aws-sdk-networkfirewall 1.101.0 → 1.102.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9cf1b16591a00d56cdc829c2b68811a21f067fffa335e2d8fa8af8e992a73c9c
-  data.tar.gz: 02ea0ab221a83cafe5a9325b757082fd63c28116568e3860efd9ad0e57188877
+  metadata.gz: 8d95481e84999a06af3f932e14065ec9bcc5d3a37eb1fcfd22d9090fe8200fdc
+  data.tar.gz: db9012f7dbdd99d0fda7252f276f5911e5f54f15a1164de5047c6c88c076a210
 SHA512:
-  metadata.gz: 2cb6381ece5ab3ca33b2d4a5399a2cc6a970b841a16b6758d171be2b089485d275aab746efb12957b472b21ad7fd7e765b282ea209c88a08358bf6ab889bafe3
-  data.tar.gz: 93e989ac12407ac2a3af45b8dd3728ceb93fc87783ae407d99f63373d129a9ba84460ba2cbb7a9ced7fd806758c52f7dfb7ea430fec381257866cb8eb438bae8
+  metadata.gz: 6cfc7df260b361d403dbe64068bb3f3316beea454f69c6dc9e5f71602337462559f4e9cd81168e10c70771a71fc3dd22c5b728acd12523652199fe88105b718d
+  data.tar.gz: bedeea5a8b525d9e8499f51bcce511ce64db1395d2281120c972c4e75c966b878bbb76b1c49b1f740b01b86d4ff61828cefaa8116387cfc6561145e26c7408c6

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.102.0 (2026-10-21)
+------------------
+
+* Feature - Adds support for Network Firewall Resolved IP validation.
+
 1.101.0 (2026-10-20)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.101.0
+1.102.0

data/lib/aws-sdk-networkfirewall/client.rb

@@ -1331,6 +1331,21 @@ module Aws::NetworkFirewall
     #         },
     #       },
     #       enable_tls_session_holding: false,
+    #       route_53_resolved_ip_validation: {
+    #         action: "REJECT", # required, accepts REJECT, DROP, ALERT
+    #         dns_firewall_rule_group_id: "DNSFirewallRuleGroupId", # required
+    #         dns_expiry_exception_policy: "REJECT", # required, accepts REJECT, DROP, CONTINUE
+    #         bypass_destination_validation_ip_ranges: [
+    #           {
+    #             address_definition: "AddressDefinition", # required
+    #           },
+    #         ],
+    #         source_ip_ranges: [
+    #           {
+    #             address_definition: "AddressDefinition", # required
+    #           },
+    #         ],
+    #       },
     #     },
     #     description: "Description",
     #     tags: [
@@ -1353,7 +1368,8 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.firewall_policy_arn #=> String
     #   resp.firewall_policy_response.firewall_policy_id #=> String
     #   resp.firewall_policy_response.description #=> String
-    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
+    #   resp.firewall_policy_response.status_message #=> String
     #   resp.firewall_policy_response.tags #=> Array
     #   resp.firewall_policy_response.tags[0].key #=> String
     #   resp.firewall_policy_response.tags[0].value #=> String
@@ -1363,6 +1379,10 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.number_of_associations #=> Integer
     #   resp.firewall_policy_response.encryption_configuration.key_id #=> String
     #   resp.firewall_policy_response.encryption_configuration.type #=> String, one of "CUSTOMER_KMS", "AWS_OWNED_KMS_KEY"
+    #   resp.firewall_policy_response.errors #=> Array
+    #   resp.firewall_policy_response.errors[0].code #=> String, one of "DNS_FIREWALL_RULE_GROUP_UNAVAILABLE", "ROUTE53_RESOLVED_IP_VALIDATION_MISSING"
+    #   resp.firewall_policy_response.errors[0].message #=> String
+    #   resp.firewall_policy_response.errors[0].resource_id #=> String
     #   resp.firewall_policy_response.last_modified_time #=> Time
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/CreateFirewallPolicy AWS API Documentation
@@ -2004,7 +2024,7 @@ module Aws::NetworkFirewall
     #         rules_string: "RulesString",
     #         rules_source_list: {
     #           targets: ["CollectionMember_String"], # required
-    #           target_types: ["TLS_SNI"], # required, accepts TLS_SNI, HTTP_HOST
+    #           target_types: ["TLS_SNI"], # required, accepts TLS_SNI, HTTP_HOST, AWS_ROUTE_53_RESOLVED_DOMAIN
     #           generated_rules_type: "ALLOWLIST", # required, accepts ALLOWLIST, DENYLIST, REJECTLIST, ALERTLIST
     #         },
     #         stateful_rules: [
@@ -2120,7 +2140,7 @@ module Aws::NetworkFirewall
     #   resp.rule_group_response.description #=> String
     #   resp.rule_group_response.type #=> String, one of "STATELESS", "STATEFUL", "STATEFUL_DOMAIN"
     #   resp.rule_group_response.capacity #=> Integer
-    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.rule_group_response.tags #=> Array
     #   resp.rule_group_response.tags[0].key #=> String
     #   resp.rule_group_response.tags[0].value #=> String
@@ -2299,7 +2319,7 @@ module Aws::NetworkFirewall
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_arn #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_name #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_id #=> String
-    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.tls_inspection_configuration_response.description #=> String
     #   resp.tls_inspection_configuration_response.tags #=> Array
     #   resp.tls_inspection_configuration_response.tags[0].key #=> String
@@ -2588,7 +2608,8 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.firewall_policy_arn #=> String
     #   resp.firewall_policy_response.firewall_policy_id #=> String
     #   resp.firewall_policy_response.description #=> String
-    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
+    #   resp.firewall_policy_response.status_message #=> String
     #   resp.firewall_policy_response.tags #=> Array
     #   resp.firewall_policy_response.tags[0].key #=> String
     #   resp.firewall_policy_response.tags[0].value #=> String
@@ -2598,6 +2619,10 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.number_of_associations #=> Integer
     #   resp.firewall_policy_response.encryption_configuration.key_id #=> String
     #   resp.firewall_policy_response.encryption_configuration.type #=> String, one of "CUSTOMER_KMS", "AWS_OWNED_KMS_KEY"
+    #   resp.firewall_policy_response.errors #=> Array
+    #   resp.firewall_policy_response.errors[0].code #=> String, one of "DNS_FIREWALL_RULE_GROUP_UNAVAILABLE", "ROUTE53_RESOLVED_IP_VALIDATION_MISSING"
+    #   resp.firewall_policy_response.errors[0].message #=> String
+    #   resp.firewall_policy_response.errors[0].resource_id #=> String
     #   resp.firewall_policy_response.last_modified_time #=> Time
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/DeleteFirewallPolicy AWS API Documentation
@@ -2916,7 +2941,7 @@ module Aws::NetworkFirewall
     #   resp.rule_group_response.description #=> String
     #   resp.rule_group_response.type #=> String, one of "STATELESS", "STATEFUL", "STATEFUL_DOMAIN"
     #   resp.rule_group_response.capacity #=> Integer
-    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.rule_group_response.tags #=> Array
     #   resp.rule_group_response.tags[0].key #=> String
     #   resp.rule_group_response.tags[0].value #=> String
@@ -2974,7 +2999,7 @@ module Aws::NetworkFirewall
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_arn #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_name #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_id #=> String
-    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.tls_inspection_configuration_response.description #=> String
     #   resp.tls_inspection_configuration_response.tags #=> Array
     #   resp.tls_inspection_configuration_response.tags[0].key #=> String
@@ -3286,7 +3311,8 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.firewall_policy_arn #=> String
     #   resp.firewall_policy_response.firewall_policy_id #=> String
     #   resp.firewall_policy_response.description #=> String
-    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
+    #   resp.firewall_policy_response.status_message #=> String
     #   resp.firewall_policy_response.tags #=> Array
     #   resp.firewall_policy_response.tags[0].key #=> String
     #   resp.firewall_policy_response.tags[0].value #=> String
@@ -3296,6 +3322,10 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.number_of_associations #=> Integer
     #   resp.firewall_policy_response.encryption_configuration.key_id #=> String
     #   resp.firewall_policy_response.encryption_configuration.type #=> String, one of "CUSTOMER_KMS", "AWS_OWNED_KMS_KEY"
+    #   resp.firewall_policy_response.errors #=> Array
+    #   resp.firewall_policy_response.errors[0].code #=> String, one of "DNS_FIREWALL_RULE_GROUP_UNAVAILABLE", "ROUTE53_RESOLVED_IP_VALIDATION_MISSING"
+    #   resp.firewall_policy_response.errors[0].message #=> String
+    #   resp.firewall_policy_response.errors[0].resource_id #=> String
     #   resp.firewall_policy_response.last_modified_time #=> Time
     #   resp.firewall_policy.stateless_rule_group_references #=> Array
     #   resp.firewall_policy.stateless_rule_group_references[0].resource_arn #=> String
@@ -3323,6 +3353,18 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy.policy_variables.rule_variables["RuleVariableName"].definition #=> Array
     #   resp.firewall_policy.policy_variables.rule_variables["RuleVariableName"].definition[0] #=> String
     #   resp.firewall_policy.enable_tls_session_holding #=> Boolean
+    #   resp.firewall_policy.route_53_resolved_ip_validation.action #=> String, one of "REJECT", "DROP", "ALERT"
+    #   resp.firewall_policy.route_53_resolved_ip_validation.dns_firewall_rule_group_id #=> String
+    #   resp.firewall_policy.route_53_resolved_ip_validation.dns_expiry_exception_policy #=> String, one of "REJECT", "DROP", "CONTINUE"
+    #   resp.firewall_policy.route_53_resolved_ip_validation.bypass_destination_validation_ip_ranges #=> Array
+    #   resp.firewall_policy.route_53_resolved_ip_validation.bypass_destination_validation_ip_ranges[0].address_definition #=> String
+    #   resp.firewall_policy.route_53_resolved_ip_validation.source_ip_ranges #=> Array
+    #   resp.firewall_policy.route_53_resolved_ip_validation.source_ip_ranges[0].address_definition #=> String
+    #
+    #
+    # The following waiters are defined for this operation (see {Client#wait_until} for detailed usage):
+    #
+    #   * firewall_policy_active
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/DescribeFirewallPolicy AWS API Documentation
     #
@@ -3339,12 +3381,20 @@ module Aws::NetworkFirewall
     #   The Amazon Resource Name (ARN) of the firewall.
     #
     # @option params [String] :availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #
+    # @option params [String] :availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you coordinate
+    #   resources across accounts. Specify either `AvailabilityZone` or
+    #   `AvailabilityZoneId`, not both. If you specify both, the request
+    #   fails.
+    #
     # @option params [String] :vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #
@@ -3361,6 +3411,7 @@ module Aws::NetworkFirewall
     #
     #   * {Types::DescribeFlowOperationResponse#firewall_arn #firewall_arn} => String
     #   * {Types::DescribeFlowOperationResponse#availability_zone #availability_zone} => String
+    #   * {Types::DescribeFlowOperationResponse#availability_zone_id #availability_zone_id} => String
     #   * {Types::DescribeFlowOperationResponse#vpc_endpoint_association_arn #vpc_endpoint_association_arn} => String
     #   * {Types::DescribeFlowOperationResponse#vpc_endpoint_id #vpc_endpoint_id} => String
     #   * {Types::DescribeFlowOperationResponse#flow_operation_id #flow_operation_id} => String
@@ -3375,6 +3426,7 @@ module Aws::NetworkFirewall
     #   resp = client.describe_flow_operation({
     #     firewall_arn: "ResourceArn", # required
     #     availability_zone: "AvailabilityZone",
+    #     availability_zone_id: "AvailabilityZoneId",
     #     vpc_endpoint_association_arn: "ResourceArn",
     #     vpc_endpoint_id: "VpcEndpointId",
     #     flow_operation_id: "FlowOperationId", # required
@@ -3384,6 +3436,7 @@ module Aws::NetworkFirewall
     #
     #   resp.firewall_arn #=> String
     #   resp.availability_zone #=> String
+    #   resp.availability_zone_id #=> String
     #   resp.vpc_endpoint_association_arn #=> String
     #   resp.vpc_endpoint_id #=> String
     #   resp.flow_operation_id #=> String
@@ -3781,7 +3834,7 @@ module Aws::NetworkFirewall
     #   resp.rule_group.rules_source.rules_source_list.targets #=> Array
     #   resp.rule_group.rules_source.rules_source_list.targets[0] #=> String
     #   resp.rule_group.rules_source.rules_source_list.target_types #=> Array
-    #   resp.rule_group.rules_source.rules_source_list.target_types[0] #=> String, one of "TLS_SNI", "HTTP_HOST"
+    #   resp.rule_group.rules_source.rules_source_list.target_types[0] #=> String, one of "TLS_SNI", "HTTP_HOST", "AWS_ROUTE_53_RESOLVED_DOMAIN"
     #   resp.rule_group.rules_source.rules_source_list.generated_rules_type #=> String, one of "ALLOWLIST", "DENYLIST", "REJECTLIST", "ALERTLIST"
     #   resp.rule_group.rules_source.stateful_rules #=> Array
     #   resp.rule_group.rules_source.stateful_rules[0].action #=> String, one of "PASS", "DROP", "ALERT", "REJECT"
@@ -3827,7 +3880,7 @@ module Aws::NetworkFirewall
     #   resp.rule_group_response.description #=> String
     #   resp.rule_group_response.type #=> String, one of "STATELESS", "STATEFUL", "STATEFUL_DOMAIN"
     #   resp.rule_group_response.capacity #=> Integer
-    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.rule_group_response.tags #=> Array
     #   resp.rule_group_response.tags[0].key #=> String
     #   resp.rule_group_response.tags[0].value #=> String
@@ -4041,7 +4094,7 @@ module Aws::NetworkFirewall
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_arn #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_name #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_id #=> String
-    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.tls_inspection_configuration_response.description #=> String
     #   resp.tls_inspection_configuration_response.tags #=> Array
     #   resp.tls_inspection_configuration_response.tags[0].key #=> String
@@ -4675,12 +4728,20 @@ module Aws::NetworkFirewall
     #   subsequent call to get the next batch of objects.
     #
     # @option params [String] :availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #
+    # @option params [String] :availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you coordinate
+    #   resources across accounts. Specify either `AvailabilityZone` or
+    #   `AvailabilityZoneId`, not both. If you specify both, the request
+    #   fails.
+    #
     # @option params [String] :vpc_endpoint_id
     #   A unique identifier for the primary endpoint associated with a
     #   firewall.
@@ -4692,6 +4753,7 @@ module Aws::NetworkFirewall
     #
     #   * {Types::ListFlowOperationResultsResponse#firewall_arn #firewall_arn} => String
     #   * {Types::ListFlowOperationResultsResponse#availability_zone #availability_zone} => String
+    #   * {Types::ListFlowOperationResultsResponse#availability_zone_id #availability_zone_id} => String
     #   * {Types::ListFlowOperationResultsResponse#vpc_endpoint_association_arn #vpc_endpoint_association_arn} => String
     #   * {Types::ListFlowOperationResultsResponse#vpc_endpoint_id #vpc_endpoint_id} => String
     #   * {Types::ListFlowOperationResultsResponse#flow_operation_id #flow_operation_id} => String
@@ -4711,6 +4773,7 @@ module Aws::NetworkFirewall
     #     next_token: "PaginationToken",
     #     max_results: 1,
     #     availability_zone: "AvailabilityZone",
+    #     availability_zone_id: "AvailabilityZoneId",
     #     vpc_endpoint_id: "VpcEndpointId",
     #     vpc_endpoint_association_arn: "ResourceArn",
     #   })
@@ -4719,6 +4782,7 @@ module Aws::NetworkFirewall
     #
     #   resp.firewall_arn #=> String
     #   resp.availability_zone #=> String
+    #   resp.availability_zone_id #=> String
     #   resp.vpc_endpoint_association_arn #=> String
     #   resp.vpc_endpoint_id #=> String
     #   resp.flow_operation_id #=> String
@@ -4762,12 +4826,20 @@ module Aws::NetworkFirewall
     #   The Amazon Resource Name (ARN) of the firewall.
     #
     # @option params [String] :availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #
+    # @option params [String] :availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you coordinate
+    #   resources across accounts. Specify either `AvailabilityZone` or
+    #   `AvailabilityZoneId`, not both. If you specify both, the request
+    #   fails.
+    #
     # @option params [String] :vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #
@@ -4804,6 +4876,7 @@ module Aws::NetworkFirewall
     #   resp = client.list_flow_operations({
     #     firewall_arn: "ResourceArn", # required
     #     availability_zone: "AvailabilityZone",
+    #     availability_zone_id: "AvailabilityZoneId",
     #     vpc_endpoint_association_arn: "ResourceArn",
     #     vpc_endpoint_id: "VpcEndpointId",
     #     flow_operation_type: "FLOW_FLUSH", # accepts FLOW_FLUSH, FLOW_CAPTURE
@@ -5409,12 +5482,20 @@ module Aws::NetworkFirewall
     #   The Amazon Resource Name (ARN) of the firewall.
     #
     # @option params [String] :availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #
+    # @option params [String] :availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you coordinate
+    #   resources across accounts. Specify either `AvailabilityZone` or
+    #   `AvailabilityZoneId`, not both. If you specify both, the request
+    #   fails.
+    #
     # @option params [String] :vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #
@@ -5447,6 +5528,7 @@ module Aws::NetworkFirewall
     #   resp = client.start_flow_capture({
     #     firewall_arn: "ResourceArn", # required
     #     availability_zone: "AvailabilityZone",
+    #     availability_zone_id: "AvailabilityZoneId",
     #     vpc_endpoint_association_arn: "ResourceArn",
     #     vpc_endpoint_id: "VpcEndpointId",
     #     minimum_flow_age_in_seconds: 1,
@@ -5494,12 +5576,20 @@ module Aws::NetworkFirewall
     #   The Amazon Resource Name (ARN) of the firewall.
     #
     # @option params [String] :availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #
+    # @option params [String] :availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you coordinate
+    #   resources across accounts. Specify either `AvailabilityZone` or
+    #   `AvailabilityZoneId`, not both. If you specify both, the request
+    #   fails.
+    #
     # @option params [String] :vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #
@@ -5527,6 +5617,7 @@ module Aws::NetworkFirewall
     #   resp = client.start_flow_flush({
     #     firewall_arn: "ResourceArn", # required
     #     availability_zone: "AvailabilityZone",
+    #     availability_zone_id: "AvailabilityZoneId",
     #     vpc_endpoint_association_arn: "ResourceArn",
     #     vpc_endpoint_id: "VpcEndpointId",
     #     minimum_flow_age_in_seconds: 1,
@@ -6233,6 +6324,21 @@ module Aws::NetworkFirewall
     #         },
     #       },
     #       enable_tls_session_holding: false,
+    #       route_53_resolved_ip_validation: {
+    #         action: "REJECT", # required, accepts REJECT, DROP, ALERT
+    #         dns_firewall_rule_group_id: "DNSFirewallRuleGroupId", # required
+    #         dns_expiry_exception_policy: "REJECT", # required, accepts REJECT, DROP, CONTINUE
+    #         bypass_destination_validation_ip_ranges: [
+    #           {
+    #             address_definition: "AddressDefinition", # required
+    #           },
+    #         ],
+    #         source_ip_ranges: [
+    #           {
+    #             address_definition: "AddressDefinition", # required
+    #           },
+    #         ],
+    #       },
     #     },
     #     description: "Description",
     #     dry_run: false,
@@ -6249,7 +6355,8 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.firewall_policy_arn #=> String
     #   resp.firewall_policy_response.firewall_policy_id #=> String
     #   resp.firewall_policy_response.description #=> String
-    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.firewall_policy_response.firewall_policy_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
+    #   resp.firewall_policy_response.status_message #=> String
     #   resp.firewall_policy_response.tags #=> Array
     #   resp.firewall_policy_response.tags[0].key #=> String
     #   resp.firewall_policy_response.tags[0].value #=> String
@@ -6259,6 +6366,10 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy_response.number_of_associations #=> Integer
     #   resp.firewall_policy_response.encryption_configuration.key_id #=> String
     #   resp.firewall_policy_response.encryption_configuration.type #=> String, one of "CUSTOMER_KMS", "AWS_OWNED_KMS_KEY"
+    #   resp.firewall_policy_response.errors #=> Array
+    #   resp.firewall_policy_response.errors[0].code #=> String, one of "DNS_FIREWALL_RULE_GROUP_UNAVAILABLE", "ROUTE53_RESOLVED_IP_VALIDATION_MISSING"
+    #   resp.firewall_policy_response.errors[0].message #=> String
+    #   resp.firewall_policy_response.errors[0].resource_id #=> String
     #   resp.firewall_policy_response.last_modified_time #=> Time
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/UpdateFirewallPolicy AWS API Documentation
@@ -7087,7 +7198,7 @@ module Aws::NetworkFirewall
     #         rules_string: "RulesString",
     #         rules_source_list: {
     #           targets: ["CollectionMember_String"], # required
-    #           target_types: ["TLS_SNI"], # required, accepts TLS_SNI, HTTP_HOST
+    #           target_types: ["TLS_SNI"], # required, accepts TLS_SNI, HTTP_HOST, AWS_ROUTE_53_RESOLVED_DOMAIN
     #           generated_rules_type: "ALLOWLIST", # required, accepts ALLOWLIST, DENYLIST, REJECTLIST, ALERTLIST
     #         },
     #         stateful_rules: [
@@ -7196,7 +7307,7 @@ module Aws::NetworkFirewall
     #   resp.rule_group_response.description #=> String
     #   resp.rule_group_response.type #=> String, one of "STATELESS", "STATEFUL", "STATEFUL_DOMAIN"
     #   resp.rule_group_response.capacity #=> Integer
-    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.rule_group_response.rule_group_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.rule_group_response.tags #=> Array
     #   resp.rule_group_response.tags[0].key #=> String
     #   resp.rule_group_response.tags[0].value #=> String
@@ -7425,7 +7536,7 @@ module Aws::NetworkFirewall
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_arn #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_name #=> String
     #   resp.tls_inspection_configuration_response.tls_inspection_configuration_id #=> String
-    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR"
+    #   resp.tls_inspection_configuration_response.tls_inspection_configuration_status #=> String, one of "ACTIVE", "DELETING", "ERROR", "UPDATING"
     #   resp.tls_inspection_configuration_response.description #=> String
     #   resp.tls_inspection_configuration_response.tags #=> Array
     #   resp.tls_inspection_configuration_response.tags[0].key #=> String
@@ -7471,14 +7582,127 @@ module Aws::NetworkFirewall
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-networkfirewall'
-      context[:gem_version] = '1.101.0'
+      context[:gem_version] = '1.102.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 
+    # Polls an API operation until a resource enters a desired state.
+    #
+    # ## Basic Usage
+    #
+    # A waiter will call an API operation until:
+    #
+    # * It is successful
+    # * It enters a terminal state
+    # * It makes the maximum number of attempts
+    #
+    # In between attempts, the waiter will sleep.
+    #
+    #     # polls in a loop, sleeping between attempts
+    #     client.wait_until(waiter_name, params)
+    #
+    # ## Configuration
+    #
+    # You can configure the maximum number of polling attempts, and the
+    # delay (in seconds) between each polling attempt. You can pass
+    # configuration as the final arguments hash.
+    #
+    #     # poll for ~25 seconds
+    #     client.wait_until(waiter_name, params, {
+    #       max_attempts: 5,
+    #       delay: 5,
+    #     })
+    #
+    # ## Callbacks
+    #
+    # You can be notified before each polling attempt and before each
+    # delay. If you throw `:success` or `:failure` from these callbacks,
+    # it will terminate the waiter.
+    #
+    #     started_at = Time.now
+    #     client.wait_until(waiter_name, params, {
+    #
+    #       # disable max attempts
+    #       max_attempts: nil,
+    #
+    #       # poll for 1 hour, instead of a number of attempts
+    #       before_wait: -> (attempts, response) do
+    #         throw :failure if Time.now - started_at > 3600
+    #       end
+    #     })
+    #
+    # ## Handling Errors
+    #
+    # When a waiter is unsuccessful, it will raise an error.
+    # All of the failure errors extend from
+    # {Aws::Waiters::Errors::WaiterFailed}.
+    #
+    #     begin
+    #       client.wait_until(...)
+    #     rescue Aws::Waiters::Errors::WaiterFailed
+    #       # resource did not enter the desired state in time
+    #     end
+    #
+    # ## Valid Waiters
+    #
+    # The following table lists the valid waiter names, the operations they call,
+    # and the default `:delay` and `:max_attempts` values.
+    #
+    # | waiter_name            | params                            | :delay   | :max_attempts |
+    # | ---------------------- | --------------------------------- | -------- | ------------- |
+    # | firewall_policy_active | {Client#describe_firewall_policy} | 15       | 40            |
+    #
+    # @raise [Errors::FailureStateError] Raised when the waiter terminates
+    #   because the waiter has entered a state that it will not transition
+    #   out of, preventing success.
+    #
+    # @raise [Errors::TooManyAttemptsError] Raised when the configured
+    #   maximum number of attempts have been made, and the waiter is not
+    #   yet successful.
+    #
+    # @raise [Errors::UnexpectedError] Raised when an error is encounted
+    #   while polling for a resource that is not expected.
+    #
+    # @raise [Errors::NoSuchWaiterError] Raised when you request to wait
+    #   for an unknown state.
+    #
+    # @return [Boolean] Returns `true` if the waiter was successful.
+    # @param [Symbol] waiter_name
+    # @param [Hash] params ({})
+    # @param [Hash] options ({})
+    # @option options [Integer] :max_attempts
+    # @option options [Integer] :delay
+    # @option options [Proc] :before_attempt
+    # @option options [Proc] :before_wait
+    def wait_until(waiter_name, params = {}, options = {})
+      w = waiter(waiter_name, options)
+      yield(w.waiter) if block_given? # deprecated
+      w.wait(params)
+    end
+
     # @api private
     # @deprecated
     def waiter_names
-      []
+      waiters.keys
+    end
+
+    private
+
+    # @param [Symbol] waiter_name
+    # @param [Hash] options ({})
+    def waiter(waiter_name, options = {})
+      waiter_class = waiters[waiter_name]
+      if waiter_class
+        waiter_class.new(options.merge(client: self))
+      else
+        raise Aws::Waiters::Errors::NoSuchWaiterError.new(waiter_name, waiters.keys)
+      end
+    end
+
+    def waiters
+      {
+        firewall_policy_active: Waiters::FirewallPolicyActive
+      }
     end
 
     class << self