overload modify_account_vpc_encryption_control(params = {})
+    # @param [Hash] params ({})
+    def modify_account_vpc_encryption_control(params = {}, options = {})
+      req = build_request(:modify_account_vpc_encryption_control, params)
+      req.send_request(options)
+    end
+
     # Modifies an attribute of the specified Elastic IP address. For
     # requirements, see [Using reverse DNS for email applications][1].
     #
@@ -64102,6 +64299,9 @@ module Aws::EC2
     #   resp.volume_modification.progress #=> Integer
     #   resp.volume_modification.start_time #=> Time
     #   resp.volume_modification.end_time #=> Time
+    #   resp.volume_modification.operator.managed #=> Boolean
+    #   resp.volume_modification.operator.principal #=> String
+    #   resp.volume_modification.operator.hidden_by_default #=> Boolean
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyVolume AWS API Documentation
     #
@@ -74175,7 +74375,7 @@ module Aws::EC2
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-ec2'
-      context[:gem_version] = '1.627.0'
+      context[:gem_version] = '1.629.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-ec2/client_api.rb

@@ -55,6 +55,10 @@ module Aws::EC2
     AccountAttributeValue = Shapes::StructureShape.new(name: 'AccountAttributeValue')
     AccountAttributeValueList = Shapes::ListShape.new(name: 'AccountAttributeValueList')
     AccountID = Shapes::StringShape.new(name: 'AccountID')
+    AccountVpcEncryptionControl = Shapes::StructureShape.new(name: 'AccountVpcEncryptionControl')
+    AccountVpcEncryptionControlExclusions = Shapes::StructureShape.new(name: 'AccountVpcEncryptionControlExclusions')
+    AccountVpcEncryptionControlMode = Shapes::StringShape.new(name: 'AccountVpcEncryptionControlMode')
+    AccountVpcEncryptionControlState = Shapes::StringShape.new(name: 'AccountVpcEncryptionControlState')
     ActiveInstance = Shapes::StructureShape.new(name: 'ActiveInstance')
     ActiveInstanceSet = Shapes::ListShape.new(name: 'ActiveInstanceSet')
     ActiveVpnTunnelStatus = Shapes::StructureShape.new(name: 'ActiveVpnTunnelStatus')
@@ -104,6 +108,7 @@ module Aws::EC2
     AllowsMultipleInstanceTypes = Shapes::StringShape.new(name: 'AllowsMultipleInstanceTypes')
     AlternatePathHint = Shapes::StructureShape.new(name: 'AlternatePathHint')
     AlternatePathHintList = Shapes::ListShape.new(name: 'AlternatePathHintList')
+    AmdSevSnp = Shapes::StringShape.new(name: 'AmdSevSnp')
     AmdSevSnpSpecification = Shapes::StringShape.new(name: 'AmdSevSnpSpecification')
     AnalysisAclRule = Shapes::StructureShape.new(name: 'AnalysisAclRule')
     AnalysisComponent = Shapes::StructureShape.new(name: 'AnalysisComponent')
@@ -980,6 +985,8 @@ module Aws::EC2
     DeregisterTransitGatewayMulticastGroupSourcesResult = Shapes::StructureShape.new(name: 'DeregisterTransitGatewayMulticastGroupSourcesResult')
     DescribeAccountAttributesRequest = Shapes::StructureShape.new(name: 'DescribeAccountAttributesRequest')
     DescribeAccountAttributesResult = Shapes::StructureShape.new(name: 'DescribeAccountAttributesResult')
+    DescribeAccountVpcEncryptionControlRequest = Shapes::StructureShape.new(name: 'DescribeAccountVpcEncryptionControlRequest')
+    DescribeAccountVpcEncryptionControlResult = Shapes::StructureShape.new(name: 'DescribeAccountVpcEncryptionControlResult')
     DescribeAddressTransfersMaxResults = Shapes::IntegerShape.new(name: 'DescribeAddressTransfersMaxResults')
     DescribeAddressTransfersRequest = Shapes::StructureShape.new(name: 'DescribeAddressTransfersRequest')
     DescribeAddressTransfersResult = Shapes::StructureShape.new(name: 'DescribeAddressTransfersResult')
@@ -1983,6 +1990,8 @@ module Aws::EC2
     HistoryRecordSet = Shapes::ListShape.new(name: 'HistoryRecordSet')
     HistoryRecords = Shapes::ListShape.new(name: 'HistoryRecords')
     Host = Shapes::StructureShape.new(name: 'Host')
+    HostCpuOptions = Shapes::StructureShape.new(name: 'HostCpuOptions')
+    HostCpuOptionsRequest = Shapes::StructureShape.new(name: 'HostCpuOptionsRequest')
     HostInstance = Shapes::StructureShape.new(name: 'HostInstance')
     HostInstanceList = Shapes::ListShape.new(name: 'HostInstanceList')
     HostList = Shapes::ListShape.new(name: 'HostList')
@@ -2668,6 +2677,8 @@ module Aws::EC2
     MetricValue = Shapes::StructureShape.new(name: 'MetricValue')
     MetricValueSet = Shapes::ListShape.new(name: 'MetricValueSet')
     MillisecondDateTime = Shapes::TimestampShape.new(name: 'MillisecondDateTime')
+    ModifyAccountVpcEncryptionControlRequest = Shapes::StructureShape.new(name: 'ModifyAccountVpcEncryptionControlRequest')
+    ModifyAccountVpcEncryptionControlResult = Shapes::StructureShape.new(name: 'ModifyAccountVpcEncryptionControlResult')
     ModifyAddressAttributeRequest = Shapes::StructureShape.new(name: 'ModifyAddressAttributeRequest')
     ModifyAddressAttributeResult = Shapes::StructureShape.new(name: 'ModifyAddressAttributeResult')
     ModifyAvailabilityZoneGroupRequest = Shapes::StructureShape.new(name: 'ModifyAvailabilityZoneGroupRequest')
@@ -4194,6 +4205,23 @@ module Aws::EC2
 
     AccountAttributeValueList.member = Shapes::ShapeRef.new(shape: AccountAttributeValue, location_name: "item")
 
+    AccountVpcEncryptionControl.add_member(:state, Shapes::ShapeRef.new(shape: AccountVpcEncryptionControlState, location_name: "state"))
+    AccountVpcEncryptionControl.add_member(:mode, Shapes::ShapeRef.new(shape: AccountVpcEncryptionControlMode, location_name: "mode"))
+    AccountVpcEncryptionControl.add_member(:exclusions, Shapes::ShapeRef.new(shape: AccountVpcEncryptionControlExclusions, location_name: "exclusions"))
+    AccountVpcEncryptionControl.add_member(:managed_by, Shapes::ShapeRef.new(shape: ManagedBy, location_name: "managedBy"))
+    AccountVpcEncryptionControl.add_member(:last_update_timestamp, Shapes::ShapeRef.new(shape: MillisecondDateTime, location_name: "lastUpdateTimestamp"))
+    AccountVpcEncryptionControl.struct_class = Types::AccountVpcEncryptionControl
+
+    AccountVpcEncryptionControlExclusions.add_member(:internet_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "internetGateway"))
+    AccountVpcEncryptionControlExclusions.add_member(:egress_only_internet_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "egressOnlyInternetGateway"))
+    AccountVpcEncryptionControlExclusions.add_member(:nat_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "natGateway"))
+    AccountVpcEncryptionControlExclusions.add_member(:virtual_private_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "virtualPrivateGateway"))
+    AccountVpcEncryptionControlExclusions.add_member(:vpc_peering, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "vpcPeering"))
+    AccountVpcEncryptionControlExclusions.add_member(:lambda, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "lambda"))
+    AccountVpcEncryptionControlExclusions.add_member(:vpc_lattice, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "vpcLattice"))
+    AccountVpcEncryptionControlExclusions.add_member(:elastic_file_system, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionState, location_name: "elasticFileSystem"))
+    AccountVpcEncryptionControlExclusions.struct_class = Types::AccountVpcEncryptionControlExclusions
+
     ActiveInstance.add_member(:instance_id, Shapes::ShapeRef.new(shape: String, location_name: "instanceId"))
     ActiveInstance.add_member(:instance_type, Shapes::ShapeRef.new(shape: String, location_name: "instanceType"))
     ActiveInstance.add_member(:spot_instance_request_id, Shapes::ShapeRef.new(shape: String, location_name: "spotInstanceRequestId"))
@@ -4323,6 +4351,7 @@ module Aws::EC2
     AllocateHostsRequest.add_member(:host_maintenance, Shapes::ShapeRef.new(shape: HostMaintenance, location_name: "HostMaintenance"))
     AllocateHostsRequest.add_member(:asset_ids, Shapes::ShapeRef.new(shape: AssetIdList, location_name: "AssetId"))
     AllocateHostsRequest.add_member(:availability_zone_id, Shapes::ShapeRef.new(shape: AvailabilityZoneId, location_name: "AvailabilityZoneId"))
+    AllocateHostsRequest.add_member(:cpu_options, Shapes::ShapeRef.new(shape: HostCpuOptionsRequest, location_name: "CpuOptions"))
     AllocateHostsRequest.add_member(:auto_placement, Shapes::ShapeRef.new(shape: AutoPlacement, location_name: "autoPlacement"))
     AllocateHostsRequest.add_member(:client_token, Shapes::ShapeRef.new(shape: String, location_name: "clientToken"))
     AllocateHostsRequest.add_member(:instance_type, Shapes::ShapeRef.new(shape: String, location_name: "instanceType"))
@@ -7999,6 +8028,12 @@ module Aws::EC2
     DescribeAccountAttributesResult.add_member(:account_attributes, Shapes::ShapeRef.new(shape: AccountAttributeList, location_name: "accountAttributeSet"))
     DescribeAccountAttributesResult.struct_class = Types::DescribeAccountAttributesResult
 
+    DescribeAccountVpcEncryptionControlRequest.add_member(:dry_run, Shapes::ShapeRef.new(shape: Boolean, location_name: "DryRun"))
+    DescribeAccountVpcEncryptionControlRequest.struct_class = Types::DescribeAccountVpcEncryptionControlRequest
+
+    DescribeAccountVpcEncryptionControlResult.add_member(:account_vpc_encryption_control, Shapes::ShapeRef.new(shape: AccountVpcEncryptionControl, location_name: "accountVpcEncryptionControl"))
+    DescribeAccountVpcEncryptionControlResult.struct_class = Types::DescribeAccountVpcEncryptionControlResult
+
     DescribeAddressTransfersRequest.add_member(:allocation_ids, Shapes::ShapeRef.new(shape: AllocationIdList, location_name: "AllocationId"))
     DescribeAddressTransfersRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: String, location_name: "NextToken"))
     DescribeAddressTransfersRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: DescribeAddressTransfersMaxResults, location_name: "MaxResults"))
@@ -9874,6 +9909,7 @@ module Aws::EC2
     DescribeVolumesModificationsRequest.add_member(:filters, Shapes::ShapeRef.new(shape: FilterList, location_name: "Filter"))
     DescribeVolumesModificationsRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: String, location_name: "NextToken"))
     DescribeVolumesModificationsRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: Integer, location_name: "MaxResults"))
+    DescribeVolumesModificationsRequest.add_member(:include_managed_resources, Shapes::ShapeRef.new(shape: Boolean, location_name: "IncludeManagedResources"))
     DescribeVolumesModificationsRequest.struct_class = Types::DescribeVolumesModificationsRequest
 
     DescribeVolumesModificationsResult.add_member(:next_token, Shapes::ShapeRef.new(shape: String, location_name: "nextToken"))
@@ -12202,8 +12238,15 @@ module Aws::EC2
     Host.add_member(:outpost_arn, Shapes::ShapeRef.new(shape: String, location_name: "outpostArn"))
     Host.add_member(:host_maintenance, Shapes::ShapeRef.new(shape: HostMaintenance, location_name: "hostMaintenance"))
     Host.add_member(:asset_id, Shapes::ShapeRef.new(shape: AssetId, location_name: "assetId"))
+    Host.add_member(:cpu_options, Shapes::ShapeRef.new(shape: HostCpuOptions, location_name: "cpuOptions"))
     Host.struct_class = Types::Host
 
+    HostCpuOptions.add_member(:amd_sev_snp, Shapes::ShapeRef.new(shape: AmdSevSnp, location_name: "amdSevSnp"))
+    HostCpuOptions.struct_class = Types::HostCpuOptions
+
+    HostCpuOptionsRequest.add_member(:amd_sev_snp, Shapes::ShapeRef.new(shape: AmdSevSnp, location_name: "AmdSevSnp"))
+    HostCpuOptionsRequest.struct_class = Types::HostCpuOptionsRequest
+
     HostInstance.add_member(:instance_id, Shapes::ShapeRef.new(shape: String, location_name: "instanceId"))
     HostInstance.add_member(:instance_type, Shapes::ShapeRef.new(shape: String, location_name: "instanceType"))
     HostInstance.add_member(:owner_id, Shapes::ShapeRef.new(shape: String, location_name: "ownerId"))
@@ -12314,6 +12357,7 @@ module Aws::EC2
     Image.add_member(:source_image_id, Shapes::ShapeRef.new(shape: String, location_name: "sourceImageId"))
     Image.add_member(:source_image_region, Shapes::ShapeRef.new(shape: String, location_name: "sourceImageRegion"))
     Image.add_member(:free_tier_eligible, Shapes::ShapeRef.new(shape: Boolean, location_name: "freeTierEligible"))
+    Image.add_member(:public_ssm_parameter_name, Shapes::ShapeRef.new(shape: String, location_name: "publicSsmParameterName"))
     Image.add_member(:image_watermarks, Shapes::ShapeRef.new(shape: ImageWatermarkList, location_name: "imageWatermarkSet"))
     Image.add_member(:image_id, Shapes::ShapeRef.new(shape: String, location_name: "imageId"))
     Image.add_member(:image_location, Shapes::ShapeRef.new(shape: String, location_name: "imageLocation"))
@@ -14539,6 +14583,21 @@ module Aws::EC2
 
     MetricValueSet.member = Shapes::ShapeRef.new(shape: MetricValue, location_name: "item")
 
+    ModifyAccountVpcEncryptionControlRequest.add_member(:dry_run, Shapes::ShapeRef.new(shape: Boolean, location_name: "DryRun"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:mode, Shapes::ShapeRef.new(shape: AccountVpcEncryptionControlMode, location_name: "Mode"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:internet_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "InternetGateway"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:egress_only_internet_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "EgressOnlyInternetGateway"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:nat_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "NatGateway"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:virtual_private_gateway, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "VirtualPrivateGateway"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:vpc_peering, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "VpcPeering"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:lambda, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "Lambda"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:vpc_lattice, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "VpcLattice"))
+    ModifyAccountVpcEncryptionControlRequest.add_member(:elastic_file_system, Shapes::ShapeRef.new(shape: VpcEncryptionControlExclusionStateInput, location_name: "ElasticFileSystem"))
+    ModifyAccountVpcEncryptionControlRequest.struct_class = Types::ModifyAccountVpcEncryptionControlRequest
+
+    ModifyAccountVpcEncryptionControlResult.add_member(:account_vpc_encryption_control, Shapes::ShapeRef.new(shape: AccountVpcEncryptionControl, location_name: "accountVpcEncryptionControl"))
+    ModifyAccountVpcEncryptionControlResult.struct_class = Types::ModifyAccountVpcEncryptionControlResult
+
     ModifyAddressAttributeRequest.add_member(:allocation_id, Shapes::ShapeRef.new(shape: AllocationId, required: true, location_name: "AllocationId"))
     ModifyAddressAttributeRequest.add_member(:domain_name, Shapes::ShapeRef.new(shape: String, location_name: "DomainName"))
     ModifyAddressAttributeRequest.add_member(:dry_run, Shapes::ShapeRef.new(shape: Boolean, location_name: "DryRun"))
@@ -19476,6 +19535,7 @@ module Aws::EC2
     VolumeModification.add_member(:progress, Shapes::ShapeRef.new(shape: Long, location_name: "progress"))
     VolumeModification.add_member(:start_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "startTime"))
     VolumeModification.add_member(:end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "endTime"))
+    VolumeModification.add_member(:operator, Shapes::ShapeRef.new(shape: OperatorResponse, location_name: "operator"))
     VolumeModification.struct_class = Types::VolumeModification
 
     VolumeModificationList.member = Shapes::ShapeRef.new(shape: VolumeModification, location_name: "item")
@@ -22090,6 +22150,14 @@ module Aws::EC2
         o.output = Shapes::ShapeRef.new(shape: DescribeAccountAttributesResult)
       end)
 
+      api.add_operation(:describe_account_vpc_encryption_control, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "DescribeAccountVpcEncryptionControl"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: DescribeAccountVpcEncryptionControlRequest)
+        o.output = Shapes::ShapeRef.new(shape: DescribeAccountVpcEncryptionControlResult)
+      end)
+
       api.add_operation(:describe_address_transfers, Seahorse::Model::Operation.new.tap do |o|
         o.name = "DescribeAddressTransfers"
         o.http_method = "POST"
@@ -25805,6 +25873,14 @@ module Aws::EC2
         o.output = Shapes::ShapeRef.new(shape: LockSnapshotResult)
       end)
 
+      api.add_operation(:modify_account_vpc_encryption_control, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "ModifyAccountVpcEncryptionControl"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: ModifyAccountVpcEncryptionControlRequest)
+        o.output = Shapes::ShapeRef.new(shape: ModifyAccountVpcEncryptionControlResult)
+      end)
+
       api.add_operation(:modify_address_attribute, Seahorse::Model::Operation.new.tap do |o|
         o.name = "ModifyAddressAttribute"
         o.http_method = "POST"

data/lib/aws-sdk-ec2/image.rb

@@ -264,6 +264,13 @@ module Aws::EC2
       data[:free_tier_eligible]
     end
 
+    # The name of the public Systems Manager parameter that resolves to this
+    # AMI, under the `aws/service/` namespace.
+    # @return [String]
+    def public_ssm_parameter_name
+      data[:public_ssm_parameter_name]
+    end
+
     # The watermarks attached to the AMI.
     # @return [Array<Types::ImageWatermark>]
     def image_watermarks

data/lib/aws-sdk-ec2/resource.rb

@@ -2498,6 +2498,27 @@ module Aws::EC2
     #
     #   * `image-id` - The ID of the image.
     #
+    #   * `image-watermark.source-image-creation-time` - The creation date of
+    #     the source AMI, in the ISO 8601 format in the UTC time zone (`
+    #     YYYY-MM-DDTHH:MM:SS.ssssss+HH:MM `). You can use a wildcard (`*`),
+    #     for example, `2021-09-29T*`, which matches an entire day.
+    #
+    #   * `image-watermark.source-image-id` - The ID of the AMI to which the
+    #     watermark was originally attached.
+    #
+    #   * `image-watermark.source-image-region` - The Region where the
+    #     watermark was originally attached.
+    #
+    #   * `image-watermark.watermark-creation-time` - The date and time the
+    #     watermark was attached to the AMI, in the ISO 8601 format in the UTC
+    #     time zone (` YYYY-MM-DDTHH:MM:SS.ssssss+HH:MM `). You can use a
+    #     wildcard (`*`), for example, `2021-09-29T*`, which matches an entire
+    #     day.
+    #
+    #   * `image-watermark.watermark-key` - The watermark identifier, in
+    #     `accountId:watermarkName` format (for example,
+    #     `123456789012:approvedAmi`).
+    #
     #   * `image-type` - The image type (`machine` \| `kernel` \| `ramdisk`).
     #
     #   * `is-public` - A Boolean that indicates whether the image is public.
@@ -2524,6 +2545,12 @@ module Aws::EC2
     #
     #   * `product-code.type` - The type of the product code (`marketplace`).
     #
+    #   * `public-ssm-parameter-name` - The name of a public Systems Manager
+    #     parameter associated with the AMI. The parameter must be in a
+    #     trusted Amazon Web Services namespace under `aws/service/`. Returns
+    #     all AMIs that have ever been associated with the parameter,
+    #     including previous versions.
+    #
     #   * `ramdisk-id` - The RAM disk ID.
     #
     #   * `root-device-name` - The device name of the root device volume (for

data/lib/aws-sdk-ec2/types.rb

@@ -535,6 +535,111 @@ module Aws::EC2
       include Aws::Structure
     end
 
+    # Describes the account-level VPC Encryption Control configuration,
+    # including its mode, state, and exclusions.
+    #
+    # For more information, see [Enforce VPC encryption in transit][1] in
+    # the *Amazon VPC User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html
+    #
+    # @!attribute [rw] state
+    #   The current state of the account-level VPC Encryption Control
+    #   configuration.
+    #   @return [String]
+    #
+    # @!attribute [rw] mode
+    #   The encryption mode for the account-level VPC Encryption Control
+    #   configuration.
+    #   @return [String]
+    #
+    # @!attribute [rw] exclusions
+    #   Information about the traffic exclusions for the account-level VPC
+    #   Encryption Control configuration.
+    #   @return [Types::AccountVpcEncryptionControlExclusions]
+    #
+    # @!attribute [rw] managed_by
+    #   The entity that manages the account-level VPC Encryption Control
+    #   configuration.
+    #   @return [String]
+    #
+    # @!attribute [rw] last_update_timestamp
+    #   The date and time when the account-level VPC Encryption Control
+    #   configuration was last updated.
+    #   @return [Time]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/AccountVpcEncryptionControl AWS API Documentation
+    #
+    class AccountVpcEncryptionControl < Struct.new(
+      :state,
+      :mode,
+      :exclusions,
+      :managed_by,
+      :last_update_timestamp)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Describes the exclusion configurations for the various resource types
+    # in the account-level VPC Encryption Control configuration.
+    #
+    # For more information, see [Enforce VPC encryption in transit][1] in
+    # the *Amazon VPC User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html
+    #
+    # @!attribute [rw] internet_gateway
+    #   The exclusion configuration for internet gateway resource.
+    #   @return [String]
+    #
+    # @!attribute [rw] egress_only_internet_gateway
+    #   The exclusion configuration for egress-only internet gateway
+    #   resource.
+    #   @return [String]
+    #
+    # @!attribute [rw] nat_gateway
+    #   The exclusion configuration for NAT gateway resource.
+    #   @return [String]
+    #
+    # @!attribute [rw] virtual_private_gateway
+    #   The exclusion configuration for virtual private gateway resource.
+    #   @return [String]
+    #
+    # @!attribute [rw] vpc_peering
+    #   The exclusion configuration for VPC peering connection resource.
+    #   @return [String]
+    #
+    # @!attribute [rw] lambda
+    #   The exclusion configuration for Lambda service.
+    #   @return [String]
+    #
+    # @!attribute [rw] vpc_lattice
+    #   The exclusion configuration for VPC Lattice service.
+    #   @return [String]
+    #
+    # @!attribute [rw] elastic_file_system
+    #   The exclusion configuration for Elastic File System service.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/AccountVpcEncryptionControlExclusions AWS API Documentation
+    #
+    class AccountVpcEncryptionControlExclusions < Struct.new(
+      :internet_gateway,
+      :egress_only_internet_gateway,
+      :nat_gateway,
+      :virtual_private_gateway,
+      :vpc_peering,
+      :lambda,
+      :vpc_lattice,
+      :elastic_file_system)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Describes a running instance in a Spot Fleet.
     #
     # @!attribute [rw] instance_id
@@ -1228,6 +1333,10 @@ module Aws::EC2
     #   The ID of the Availability Zone.
     #   @return [String]
     #
+    # @!attribute [rw] cpu_options
+    #   The CPU configuration options to apply to the Dedicated Host.
+    #   @return [Types::HostCpuOptionsRequest]
+    #
     # @!attribute [rw] auto_placement
     #   Indicates whether the host accepts any untargeted instance launches
     #   that match its instance type configuration, or if it only accepts
@@ -1287,6 +1396,7 @@ module Aws::EC2
       :host_maintenance,
       :asset_ids,
       :availability_zone_id,
+      :cpu_options,
       :auto_placement,
       :client_token,
       :instance_type,
@@ -21723,6 +21833,34 @@ module Aws::EC2
       include Aws::Structure
     end
 
+    # @!attribute [rw] dry_run
+    #   Checks whether you have the required permissions for the action,
+    #   without actually making the request, and provides an error response.
+    #   If you have the required permissions, the error response is
+    #   `DryRunOperation`. Otherwise, it is `UnauthorizedOperation`.
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeAccountVpcEncryptionControlRequest AWS API Documentation
+    #
+    class DescribeAccountVpcEncryptionControlRequest < Struct.new(
+      :dry_run)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] account_vpc_encryption_control
+    #   Information about the account-level VPC Encryption Control
+    #   configuration.
+    #   @return [Types::AccountVpcEncryptionControl]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeAccountVpcEncryptionControlResult AWS API Documentation
+    #
+    class DescribeAccountVpcEncryptionControlResult < Struct.new(
+      :account_vpc_encryption_control)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] allocation_ids
     #   The allocation IDs of Elastic IP addresses.
     #   @return [Array<String>]
@@ -25638,6 +25776,27 @@ module Aws::EC2
     #
     #   * `image-id` - The ID of the image.
     #
+    #   * `image-watermark.source-image-creation-time` - The creation date
+    #     of the source AMI, in the ISO 8601 format in the UTC time zone (`
+    #     YYYY-MM-DDTHH:MM:SS.ssssss+HH:MM `). You can use a wildcard (`*`),
+    #     for example, `2021-09-29T*`, which matches an entire day.
+    #
+    #   * `image-watermark.source-image-id` - The ID of the AMI to which the
+    #     watermark was originally attached.
+    #
+    #   * `image-watermark.source-image-region` - The Region where the
+    #     watermark was originally attached.
+    #
+    #   * `image-watermark.watermark-creation-time` - The date and time the
+    #     watermark was attached to the AMI, in the ISO 8601 format in the
+    #     UTC time zone (` YYYY-MM-DDTHH:MM:SS.ssssss+HH:MM `). You can use
+    #     a wildcard (`*`), for example, `2021-09-29T*`, which matches an
+    #     entire day.
+    #
+    #   * `image-watermark.watermark-key` - The watermark identifier, in
+    #     `accountId:watermarkName` format (for example,
+    #     `123456789012:approvedAmi`).
+    #
     #   * `image-type` - The image type (`machine` \| `kernel` \|
     #     `ramdisk`).
     #
@@ -25668,6 +25827,12 @@ module Aws::EC2
     #   * `product-code.type` - The type of the product code
     #     (`marketplace`).
     #
+    #   * `public-ssm-parameter-name` - The name of a public Systems Manager
+    #     parameter associated with the AMI. The parameter must be in a
+    #     trusted Amazon Web Services namespace under `aws/service/`.
+    #     Returns all AMIs that have ever been associated with the
+    #     parameter, including previous versions.
+    #
     #   * `ramdisk-id` - The RAM disk ID.
     #
     #   * `root-device-name` - The device name of the root device volume
@@ -34996,6 +35161,13 @@ module Aws::EC2
     #   [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Query-Requests.html#api-pagination
     #   @return [Integer]
     #
+    # @!attribute [rw] include_managed_resources
+    #   Indicates whether to include managed resources in the output. If
+    #   this parameter is set to `true`, the output includes resources that
+    #   are managed by Amazon Web Services services, even if managed
+    #   resource visibility is set to hidden.
+    #   @return [Boolean]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/DescribeVolumesModificationsRequest AWS API Documentation
     #
     class DescribeVolumesModificationsRequest < Struct.new(
@@ -35003,7 +35175,8 @@ module Aws::EC2
       :volume_ids,
       :filters,
       :next_token,
-      :max_results)
+      :max_results,
+      :include_managed_resources)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -48004,6 +48177,12 @@ module Aws::EC2
     #   allocated.
     #   @return [String]
     #
+    # @!attribute [rw] cpu_options
+    #   The CPU options for the Dedicated Host, including AMD Secure
+    #   Encrypted Virtualization-Secure Nested Paging (AMD SEV-SNP)
+    #   settings.
+    #   @return [Types::HostCpuOptions]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/Host AWS API Documentation
     #
     class Host < Struct.new(
@@ -48026,7 +48205,43 @@ module Aws::EC2
       :member_of_service_linked_resource_group,
       :outpost_arn,
       :host_maintenance,
-      :asset_id)
+      :asset_id,
+      :cpu_options)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Contains the CPU options for a Dedicated Host, including AMD Secure
+    # Encrypted Virtualization-Secure Nested Paging (AMD SEV-SNP) settings.
+    #
+    # @!attribute [rw] amd_sev_snp
+    #   Specifies whether AMD Secure Encrypted Virtualization-Secure Nested
+    #   Paging (AMD SEV-SNP) is enabled or disabled for the Dedicated Host.
+    #   If you don't specify a value, AMD SEV-SNP is `disabled`.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/HostCpuOptions AWS API Documentation
+    #
+    class HostCpuOptions < Struct.new(
+      :amd_sev_snp)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Contains the CPU configuration options for a Dedicated Host allocation
+    # request. Options include AMD Secure Encrypted Virtualization-Secure
+    # Nested Paging (AMD SEV-SNP) settings.
+    #
+    # @!attribute [rw] amd_sev_snp
+    #   Specifies whether AMD Secure Encrypted Virtualization-Secure Nested
+    #   Paging (AMD SEV-SNP) is enabled or disabled for the Dedicated Host.
+    #   If you don't specify a value, AMD SEV-SNP is `disabled`.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/HostCpuOptionsRequest AWS API Documentation
+    #
+    class HostCpuOptionsRequest < Struct.new(
+      :amd_sev_snp)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -48557,6 +48772,11 @@ module Aws::EC2
     #   * If `false`, the AMI is not eligible for Free Tier.
     #   @return [Boolean]
     #
+    # @!attribute [rw] public_ssm_parameter_name
+    #   The name of the public Systems Manager parameter that resolves to
+    #   this AMI, under the `aws/service/` namespace.
+    #   @return [String]
+    #
     # @!attribute [rw] image_watermarks
     #   The watermarks attached to the AMI.
     #   @return [Array<Types::ImageWatermark>]
@@ -48643,6 +48863,7 @@ module Aws::EC2
       :source_image_id,
       :source_image_region,
       :free_tier_eligible,
+      :public_ssm_parameter_name,
       :image_watermarks,
       :image_id,
       :image_location,
@@ -60998,6 +61219,88 @@ module Aws::EC2
       include Aws::Structure
     end
 
+    # @!attribute [rw] dry_run
+    #   Checks whether you have the required permissions for the action,
+    #   without actually making the request, and provides an error response.
+    #   If you have the required permissions, the error response is
+    #   `DryRunOperation`. Otherwise, it is `UnauthorizedOperation`.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] mode
+    #   The encryption mode for the account encryption control
+    #   configuration.
+    #   @return [String]
+    #
+    # @!attribute [rw] internet_gateway
+    #   Specifies whether to exclude internet gateway resource from
+    #   account-level encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] egress_only_internet_gateway
+    #   Specifies whether to exclude egress-only internet gateway resource
+    #   from account-level encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] nat_gateway
+    #   Specifies whether to exclude NAT gateway resource from account-level
+    #   encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] virtual_private_gateway
+    #   Specifies whether to exclude virtual private gateway resource from
+    #   account-level encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] vpc_peering
+    #   Specifies whether to exclude VPC peering connection resource from
+    #   account-level encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] lambda
+    #   Specifies whether to exclude Lambda service from account-level
+    #   encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] vpc_lattice
+    #   Specifies whether to exclude VPC Lattice service from account-level
+    #   encryption enforcement.
+    #   @return [String]
+    #
+    # @!attribute [rw] elastic_file_system
+    #   Specifies whether to exclude Elastic File System service from
+    #   account-level encryption enforcement.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyAccountVpcEncryptionControlRequest AWS API Documentation
+    #
+    class ModifyAccountVpcEncryptionControlRequest < Struct.new(
+      :dry_run,
+      :mode,
+      :internet_gateway,
+      :egress_only_internet_gateway,
+      :nat_gateway,
+      :virtual_private_gateway,
+      :vpc_peering,
+      :lambda,
+      :vpc_lattice,
+      :elastic_file_system)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] account_vpc_encryption_control
+    #   Information about the account-level VPC Encryption Control
+    #   configuration.
+    #   @return [Types::AccountVpcEncryptionControl]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/ModifyAccountVpcEncryptionControlResult AWS API Documentation
+    #
+    class ModifyAccountVpcEncryptionControlResult < Struct.new(
+      :account_vpc_encryption_control)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] allocation_id
     #   \[EC2-VPC\] The allocation ID.
     #   @return [String]
@@ -86613,6 +86916,10 @@ module Aws::EC2
     #   The modification completion or failure time.
     #   @return [Time]
     #
+    # @!attribute [rw] operator
+    #   The service provider that manages the resource.
+    #   @return [Types::OperatorResponse]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ec2-2016-11-15/VolumeModification AWS API Documentation
     #
     class VolumeModification < Struct.new(
@@ -86631,7 +86938,8 @@ module Aws::EC2
       :original_multi_attach_enabled,
       :progress,
       :start_time,
-      :end_time)
+      :end_time,
+      :operator)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-ec2.rb

@@ -78,7 +78,7 @@ module Aws::EC2
   autoload :VpcPeeringConnection, 'aws-sdk-ec2/vpc_peering_connection'
   autoload :VpcAddress, 'aws-sdk-ec2/vpc_address'
 
-  GEM_VERSION = '1.627.0'
+  GEM_VERSION = '1.629.0'
 
 end
 

data/sig/client.rbs

@@ -267,6 +267,9 @@ module Aws
                             ?host_maintenance: ("on" | "off"),
                             ?asset_ids: Array[::String],
                             ?availability_zone_id: ::String,
+                            ?cpu_options: {
+                              amd_sev_snp: ("enabled" | "disabled")?
+                            },
                             ?auto_placement: ("on" | "off"),
                             ?client_token: ::String,
                             ?instance_type: ::String,
@@ -5232,6 +5235,16 @@ module Aws
                                        ) -> _DescribeAccountAttributesResponseSuccess
                                      | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeAccountAttributesResponseSuccess
 
+      interface _DescribeAccountVpcEncryptionControlResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::DescribeAccountVpcEncryptionControlResult]
+        def account_vpc_encryption_control: () -> Types::AccountVpcEncryptionControl
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/EC2/Client.html#describe_account_vpc_encryption_control-instance_method
+      def describe_account_vpc_encryption_control: (
+                                                     ?dry_run: bool
+                                                   ) -> _DescribeAccountVpcEncryptionControlResponseSuccess
+                                                 | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeAccountVpcEncryptionControlResponseSuccess
+
       interface _DescribeAddressTransfersResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::DescribeAddressTransfersResult]
         def address_transfers: () -> ::Array[Types::AddressTransfer]
@@ -8499,7 +8512,8 @@ module Aws
                                               }
                                             ],
                                             ?next_token: ::String,
-                                            ?max_results: ::Integer
+                                            ?max_results: ::Integer,
+                                            ?include_managed_resources: bool
                                           ) -> _DescribeVolumesModificationsResponseSuccess
                                         | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeVolumesModificationsResponseSuccess
 
@@ -11193,6 +11207,25 @@ module Aws
                          ) -> _LockSnapshotResponseSuccess
                        | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _LockSnapshotResponseSuccess
 
+      interface _ModifyAccountVpcEncryptionControlResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::ModifyAccountVpcEncryptionControlResult]
+        def account_vpc_encryption_control: () -> Types::AccountVpcEncryptionControl
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/EC2/Client.html#modify_account_vpc_encryption_control-instance_method
+      def modify_account_vpc_encryption_control: (
+                                                   ?dry_run: bool,
+                                                   ?mode: ("unmanaged" | "attempt-monitor" | "attempt-enforce"),
+                                                   ?internet_gateway: ("enable" | "disable"),
+                                                   ?egress_only_internet_gateway: ("enable" | "disable"),
+                                                   ?nat_gateway: ("enable" | "disable"),
+                                                   ?virtual_private_gateway: ("enable" | "disable"),
+                                                   ?vpc_peering: ("enable" | "disable"),
+                                                   ?lambda: ("enable" | "disable"),
+                                                   ?vpc_lattice: ("enable" | "disable"),
+                                                   ?elastic_file_system: ("enable" | "disable")
+                                                 ) -> _ModifyAccountVpcEncryptionControlResponseSuccess
+                                               | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _ModifyAccountVpcEncryptionControlResponseSuccess
+
       interface _ModifyAddressAttributeResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::ModifyAddressAttributeResult]
         def address: () -> Types::AddressAttribute

data/sig/image.rbs

@@ -93,6 +93,9 @@ module Aws
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/EC2/Image.html#free_tier_eligible-instance_method
       def free_tier_eligible: () -> bool
 
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/EC2/Image.html#public_ssm_parameter_name-instance_method
+      def public_ssm_parameter_name: () -> ::String
+
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/EC2/Image.html#image_watermarks-instance_method
       def image_watermarks: () -> ::Array[Types::ImageWatermark]
 

data/sig/types.rbs

@@ -169,6 +169,27 @@ module Aws::EC2
       SENSITIVE: []
     end
 
+    class AccountVpcEncryptionControl
+      attr_accessor state: ("default-state" | "transitions-in-progress" | "transitions-partially-successful" | "transitions-successful" | "transitions-failed")
+      attr_accessor mode: ("unmanaged" | "attempt-monitor" | "attempt-enforce")
+      attr_accessor exclusions: Types::AccountVpcEncryptionControlExclusions
+      attr_accessor managed_by: ("account" | "declarative-policy")
+      attr_accessor last_update_timestamp: ::Time
+      SENSITIVE: []
+    end
+
+    class AccountVpcEncryptionControlExclusions
+      attr_accessor internet_gateway: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor egress_only_internet_gateway: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor nat_gateway: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor virtual_private_gateway: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor vpc_peering: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor lambda: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor vpc_lattice: ("enabling" | "enabled" | "disabling" | "disabled")
+      attr_accessor elastic_file_system: ("enabling" | "enabled" | "disabling" | "disabled")
+      SENSITIVE: []
+    end
+
     class ActiveInstance
       attr_accessor instance_id: ::String
       attr_accessor instance_type: ::String
@@ -309,6 +330,7 @@ module Aws::EC2
       attr_accessor host_maintenance: ("on" | "off")
       attr_accessor asset_ids: ::Array[::String]
       attr_accessor availability_zone_id: ::String
+      attr_accessor cpu_options: Types::HostCpuOptionsRequest
       attr_accessor auto_placement: ("on" | "off")
       attr_accessor client_token: ::String
       attr_accessor instance_type: ::String
@@ -5056,6 +5078,16 @@ module Aws::EC2
       SENSITIVE: []
     end
 
+    class DescribeAccountVpcEncryptionControlRequest
+      attr_accessor dry_run: bool
+      SENSITIVE: []
+    end
+
+    class DescribeAccountVpcEncryptionControlResult
+      attr_accessor account_vpc_encryption_control: Types::AccountVpcEncryptionControl
+      SENSITIVE: []
+    end
+
     class DescribeAddressTransfersRequest
       attr_accessor allocation_ids: ::Array[::String]
       attr_accessor next_token: ::String
@@ -7582,6 +7614,7 @@ module Aws::EC2
       attr_accessor filters: ::Array[Types::Filter]
       attr_accessor next_token: ::String
       attr_accessor max_results: ::Integer
+      attr_accessor include_managed_resources: bool
       SENSITIVE: []
     end
 
@@ -10612,7 +10645,7 @@ module Aws::EC2
       attr_accessor host_properties: Types::HostProperties
       attr_accessor host_reservation_id: ::String
       attr_accessor instances: ::Array[Types::HostInstance]
-      attr_accessor state: ("available" | "under-assessment" | "permanent-failure" | "released" | "released-permanent-failure" | "pending")
+      attr_accessor state: ("available" | "under-assessment" | "permanent-failure" | "released" | "released-permanent-failure" | "pending" | "configuring")
       attr_accessor allocation_time: ::Time
       attr_accessor release_time: ::Time
       attr_accessor tags: ::Array[Types::Tag]
@@ -10624,6 +10657,17 @@ module Aws::EC2
       attr_accessor outpost_arn: ::String
       attr_accessor host_maintenance: ("on" | "off")
       attr_accessor asset_id: ::String
+      attr_accessor cpu_options: Types::HostCpuOptions
+      SENSITIVE: []
+    end
+
+    class HostCpuOptions
+      attr_accessor amd_sev_snp: ("enabled" | "disabled")
+      SENSITIVE: []
+    end
+
+    class HostCpuOptionsRequest
+      attr_accessor amd_sev_snp: ("enabled" | "disabled")
       SENSITIVE: []
     end
 
@@ -10742,6 +10786,7 @@ module Aws::EC2
       attr_accessor source_image_id: ::String
       attr_accessor source_image_region: ::String
       attr_accessor free_tier_eligible: bool
+      attr_accessor public_ssm_parameter_name: ::String
       attr_accessor image_watermarks: ::Array[Types::ImageWatermark]
       attr_accessor image_id: ::String
       attr_accessor image_location: ::String
@@ -13098,6 +13143,25 @@ module Aws::EC2
       SENSITIVE: []
     end
 
+    class ModifyAccountVpcEncryptionControlRequest
+      attr_accessor dry_run: bool
+      attr_accessor mode: ("unmanaged" | "attempt-monitor" | "attempt-enforce")
+      attr_accessor internet_gateway: ("enable" | "disable")
+      attr_accessor egress_only_internet_gateway: ("enable" | "disable")
+      attr_accessor nat_gateway: ("enable" | "disable")
+      attr_accessor virtual_private_gateway: ("enable" | "disable")
+      attr_accessor vpc_peering: ("enable" | "disable")
+      attr_accessor lambda: ("enable" | "disable")
+      attr_accessor vpc_lattice: ("enable" | "disable")
+      attr_accessor elastic_file_system: ("enable" | "disable")
+      SENSITIVE: []
+    end
+
+    class ModifyAccountVpcEncryptionControlResult
+      attr_accessor account_vpc_encryption_control: Types::AccountVpcEncryptionControl
+      SENSITIVE: []
+    end
+
     class ModifyAddressAttributeRequest
       attr_accessor allocation_id: ::String
       attr_accessor domain_name: ::String
@@ -18730,6 +18794,7 @@ module Aws::EC2
       attr_accessor progress: ::Integer
       attr_accessor start_time: ::Time
       attr_accessor end_time: ::Time
+      attr_accessor operator: Types::OperatorResponse
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-ec2
 version: !ruby/object:Gem::Version
-  version: 1.627.0
+  version: 1.629.0
 platform: ruby
 authors:
 - Amazon Web Services