aws-sdk-ssm 1.103.0 → 1.108.0

data/lib/aws-sdk-ssm/client_api.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 
@@ -117,6 +117,7 @@ module Aws::SSM
     BaselineDescription = Shapes::StringShape.new(name: 'BaselineDescription')
     BaselineId = Shapes::StringShape.new(name: 'BaselineId')
     BaselineName = Shapes::StringShape.new(name: 'BaselineName')
+    BaselineOverride = Shapes::StructureShape.new(name: 'BaselineOverride')
     BatchErrorMessage = Shapes::StringShape.new(name: 'BatchErrorMessage')
     Boolean = Shapes::BooleanShape.new(name: 'Boolean')
     CalendarNameOrARN = Shapes::StringShape.new(name: 'CalendarNameOrARN')
@@ -126,6 +127,7 @@ module Aws::SSM
     CancelCommandResult = Shapes::StructureShape.new(name: 'CancelCommandResult')
     CancelMaintenanceWindowExecutionRequest = Shapes::StructureShape.new(name: 'CancelMaintenanceWindowExecutionRequest')
     CancelMaintenanceWindowExecutionResult = Shapes::StructureShape.new(name: 'CancelMaintenanceWindowExecutionResult')
+    ChangeDetailsValue = Shapes::StringShape.new(name: 'ChangeDetailsValue')
     ChangeRequestName = Shapes::StringShape.new(name: 'ChangeRequestName')
     ClientToken = Shapes::StringShape.new(name: 'ClientToken')
     CloudWatchLogGroupName = Shapes::StringShape.new(name: 'CloudWatchLogGroupName')
@@ -843,6 +845,7 @@ module Aws::SSM
     PatchComplianceLevel = Shapes::StringShape.new(name: 'PatchComplianceLevel')
     PatchComplianceMaxResults = Shapes::IntegerShape.new(name: 'PatchComplianceMaxResults')
     PatchContentUrl = Shapes::StringShape.new(name: 'PatchContentUrl')
+    PatchCriticalNonCompliantCount = Shapes::IntegerShape.new(name: 'PatchCriticalNonCompliantCount')
     PatchDeploymentStatus = Shapes::StringShape.new(name: 'PatchDeploymentStatus')
     PatchDescription = Shapes::StringShape.new(name: 'PatchDescription')
     PatchEpoch = Shapes::IntegerShape.new(name: 'PatchEpoch')
@@ -877,6 +880,7 @@ module Aws::SSM
     PatchOrchestratorFilterList = Shapes::ListShape.new(name: 'PatchOrchestratorFilterList')
     PatchOrchestratorFilterValue = Shapes::StringShape.new(name: 'PatchOrchestratorFilterValue')
     PatchOrchestratorFilterValues = Shapes::ListShape.new(name: 'PatchOrchestratorFilterValues')
+    PatchOtherNonCompliantCount = Shapes::IntegerShape.new(name: 'PatchOtherNonCompliantCount')
     PatchProduct = Shapes::StringShape.new(name: 'PatchProduct')
     PatchProductFamily = Shapes::StringShape.new(name: 'PatchProductFamily')
     PatchPropertiesList = Shapes::ListShape.new(name: 'PatchPropertiesList')
@@ -887,6 +891,7 @@ module Aws::SSM
     PatchRule = Shapes::StructureShape.new(name: 'PatchRule')
     PatchRuleGroup = Shapes::StructureShape.new(name: 'PatchRuleGroup')
     PatchRuleList = Shapes::ListShape.new(name: 'PatchRuleList')
+    PatchSecurityNonCompliantCount = Shapes::IntegerShape.new(name: 'PatchSecurityNonCompliantCount')
     PatchSet = Shapes::StringShape.new(name: 'PatchSet')
     PatchSeverity = Shapes::StringShape.new(name: 'PatchSeverity')
     PatchSource = Shapes::StructureShape.new(name: 'PatchSource')
@@ -947,6 +952,7 @@ module Aws::SSM
     ResourceDataSyncCreatedTime = Shapes::TimestampShape.new(name: 'ResourceDataSyncCreatedTime')
     ResourceDataSyncDestinationDataSharing = Shapes::StructureShape.new(name: 'ResourceDataSyncDestinationDataSharing')
     ResourceDataSyncDestinationDataSharingType = Shapes::StringShape.new(name: 'ResourceDataSyncDestinationDataSharingType')
+    ResourceDataSyncEnableAllOpsDataSources = Shapes::BooleanShape.new(name: 'ResourceDataSyncEnableAllOpsDataSources')
     ResourceDataSyncIncludeFutureRegions = Shapes::BooleanShape.new(name: 'ResourceDataSyncIncludeFutureRegions')
     ResourceDataSyncInvalidConfigurationException = Shapes::StructureShape.new(name: 'ResourceDataSyncInvalidConfigurationException')
     ResourceDataSyncItem = Shapes::StructureShape.new(name: 'ResourceDataSyncItem')
@@ -1088,6 +1094,8 @@ module Aws::SSM
     TotalCount = Shapes::IntegerShape.new(name: 'TotalCount')
     TotalSizeLimitExceededException = Shapes::StructureShape.new(name: 'TotalSizeLimitExceededException')
     UUID = Shapes::StringShape.new(name: 'UUID')
+    UnlabelParameterVersionRequest = Shapes::StructureShape.new(name: 'UnlabelParameterVersionRequest')
+    UnlabelParameterVersionResult = Shapes::StructureShape.new(name: 'UnlabelParameterVersionResult')
     UnsupportedCalendarException = Shapes::StructureShape.new(name: 'UnsupportedCalendarException')
     UnsupportedFeatureRequiredException = Shapes::StructureShape.new(name: 'UnsupportedFeatureRequiredException')
     UnsupportedInventoryItemContextException = Shapes::StructureShape.new(name: 'UnsupportedInventoryItemContextException')
@@ -1417,6 +1425,17 @@ module Aws::SSM
     AutomationStepNotFoundException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
     AutomationStepNotFoundException.struct_class = Types::AutomationStepNotFoundException
 
+    BaselineOverride.add_member(:operating_system, Shapes::ShapeRef.new(shape: OperatingSystem, location_name: "OperatingSystem"))
+    BaselineOverride.add_member(:global_filters, Shapes::ShapeRef.new(shape: PatchFilterGroup, location_name: "GlobalFilters"))
+    BaselineOverride.add_member(:approval_rules, Shapes::ShapeRef.new(shape: PatchRuleGroup, location_name: "ApprovalRules"))
+    BaselineOverride.add_member(:approved_patches, Shapes::ShapeRef.new(shape: PatchIdList, location_name: "ApprovedPatches"))
+    BaselineOverride.add_member(:approved_patches_compliance_level, Shapes::ShapeRef.new(shape: PatchComplianceLevel, location_name: "ApprovedPatchesComplianceLevel"))
+    BaselineOverride.add_member(:rejected_patches, Shapes::ShapeRef.new(shape: PatchIdList, location_name: "RejectedPatches"))
+    BaselineOverride.add_member(:rejected_patches_action, Shapes::ShapeRef.new(shape: PatchAction, location_name: "RejectedPatchesAction"))
+    BaselineOverride.add_member(:approved_patches_enable_non_security, Shapes::ShapeRef.new(shape: Boolean, location_name: "ApprovedPatchesEnableNonSecurity"))
+    BaselineOverride.add_member(:sources, Shapes::ShapeRef.new(shape: PatchSourceList, location_name: "Sources"))
+    BaselineOverride.struct_class = Types::BaselineOverride
+
     CalendarNameOrARNList.member = Shapes::ShapeRef.new(shape: CalendarNameOrARN)
 
     CancelCommandRequest.add_member(:command_id, Shapes::ShapeRef.new(shape: CommandId, required: true, location_name: "CommandId"))
@@ -1673,6 +1692,7 @@ module Aws::SSM
 
     CreateOpsMetadataRequest.add_member(:resource_id, Shapes::ShapeRef.new(shape: OpsMetadataResourceId, required: true, location_name: "ResourceId"))
     CreateOpsMetadataRequest.add_member(:metadata, Shapes::ShapeRef.new(shape: MetadataMap, location_name: "Metadata"))
+    CreateOpsMetadataRequest.add_member(:tags, Shapes::ShapeRef.new(shape: TagList, location_name: "Tags"))
     CreateOpsMetadataRequest.struct_class = Types::CreateOpsMetadataRequest
 
     CreateOpsMetadataResult.add_member(:ops_metadata_arn, Shapes::ShapeRef.new(shape: OpsMetadataArn, location_name: "OpsMetadataArn"))
@@ -2093,6 +2113,9 @@ module Aws::SSM
     DescribePatchGroupStateResult.add_member(:instances_with_failed_patches, Shapes::ShapeRef.new(shape: Integer, location_name: "InstancesWithFailedPatches"))
     DescribePatchGroupStateResult.add_member(:instances_with_not_applicable_patches, Shapes::ShapeRef.new(shape: Integer, location_name: "InstancesWithNotApplicablePatches"))
     DescribePatchGroupStateResult.add_member(:instances_with_unreported_not_applicable_patches, Shapes::ShapeRef.new(shape: Integer, location_name: "InstancesWithUnreportedNotApplicablePatches", metadata: {"box"=>true}))
+    DescribePatchGroupStateResult.add_member(:instances_with_critical_non_compliant_patches, Shapes::ShapeRef.new(shape: InstancesCount, location_name: "InstancesWithCriticalNonCompliantPatches", metadata: {"box"=>true}))
+    DescribePatchGroupStateResult.add_member(:instances_with_security_non_compliant_patches, Shapes::ShapeRef.new(shape: InstancesCount, location_name: "InstancesWithSecurityNonCompliantPatches", metadata: {"box"=>true}))
+    DescribePatchGroupStateResult.add_member(:instances_with_other_non_compliant_patches, Shapes::ShapeRef.new(shape: InstancesCount, location_name: "InstancesWithOtherNonCompliantPatches", metadata: {"box"=>true}))
     DescribePatchGroupStateResult.struct_class = Types::DescribePatchGroupStateResult
 
     DescribePatchGroupsRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: PatchBaselineMaxResults, location_name: "MaxResults", metadata: {"box"=>true}))
@@ -2338,6 +2361,7 @@ module Aws::SSM
 
     GetDeployablePatchSnapshotForInstanceRequest.add_member(:instance_id, Shapes::ShapeRef.new(shape: InstanceId, required: true, location_name: "InstanceId"))
     GetDeployablePatchSnapshotForInstanceRequest.add_member(:snapshot_id, Shapes::ShapeRef.new(shape: SnapshotId, required: true, location_name: "SnapshotId"))
+    GetDeployablePatchSnapshotForInstanceRequest.add_member(:baseline_override, Shapes::ShapeRef.new(shape: BaselineOverride, location_name: "BaselineOverride"))
     GetDeployablePatchSnapshotForInstanceRequest.struct_class = Types::GetDeployablePatchSnapshotForInstanceRequest
 
     GetDeployablePatchSnapshotForInstanceResult.add_member(:instance_id, Shapes::ShapeRef.new(shape: InstanceId, location_name: "InstanceId"))
@@ -2683,6 +2707,9 @@ module Aws::SSM
     InstancePatchState.add_member(:operation, Shapes::ShapeRef.new(shape: PatchOperationType, required: true, location_name: "Operation"))
     InstancePatchState.add_member(:last_no_reboot_install_operation_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "LastNoRebootInstallOperationTime"))
     InstancePatchState.add_member(:reboot_option, Shapes::ShapeRef.new(shape: RebootOption, location_name: "RebootOption"))
+    InstancePatchState.add_member(:critical_non_compliant_count, Shapes::ShapeRef.new(shape: PatchCriticalNonCompliantCount, location_name: "CriticalNonCompliantCount", metadata: {"box"=>true}))
+    InstancePatchState.add_member(:security_non_compliant_count, Shapes::ShapeRef.new(shape: PatchSecurityNonCompliantCount, location_name: "SecurityNonCompliantCount", metadata: {"box"=>true}))
+    InstancePatchState.add_member(:other_non_compliant_count, Shapes::ShapeRef.new(shape: PatchOtherNonCompliantCount, location_name: "OtherNonCompliantCount", metadata: {"box"=>true}))
     InstancePatchState.struct_class = Types::InstancePatchState
 
     InstancePatchStateFilter.add_member(:key, Shapes::ShapeRef.new(shape: InstancePatchStateFilterKey, required: true, location_name: "Key"))
@@ -3869,6 +3896,7 @@ module Aws::SSM
     ResourceDataSyncSource.add_member(:aws_organizations_source, Shapes::ShapeRef.new(shape: ResourceDataSyncAwsOrganizationsSource, location_name: "AwsOrganizationsSource"))
     ResourceDataSyncSource.add_member(:source_regions, Shapes::ShapeRef.new(shape: ResourceDataSyncSourceRegionList, required: true, location_name: "SourceRegions"))
     ResourceDataSyncSource.add_member(:include_future_regions, Shapes::ShapeRef.new(shape: ResourceDataSyncIncludeFutureRegions, location_name: "IncludeFutureRegions"))
+    ResourceDataSyncSource.add_member(:enable_all_ops_data_sources, Shapes::ShapeRef.new(shape: ResourceDataSyncEnableAllOpsDataSources, location_name: "EnableAllOpsDataSources"))
     ResourceDataSyncSource.struct_class = Types::ResourceDataSyncSource
 
     ResourceDataSyncSourceRegionList.member = Shapes::ShapeRef.new(shape: ResourceDataSyncSourceRegion)
@@ -3878,6 +3906,7 @@ module Aws::SSM
     ResourceDataSyncSourceWithState.add_member(:source_regions, Shapes::ShapeRef.new(shape: ResourceDataSyncSourceRegionList, location_name: "SourceRegions"))
     ResourceDataSyncSourceWithState.add_member(:include_future_regions, Shapes::ShapeRef.new(shape: ResourceDataSyncIncludeFutureRegions, location_name: "IncludeFutureRegions"))
     ResourceDataSyncSourceWithState.add_member(:state, Shapes::ShapeRef.new(shape: ResourceDataSyncState, location_name: "State"))
+    ResourceDataSyncSourceWithState.add_member(:enable_all_ops_data_sources, Shapes::ShapeRef.new(shape: ResourceDataSyncEnableAllOpsDataSources, location_name: "EnableAllOpsDataSources"))
     ResourceDataSyncSourceWithState.struct_class = Types::ResourceDataSyncSourceWithState
 
     ResourceInUseException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
@@ -4039,6 +4068,8 @@ module Aws::SSM
     StartChangeRequestExecutionRequest.add_member(:client_token, Shapes::ShapeRef.new(shape: IdempotencyToken, location_name: "ClientToken"))
     StartChangeRequestExecutionRequest.add_member(:runbooks, Shapes::ShapeRef.new(shape: Runbooks, required: true, location_name: "Runbooks"))
     StartChangeRequestExecutionRequest.add_member(:tags, Shapes::ShapeRef.new(shape: TagList, location_name: "Tags"))
+    StartChangeRequestExecutionRequest.add_member(:scheduled_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "ScheduledEndTime"))
+    StartChangeRequestExecutionRequest.add_member(:change_details, Shapes::ShapeRef.new(shape: ChangeDetailsValue, location_name: "ChangeDetails"))
     StartChangeRequestExecutionRequest.struct_class = Types::StartChangeRequestExecutionRequest
 
     StartChangeRequestExecutionResult.add_member(:automation_execution_id, Shapes::ShapeRef.new(shape: AutomationExecutionId, location_name: "AutomationExecutionId"))
@@ -4153,6 +4184,15 @@ module Aws::SSM
     TotalSizeLimitExceededException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
     TotalSizeLimitExceededException.struct_class = Types::TotalSizeLimitExceededException
 
+    UnlabelParameterVersionRequest.add_member(:name, Shapes::ShapeRef.new(shape: PSParameterName, required: true, location_name: "Name"))
+    UnlabelParameterVersionRequest.add_member(:parameter_version, Shapes::ShapeRef.new(shape: PSParameterVersion, required: true, location_name: "ParameterVersion", metadata: {"box"=>true}))
+    UnlabelParameterVersionRequest.add_member(:labels, Shapes::ShapeRef.new(shape: ParameterLabelList, required: true, location_name: "Labels"))
+    UnlabelParameterVersionRequest.struct_class = Types::UnlabelParameterVersionRequest
+
+    UnlabelParameterVersionResult.add_member(:removed_labels, Shapes::ShapeRef.new(shape: ParameterLabelList, location_name: "RemovedLabels"))
+    UnlabelParameterVersionResult.add_member(:invalid_labels, Shapes::ShapeRef.new(shape: ParameterLabelList, location_name: "InvalidLabels"))
+    UnlabelParameterVersionResult.struct_class = Types::UnlabelParameterVersionResult
+
     UnsupportedCalendarException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
     UnsupportedCalendarException.struct_class = Types::UnsupportedCalendarException
 
@@ -6029,6 +6069,18 @@ module Aws::SSM
         o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
       end)
 
+      api.add_operation(:unlabel_parameter_version, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "UnlabelParameterVersion"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: UnlabelParameterVersionRequest)
+        o.output = Shapes::ShapeRef.new(shape: UnlabelParameterVersionResult)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyUpdates)
+        o.errors << Shapes::ShapeRef.new(shape: ParameterNotFound)
+        o.errors << Shapes::ShapeRef.new(shape: ParameterVersionNotFound)
+      end)
+
       api.add_operation(:update_association, Seahorse::Model::Operation.new.tap do |o|
         o.name = "UpdateAssociation"
         o.http_method = "POST"

data/lib/aws-sdk-ssm/customizations.rb

@@ -2,7 +2,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing for info on making contributions:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-ssm/errors.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-ssm/resource.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 

data/lib/aws-sdk-ssm/types.rb

@@ -3,7 +3,7 @@
 # WARNING ABOUT GENERATED CODE
 #
 # This file is generated. See the contributing guide for more information:
-# https://github.com/aws/aws-sdk-ruby/blob/master/CONTRIBUTING.md
+# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
 #
 # WARNING ABOUT GENERATED CODE
 
@@ -100,7 +100,7 @@ module Aws::SSM
     #   data as a hash:
     #
     #       {
-    #         resource_type: "Document", # required, accepts Document, ManagedInstance, MaintenanceWindow, Parameter, PatchBaseline, OpsItem
+    #         resource_type: "Document", # required, accepts Document, ManagedInstance, MaintenanceWindow, Parameter, PatchBaseline, OpsItem, OpsMetadata
     #         resource_id: "ResourceId", # required
     #         tags: [ # required
     #           {
@@ -132,6 +132,15 @@ module Aws::SSM
     #
     #   PatchBaseline: pb-012345abcde
     #
+    #   OpsMetadata object: `ResourceID` for tagging is created from the
+    #   Amazon Resource Name (ARN) for the object. Specifically,
+    #   `ResourceID` is created from the strings that come after the word
+    #   `opsmetadata` in the ARN. For example, an OpsMetadata object with an
+    #   ARN of
+    #   `arn:aws:ssm:us-east-2:1234567890:opsmetadata/aws/ssm/MyGroup/appmanager`
+    #   has a `ResourceID` of either `aws/ssm/MyGroup/appmanager` or
+    #   `/aws/ssm/MyGroup/appmanager`.
+    #
     #   For the Document and Parameter values, use the name of the resource.
     #
     #   <note markdown="1"> The ManagedInstance type for this API action is only for on-premises
@@ -143,9 +152,7 @@ module Aws::SSM
     #   @return [String]
     #
     # @!attribute [rw] tags
-    #   One or more tags. The value parameter is required, but if you don't
-    #   want the tag to have a value, specify the parameter with no value,
-    #   and we set the value to an empty string.
+    #   One or more tags. The value parameter is required.
     #
     #   Do not enter personally identifiable information in this field.
     #   @return [Array<Types::Tag>]
@@ -225,7 +232,7 @@ module Aws::SSM
     #
     # @!attribute [rw] schedule_expression
     #   A cron expression that specifies a schedule when the association
-    #   runs.
+    #   runs. The schedule runs in Coordinated Universal Time (UTC).
     #   @return [String]
     #
     # @!attribute [rw] association_name
@@ -1449,6 +1456,132 @@ module Aws::SSM
       include Aws::Structure
     end
 
+    # Defines the basic information about a patch baseline override.
+    #
+    # @note When making an API call, you may pass BaselineOverride
+    #   data as a hash:
+    #
+    #       {
+    #         operating_system: "WINDOWS", # accepts WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, CENTOS, ORACLE_LINUX, DEBIAN, MACOS
+    #         global_filters: {
+    #           patch_filters: [ # required
+    #             {
+    #               key: "ARCH", # required, accepts ARCH, ADVISORY_ID, BUGZILLA_ID, PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, CVE_ID, EPOCH, MSRC_SEVERITY, NAME, PATCH_ID, SECTION, PRIORITY, REPOSITORY, RELEASE, SEVERITY, SECURITY, VERSION
+    #               values: ["PatchFilterValue"], # required
+    #             },
+    #           ],
+    #         },
+    #         approval_rules: {
+    #           patch_rules: [ # required
+    #             {
+    #               patch_filter_group: { # required
+    #                 patch_filters: [ # required
+    #                   {
+    #                     key: "ARCH", # required, accepts ARCH, ADVISORY_ID, BUGZILLA_ID, PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, CVE_ID, EPOCH, MSRC_SEVERITY, NAME, PATCH_ID, SECTION, PRIORITY, REPOSITORY, RELEASE, SEVERITY, SECURITY, VERSION
+    #                     values: ["PatchFilterValue"], # required
+    #                   },
+    #                 ],
+    #               },
+    #               compliance_level: "CRITICAL", # accepts CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED
+    #               approve_after_days: 1,
+    #               approve_until_date: "PatchStringDateTime",
+    #               enable_non_security: false,
+    #             },
+    #           ],
+    #         },
+    #         approved_patches: ["PatchId"],
+    #         approved_patches_compliance_level: "CRITICAL", # accepts CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED
+    #         rejected_patches: ["PatchId"],
+    #         rejected_patches_action: "ALLOW_AS_DEPENDENCY", # accepts ALLOW_AS_DEPENDENCY, BLOCK
+    #         approved_patches_enable_non_security: false,
+    #         sources: [
+    #           {
+    #             name: "PatchSourceName", # required
+    #             products: ["PatchSourceProduct"], # required
+    #             configuration: "PatchSourceConfiguration", # required
+    #           },
+    #         ],
+    #       }
+    #
+    # @!attribute [rw] operating_system
+    #   The operating system rule used by the patch baseline override.
+    #   @return [String]
+    #
+    # @!attribute [rw] global_filters
+    #   A set of patch filters, typically used for approval rules.
+    #   @return [Types::PatchFilterGroup]
+    #
+    # @!attribute [rw] approval_rules
+    #   A set of rules defining the approval rules for a patch baseline.
+    #   @return [Types::PatchRuleGroup]
+    #
+    # @!attribute [rw] approved_patches
+    #   A list of explicitly approved patches for the baseline.
+    #
+    #   For information about accepted formats for lists of approved patches
+    #   and rejected patches, see [About package name formats for approved
+    #   and rejected patch lists][1] in the *AWS Systems Manager User
+    #   Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] approved_patches_compliance_level
+    #   Defines the compliance level for approved patches. When an approved
+    #   patch is reported as missing, this value describes the severity of
+    #   the compliance violation.
+    #   @return [String]
+    #
+    # @!attribute [rw] rejected_patches
+    #   A list of explicitly rejected patches for the baseline.
+    #
+    #   For information about accepted formats for lists of approved patches
+    #   and rejected patches, see [About package name formats for approved
+    #   and rejected patch lists][1] in the *AWS Systems Manager User
+    #   Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] rejected_patches_action
+    #   The action for Patch Manager to take on patches included in the
+    #   RejectedPackages list. A patch can be allowed only if it is a
+    #   dependency of another package, or blocked entirely along with
+    #   packages that include it as a dependency.
+    #   @return [String]
+    #
+    # @!attribute [rw] approved_patches_enable_non_security
+    #   Indicates whether the list of approved patches includes non-security
+    #   updates that should be applied to the instances. The default value
+    #   is 'false'. Applies to Linux instances only.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] sources
+    #   Information about the patches to use to update the instances,
+    #   including target operating systems and source repositories. Applies
+    #   to Linux instances only.
+    #   @return [Array<Types::PatchSource>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/BaselineOverride AWS API Documentation
+    #
+    class BaselineOverride < Struct.new(
+      :operating_system,
+      :global_filters,
+      :approval_rules,
+      :approved_patches,
+      :approved_patches_compliance_level,
+      :rejected_patches,
+      :rejected_patches_action,
+      :approved_patches_enable_non_security,
+      :sources)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @note When making an API call, you may pass CancelCommandRequest
     #   data as a hash:
     #
@@ -2440,8 +2573,10 @@ module Aws::SSM
     #   @return [Integer]
     #
     # @!attribute [rw] expiration_date
-    #   The date by which this activation request should expire. The default
-    #   value is 24 hours.
+    #   The date by which this activation request should expire, in
+    #   timestamp format, such as "2021-07-07T00:00:00". You can specify a
+    #   date up to 30 days in advance. If you don't provide an expiration
+    #   date, the activation code expires in 24 hours.
     #   @return [Time]
     #
     # @!attribute [rw] tags
@@ -3506,6 +3641,12 @@ module Aws::SSM
     #             value: "MetadataValueString",
     #           },
     #         },
+    #         tags: [
+    #           {
+    #             key: "TagKey", # required
+    #             value: "TagValue", # required
+    #           },
+    #         ],
     #       }
     #
     # @!attribute [rw] resource_id
@@ -3516,11 +3657,25 @@ module Aws::SSM
     #   Metadata for a new Application Manager application.
     #   @return [Hash<String,Types::MetadataValue>]
     #
+    # @!attribute [rw] tags
+    #   Optional metadata that you assign to a resource. You can specify a
+    #   maximum of five tags for an OpsMetadata object. Tags enable you to
+    #   categorize a resource in different ways, such as by purpose, owner,
+    #   or environment. For example, you might want to tag an OpsMetadata
+    #   object to identify an environment or target AWS Region. In this
+    #   case, you could specify the following key-value pairs:
+    #
+    #   * `Key=Environment,Value=Production`
+    #
+    #   * `Key=Region,Value=us-east-2`
+    #   @return [Array<Types::Tag>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/CreateOpsMetadataRequest AWS API Documentation
     #
     class CreateOpsMetadataRequest < Struct.new(
       :resource_id,
-      :metadata)
+      :metadata,
+      :tags)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -3623,8 +3778,8 @@ module Aws::SSM
     #   @return [Array<String>]
     #
     # @!attribute [rw] approved_patches_compliance_level
-    #   Defines the compliance level for approved patches. This means that
-    #   if an approved patch is reported as missing, this is the severity of
+    #   Defines the compliance level for approved patches. When an approved
+    #   patch is reported as missing, this value describes the severity of
     #   the compliance violation. The default value is UNSPECIFIED.
     #   @return [String]
     #
@@ -3759,6 +3914,7 @@ module Aws::SSM
     #           },
     #           source_regions: ["ResourceDataSyncSourceRegion"], # required
     #           include_future_regions: false,
+    #           enable_all_ops_data_sources: false,
     #         },
     #       }
     #
@@ -4724,7 +4880,7 @@ module Aws::SSM
     #
     # @!attribute [rw] reverse_order
     #   A boolean that indicates whether to list step executions in reverse
-    #   order by start time. The default value is false.
+    #   order by start time. The default value is 'false'.
     #   @return [Boolean]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/DescribeAutomationStepExecutionsRequest AWS API Documentation
@@ -6273,6 +6429,28 @@ module Aws::SSM
     #   Inventory.
     #   @return [Integer]
     #
+    # @!attribute [rw] instances_with_critical_non_compliant_patches
+    #   The number of instances where patches that are specified as
+    #   "Critical" for compliance reporting in the patch baseline are not
+    #   installed. These patches might be missing, have failed installation,
+    #   were rejected, or were installed but awaiting a required instance
+    #   reboot. The status of these instances is `NON_COMPLIANT`.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] instances_with_security_non_compliant_patches
+    #   The number of instances where patches that are specified as
+    #   "Security" in a patch advisory are not installed. These patches
+    #   might be missing, have failed installation, were rejected, or were
+    #   installed but awaiting a required instance reboot. The status of
+    #   these instances is `NON_COMPLIANT`.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] instances_with_other_non_compliant_patches
+    #   The number of instances with patches installed that are specified as
+    #   other than "Critical" or "Security" but are not compliant with
+    #   the patch baseline. The status of these instances is NON\_COMPLIANT.
+    #   @return [Integer]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/DescribePatchGroupStateResult AWS API Documentation
     #
     class DescribePatchGroupStateResult < Struct.new(
@@ -6284,7 +6462,10 @@ module Aws::SSM
       :instances_with_missing_patches,
       :instances_with_failed_patches,
       :instances_with_not_applicable_patches,
-      :instances_with_unreported_not_applicable_patches)
+      :instances_with_unreported_not_applicable_patches,
+      :instances_with_critical_non_compliant_patches,
+      :instances_with_security_non_compliant_patches,
+      :instances_with_other_non_compliant_patches)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -7473,17 +7654,26 @@ module Aws::SSM
     #
     # @!attribute [rw] instance_id
     #   (Required) The ID of the managed instance targeted by the command. A
-    #   managed instance can be an EC2 instance or an instance in your
-    #   hybrid environment that is configured for Systems Manager.
+    #   managed instance can be an Amazon Elastic Compute Cloud (Amazon EC2)
+    #   instance or an instance in your hybrid environment that is
+    #   configured for AWS Systems Manager.
     #   @return [String]
     #
     # @!attribute [rw] plugin_name
-    #   (Optional) The name of the plugin for which you want detailed
-    #   results. If the document contains only one plugin, the name can be
-    #   omitted and the details will be returned.
+    #   The name of the plugin for which you want detailed results. If the
+    #   document contains only one plugin, you can omit the name and details
+    #   for that plugin. If the document contains more than one plugin, you
+    #   must specify the name of the plugin for which you want to view
+    #   details.
     #
-    #   Plugin names are also referred to as step names in Systems Manager
-    #   documents.
+    #   Plugin names are also referred to as *step names* in Systems Manager
+    #   documents. For example, `aws:RunShellScript` is a plugin.
+    #
+    #   To find the `PluginName`, check the document content and find the
+    #   name of the plugin. Alternatively, use ListCommandInvocations with
+    #   the `CommandId` and `Details` parameters. The `PluginName` is the
+    #   `Name` attribute of the `CommandPlugin` object in the
+    #   `CommandPlugins` list.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/GetCommandInvocationRequest AWS API Documentation
@@ -7512,7 +7702,7 @@ module Aws::SSM
     #
     # @!attribute [rw] document_name
     #   The name of the document that was run. For example,
-    #   AWS-RunShellScript.
+    #   `AWS-RunShellScript`.
     #   @return [String]
     #
     # @!attribute [rw] document_version
@@ -7520,13 +7710,13 @@ module Aws::SSM
     #   @return [String]
     #
     # @!attribute [rw] plugin_name
-    #   The name of the plugin for which you want detailed results. For
-    #   example, aws:RunShellScript is a plugin.
+    #   The name of the plugin, or *step name*, for which details are
+    #   reported. For example, `aws:RunShellScript` is a plugin.
     #   @return [String]
     #
     # @!attribute [rw] response_code
     #   The error level response code for the plugin script. If the response
-    #   code is -1, then the command has not started running on the
+    #   code is `-1`, then the command has not started running on the
     #   instance, or it was not received by the instance.
     #   @return [Integer]
     #
@@ -7543,11 +7733,11 @@ module Aws::SSM
     #   @return [String]
     #
     # @!attribute [rw] execution_elapsed_time
-    #   Duration since ExecutionStartDateTime.
+    #   Duration since `ExecutionStartDateTime`.
     #   @return [String]
     #
     # @!attribute [rw] execution_end_date_time
-    #   The date and time the plugin was finished running. Date and time are
+    #   The date and time the plugin finished running. Date and time are
     #   written in ISO 8601 format. For example, June 7, 2017 is represented
     #   as 2017-06-7. The following sample AWS CLI command uses the
     #   `InvokedAfter` filter.
@@ -7560,17 +7750,17 @@ module Aws::SSM
     #
     # @!attribute [rw] status
     #   The status of this invocation plugin. This status can be different
-    #   than StatusDetails.
+    #   than `StatusDetails`.
     #   @return [String]
     #
     # @!attribute [rw] status_details
     #   A detailed status of the command execution for an invocation.
-    #   StatusDetails includes more information than Status because it
+    #   `StatusDetails` includes more information than `Status` because it
     #   includes states resulting from error and concurrency control
-    #   parameters. StatusDetails can show different results than Status.
-    #   For more information about these statuses, see [Understanding
-    #   command statuses][1] in the *AWS Systems Manager User Guide*.
-    #   StatusDetails can be one of the following values:
+    #   parameters. `StatusDetails` can show different results than
+    #   `Status`. For more information about these statuses, see
+    #   [Understanding command statuses][1] in the *AWS Systems Manager User
+    #   Guide*. `StatusDetails` can be one of the following values:
     #
     #   * Pending: The command has not been sent to the instance.
     #
@@ -7588,20 +7778,20 @@ module Aws::SSM
     #
     #   * Delivery Timed Out: The command was not delivered to the instance
     #     before the delivery timeout expired. Delivery timeouts do not
-    #     count against the parent command's MaxErrors limit, but they do
+    #     count against the parent command's `MaxErrors` limit, but they do
     #     contribute to whether the parent command status is Success or
     #     Incomplete. This is a terminal state.
     #
     #   * Execution Timed Out: The command started to run on the instance,
     #     but the execution was not complete before the timeout expired.
-    #     Execution timeouts count against the MaxErrors limit of the parent
-    #     command. This is a terminal state.
+    #     Execution timeouts count against the `MaxErrors` limit of the
+    #     parent command. This is a terminal state.
     #
     #   * Failed: The command wasn't run successfully on the instance. For
     #     a plugin, this indicates that the result code was not zero. For a
     #     command invocation, this indicates that the result code for one or
     #     more plugins was not zero. Invocation failures count against the
-    #     MaxErrors limit of the parent command. This is a terminal state.
+    #     `MaxErrors` limit of the parent command. This is a terminal state.
     #
     #   * Canceled: The command was terminated before it was completed. This
     #     is a terminal state.
@@ -7609,11 +7799,11 @@ module Aws::SSM
     #   * Undeliverable: The command can't be delivered to the instance.
     #     The instance might not exist or might not be responding.
     #     Undeliverable invocations don't count against the parent
-    #     command's MaxErrors limit and don't contribute to whether the
+    #     command's `MaxErrors` limit and don't contribute to whether the
     #     parent command status is Success or Incomplete. This is a terminal
     #     state.
     #
-    #   * Terminated: The parent command exceeded its MaxErrors limit and
+    #   * Terminated: The parent command exceeded its `MaxErrors` limit and
     #     subsequent command invocations were canceled by the system. This
     #     is a terminal state.
     #
@@ -7623,24 +7813,24 @@ module Aws::SSM
     #   @return [String]
     #
     # @!attribute [rw] standard_output_content
-    #   The first 24,000 characters written by the plugin to stdout. If the
-    #   command has not finished running, if ExecutionStatus is neither
-    #   Succeeded nor Failed, then this string is empty.
+    #   The first 24,000 characters written by the plugin to `stdout`. If
+    #   the command has not finished running, if `ExecutionStatus` is
+    #   neither Succeeded nor Failed, then this string is empty.
     #   @return [String]
     #
     # @!attribute [rw] standard_output_url
-    #   The URL for the complete text written by the plugin to stdout in
-    #   Amazon S3. If an S3 bucket was not specified, then this string is
-    #   empty.
+    #   The URL for the complete text written by the plugin to `stdout` in
+    #   Amazon Simple Storage Service (Amazon S3). If an S3 bucket was not
+    #   specified, then this string is empty.
     #   @return [String]
     #
     # @!attribute [rw] standard_error_content
-    #   The first 8,000 characters written by the plugin to stderr. If the
+    #   The first 8,000 characters written by the plugin to `stderr`. If the
     #   command has not finished running, then this string is empty.
     #   @return [String]
     #
     # @!attribute [rw] standard_error_url
-    #   The URL for the complete text written by the plugin to stderr. If
+    #   The URL for the complete text written by the plugin to `stderr`. If
     #   the command has not finished running, then this string is empty.
     #   @return [String]
     #
@@ -7753,6 +7943,47 @@ module Aws::SSM
     #       {
     #         instance_id: "InstanceId", # required
     #         snapshot_id: "SnapshotId", # required
+    #         baseline_override: {
+    #           operating_system: "WINDOWS", # accepts WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, CENTOS, ORACLE_LINUX, DEBIAN, MACOS
+    #           global_filters: {
+    #             patch_filters: [ # required
+    #               {
+    #                 key: "ARCH", # required, accepts ARCH, ADVISORY_ID, BUGZILLA_ID, PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, CVE_ID, EPOCH, MSRC_SEVERITY, NAME, PATCH_ID, SECTION, PRIORITY, REPOSITORY, RELEASE, SEVERITY, SECURITY, VERSION
+    #                 values: ["PatchFilterValue"], # required
+    #               },
+    #             ],
+    #           },
+    #           approval_rules: {
+    #             patch_rules: [ # required
+    #               {
+    #                 patch_filter_group: { # required
+    #                   patch_filters: [ # required
+    #                     {
+    #                       key: "ARCH", # required, accepts ARCH, ADVISORY_ID, BUGZILLA_ID, PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, CVE_ID, EPOCH, MSRC_SEVERITY, NAME, PATCH_ID, SECTION, PRIORITY, REPOSITORY, RELEASE, SEVERITY, SECURITY, VERSION
+    #                       values: ["PatchFilterValue"], # required
+    #                     },
+    #                   ],
+    #                 },
+    #                 compliance_level: "CRITICAL", # accepts CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED
+    #                 approve_after_days: 1,
+    #                 approve_until_date: "PatchStringDateTime",
+    #                 enable_non_security: false,
+    #               },
+    #             ],
+    #           },
+    #           approved_patches: ["PatchId"],
+    #           approved_patches_compliance_level: "CRITICAL", # accepts CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED
+    #           rejected_patches: ["PatchId"],
+    #           rejected_patches_action: "ALLOW_AS_DEPENDENCY", # accepts ALLOW_AS_DEPENDENCY, BLOCK
+    #           approved_patches_enable_non_security: false,
+    #           sources: [
+    #             {
+    #               name: "PatchSourceName", # required
+    #               products: ["PatchSourceProduct"], # required
+    #               configuration: "PatchSourceConfiguration", # required
+    #             },
+    #           ],
+    #         },
     #       }
     #
     # @!attribute [rw] instance_id
@@ -7764,11 +7995,16 @@ module Aws::SSM
     #   The user-defined snapshot ID.
     #   @return [String]
     #
+    # @!attribute [rw] baseline_override
+    #   Defines the basic information about a patch baseline override.
+    #   @return [Types::BaselineOverride]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/GetDeployablePatchSnapshotForInstanceRequest AWS API Documentation
     #
     class GetDeployablePatchSnapshotForInstanceRequest < Struct.new(
       :instance_id,
-      :snapshot_id)
+      :snapshot_id,
+      :baseline_override)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -9227,6 +9463,8 @@ module Aws::SSM
     #
     # @!attribute [rw] setting_id
     #   The ID of the service setting to get. The setting ID can be
+    #   `/ssm/automation/customer-script-log-destination`,
+    #   `/ssm/automation/customer-script-log-group-name`,
     #   `/ssm/parameter-store/default-parameter-tier`,
     #   `/ssm/parameter-store/high-throughput-enabled`, or
     #   `/ssm/managed-instance/activation-tier`.
@@ -9380,6 +9618,14 @@ module Aws::SSM
 
     # An S3 bucket where you want to store the results of this request.
     #
+    # For the minimal permissions required to enable Amazon S3 output for an
+    # association, see [Creating associations][1] in the *Systems Manager
+    # User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-state-assoc.html
+    #
     # @note When making an API call, you may pass InstanceAssociationOutputLocation
     #   data as a hash:
     #
@@ -9684,6 +9930,11 @@ module Aws::SSM
     #
     #   "InstanceIds"\|"AgentVersion"\|"PingStatus"\|"PlatformTypes"\|"ActivationIds"\|"IamRole"\|"ResourceType"\|"AssociationStatus"\|"Tag
     #   Key"
+    #
+    #   `Tag key` is not a valid filter. You must specify either `tag-key`
+    #   or `tag:keyname` and a string. Here are some valid examples:
+    #   tag-key, tag:123, tag:al!, tag:Windows. Here are some *invalid*
+    #   examples: tag-keys, Tag Key, tag:, tagKey, abc:keyname.
     #   @return [String]
     #
     # @!attribute [rw] values
@@ -9834,6 +10085,28 @@ module Aws::SSM
     #     patches might not be in effect until a reboot is performed.
     #   @return [String]
     #
+    # @!attribute [rw] critical_non_compliant_count
+    #   The number of instances where patches that are specified as
+    #   "Critical" for compliance reporting in the patch baseline are not
+    #   installed. These patches might be missing, have failed installation,
+    #   were rejected, or were installed but awaiting a required instance
+    #   reboot. The status of these instances is `NON_COMPLIANT`.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] security_non_compliant_count
+    #   The number of instances where patches that are specified as
+    #   "Security" in a patch advisory are not installed. These patches
+    #   might be missing, have failed installation, were rejected, or were
+    #   installed but awaiting a required instance reboot. The status of
+    #   these instances is `NON_COMPLIANT`.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] other_non_compliant_count
+    #   The number of instances with patches installed that are specified as
+    #   other than "Critical" or "Security" but are not compliant with
+    #   the patch baseline. The status of these instances is NON\_COMPLIANT.
+    #   @return [Integer]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/InstancePatchState AWS API Documentation
     #
     class InstancePatchState < Struct.new(
@@ -9855,7 +10128,10 @@ module Aws::SSM
       :operation_end_time,
       :operation,
       :last_no_reboot_install_operation_time,
-      :reboot_option)
+      :reboot_option,
+      :critical_non_compliant_count,
+      :security_non_compliant_count,
+      :other_non_compliant_count)
       SENSITIVE = [:owner_information]
       include Aws::Structure
     end
@@ -11226,7 +11502,7 @@ module Aws::SSM
     #
     # @!attribute [rw] details
     #   (Optional) If set this returns the response of the command
-    #   executions and any command output. By default this is set to False.
+    #   executions and any command output. The default value is 'false'.
     #   @return [Boolean]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/ListCommandInvocationsRequest AWS API Documentation
@@ -12019,7 +12295,7 @@ module Aws::SSM
     #   data as a hash:
     #
     #       {
-    #         resource_type: "Document", # required, accepts Document, ManagedInstance, MaintenanceWindow, Parameter, PatchBaseline, OpsItem
+    #         resource_type: "Document", # required, accepts Document, ManagedInstance, MaintenanceWindow, Parameter, PatchBaseline, OpsItem, OpsMetadata
     #         resource_id: "ResourceId", # required
     #       }
     #
@@ -14808,13 +15084,14 @@ module Aws::SSM
     #   The number of days after the release date of each patch matched by
     #   the rule that the patch is marked as approved in the patch baseline.
     #   For example, a value of `7` means that patches are approved seven
-    #   days after they are released. Not supported on Ubuntu Server.
+    #   days after they are released. Not supported on Debian Server or
+    #   Ubuntu Server.
     #   @return [Integer]
     #
     # @!attribute [rw] approve_until_date
     #   The cutoff date for auto approval of released patches. Any patches
     #   released on or before this date are installed automatically. Not
-    #   supported on Ubuntu Server.
+    #   supported on Debian Server or Ubuntu Server.
     #
     #   Enter dates in the format `YYYY-MM-DD`. For example, `2020-12-31`.
     #   @return [String]
@@ -15198,7 +15475,11 @@ module Aws::SSM
     #     (case-insensitive).
     #
     #   * Parameter names can include only the following symbols and
-    #     letters: `a-zA-Z0-9_.-/`
+    #     letters: `a-zA-Z0-9_.-`
+    #
+    #     In addition, the slash character ( / ) is used to delineate
+    #     hierarchies in parameter names. For example:
+    #     `/Dev/Production/East/Project-ABC/MyParameter`
     #
     #   * A parameter name can't include spaces.
     #
@@ -15206,8 +15487,8 @@ module Aws::SSM
     #     levels.
     #
     #   For additional information about valid values for parameter names,
-    #   see [About requirements and constraints for parameter names][1] in
-    #   the *AWS Systems Manager User Guide*.
+    #   see [Creating Systems Manager parameters][1] in the *AWS Systems
+    #   Manager User Guide*.
     #
     #   <note markdown="1"> The maximum length constraint listed below includes capacity for
     #   additional system attributes that are not part of the name. The
@@ -15221,7 +15502,7 @@ module Aws::SSM
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-parameter-name-constraints.html
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-create.html
     #   @return [String]
     #
     # @!attribute [rw] description
@@ -15280,8 +15561,7 @@ module Aws::SSM
     #   @return [String]
     #
     # @!attribute [rw] overwrite
-    #   Overwrite an existing parameter. If not specified, will default to
-    #   "false".
+    #   Overwrite an existing parameter. The default value is 'false'.
     #   @return [Boolean]
     #
     # @!attribute [rw] allowed_pattern
@@ -15587,6 +15867,14 @@ module Aws::SSM
     #   The targets to register with the maintenance window. In other words,
     #   the instances to run commands on when the maintenance window runs.
     #
+    #   <note markdown="1"> If a single maintenance window task is registered with multiple
+    #   targets, its task invocations occur sequentially and not in
+    #   parallel. If your task must run on multiple targets at the same
+    #   time, register a task for each target individually and assign each
+    #   task the same priority level.
+    #
+    #    </note>
+    #
     #   You can specify targets using instance IDs, resource group names, or
     #   tags that have been applied to instances.
     #
@@ -15942,7 +16230,7 @@ module Aws::SSM
     #   data as a hash:
     #
     #       {
-    #         resource_type: "Document", # required, accepts Document, ManagedInstance, MaintenanceWindow, Parameter, PatchBaseline, OpsItem
+    #         resource_type: "Document", # required, accepts Document, ManagedInstance, MaintenanceWindow, Parameter, PatchBaseline, OpsItem, OpsMetadata
     #         resource_id: "ResourceId", # required
     #         tag_keys: ["TagKey"], # required
     #       }
@@ -15967,6 +16255,15 @@ module Aws::SSM
     #
     #   PatchBaseline: pb-012345abcde
     #
+    #   OpsMetadata object: `ResourceID` for tagging is created from the
+    #   Amazon Resource Name (ARN) for the object. Specifically,
+    #   `ResourceID` is created from the strings that come after the word
+    #   `opsmetadata` in the ARN. For example, an OpsMetadata object with an
+    #   ARN of
+    #   `arn:aws:ssm:us-east-2:1234567890:opsmetadata/aws/ssm/MyGroup/appmanager`
+    #   has a `ResourceID` of either `aws/ssm/MyGroup/appmanager` or
+    #   `/aws/ssm/MyGroup/appmanager`.
+    #
     #   For the Document and Parameter values, use the name of the resource.
     #
     #   <note markdown="1"> The ManagedInstance type for this API action is only for on-premises
@@ -16005,7 +16302,9 @@ module Aws::SSM
     #
     # @!attribute [rw] setting_id
     #   The Amazon Resource Name (ARN) of the service setting to reset. The
-    #   setting ID can be `/ssm/parameter-store/default-parameter-tier`,
+    #   setting ID can be `/ssm/automation/customer-script-log-destination`,
+    #   `/ssm/automation/customer-script-log-group-name`,
+    #   `/ssm/parameter-store/default-parameter-tier`,
     #   `/ssm/parameter-store/high-throughput-enabled`, or
     #   `/ssm/managed-instance/activation-tier`. For example,
     #   `arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/parameter-store/high-throughput-enabled`.
@@ -16402,6 +16701,7 @@ module Aws::SSM
     #         },
     #         source_regions: ["ResourceDataSyncSourceRegion"], # required
     #         include_future_regions: false,
+    #         enable_all_ops_data_sources: false,
     #       }
     #
     # @!attribute [rw] source_type
@@ -16425,13 +16725,27 @@ module Aws::SSM
     #   Regions when those Regions come online.
     #   @return [Boolean]
     #
+    # @!attribute [rw] enable_all_ops_data_sources
+    #   When you create a resource data sync, if you choose one of the AWS
+    #   Organizations options, then Systems Manager automatically enables
+    #   all OpsData sources in the selected AWS Regions for all AWS accounts
+    #   in your organization (or in the selected organization units). For
+    #   more information, see [About multiple account and Region resource
+    #   data syncs][1] in the *AWS Systems Manager User Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/Explorer-resouce-data-sync-multiple-accounts-and-regions.html
+    #   @return [Boolean]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/ResourceDataSyncSource AWS API Documentation
     #
     class ResourceDataSyncSource < Struct.new(
       :source_type,
       :aws_organizations_source,
       :source_regions,
-      :include_future_regions)
+      :include_future_regions,
+      :enable_all_ops_data_sources)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -16488,6 +16802,19 @@ module Aws::SSM
     #   organization in AWS Organizations.
     #   @return [String]
     #
+    # @!attribute [rw] enable_all_ops_data_sources
+    #   When you create a resource data sync, if you choose one of the AWS
+    #   Organizations options, then Systems Manager automatically enables
+    #   all OpsData sources in the selected AWS Regions for all AWS accounts
+    #   in your organization (or in the selected organization units). For
+    #   more information, see [About multiple account and Region resource
+    #   data syncs][1] in the *AWS Systems Manager User Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/Explorer-resouce-data-sync-multiple-accounts-and-regions.html
+    #   @return [Boolean]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/ResourceDataSyncSourceWithState AWS API Documentation
     #
     class ResourceDataSyncSourceWithState < Struct.new(
@@ -16495,7 +16822,8 @@ module Aws::SSM
       :aws_organizations_source,
       :source_regions,
       :include_future_regions,
-      :state)
+      :state,
+      :enable_all_ops_data_sources)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -17605,6 +17933,8 @@ module Aws::SSM
     #             value: "TagValue", # required
     #           },
     #         ],
+    #         scheduled_end_time: Time.now,
+    #         change_details: "ChangeDetailsValue",
     #       }
     #
     # @!attribute [rw] scheduled_time
@@ -17667,6 +17997,18 @@ module Aws::SSM
     #   * `Key=Region,Value=us-east-2`
     #   @return [Array<Types::Tag>]
     #
+    # @!attribute [rw] scheduled_end_time
+    #   The time that the requester expects the runbook workflow related to
+    #   the change request to complete. The time is an estimate only that
+    #   the requester provides for reviewers.
+    #   @return [Time]
+    #
+    # @!attribute [rw] change_details
+    #   User-provided details about the change. If no details are provided,
+    #   content specified in the **Template information** section of the
+    #   associated change template is added.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/StartChangeRequestExecutionRequest AWS API Documentation
     #
     class StartChangeRequestExecutionRequest < Struct.new(
@@ -17677,7 +18019,9 @@ module Aws::SSM
       :change_request_name,
       :client_token,
       :runbooks,
-      :tags)
+      :tags,
+      :scheduled_end_time,
+      :change_details)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -18102,6 +18446,9 @@ module Aws::SSM
     #   specified `tag:ServerRole`, you could specify `value:WebServer` to
     #   run a command on instances that include EC2 tags of
     #   `ServerRole,WebServer`.
+    #
+    #   Depending on the type of `Target`, the maximum number of values for
+    #   a `Key` might be lower than the global maximum of 50.
     #   @return [Array<String>]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/Target AWS API Documentation
@@ -18266,6 +18613,55 @@ module Aws::SSM
       include Aws::Structure
     end
 
+    # @note When making an API call, you may pass UnlabelParameterVersionRequest
+    #   data as a hash:
+    #
+    #       {
+    #         name: "PSParameterName", # required
+    #         parameter_version: 1, # required
+    #         labels: ["ParameterLabel"], # required
+    #       }
+    #
+    # @!attribute [rw] name
+    #   The parameter name of which you want to delete one or more labels.
+    #   @return [String]
+    #
+    # @!attribute [rw] parameter_version
+    #   The specific version of the parameter which you want to delete one
+    #   or more labels from. If it is not present, the call will fail.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] labels
+    #   One or more labels to delete from the specified parameter version.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/UnlabelParameterVersionRequest AWS API Documentation
+    #
+    class UnlabelParameterVersionRequest < Struct.new(
+      :name,
+      :parameter_version,
+      :labels)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] removed_labels
+    #   A list of all labels deleted from the parameter.
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] invalid_labels
+    #   The labels that are not attached to the given parameter version.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/UnlabelParameterVersionResult AWS API Documentation
+    #
+    class UnlabelParameterVersionResult < Struct.new(
+      :removed_labels,
+      :invalid_labels)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # The calendar entry contained in the specified Systems Manager document
     # is not supported.
     #
@@ -18765,10 +19161,10 @@ module Aws::SSM
     #   @return [String]
     #
     # @!attribute [rw] document_version
-    #   (Required) The latest version of the document that you want to
-    #   update. The latest document version can be specified using the
-    #   $LATEST variable or by the version number. Updating a previous
-    #   version of a document is not supported.
+    #   The version of the document that you want to update. Currently,
+    #   Systems Manager supports updating only the latest version of the
+    #   document. You can specify the version number of the latest version
+    #   or use the `$LATEST` variable.
     #   @return [String]
     #
     # @!attribute [rw] document_format
@@ -19951,6 +20347,7 @@ module Aws::SSM
     #           },
     #           source_regions: ["ResourceDataSyncSourceRegion"], # required
     #           include_future_regions: false,
+    #           enable_all_ops_data_sources: false,
     #         },
     #       }
     #
@@ -19997,6 +20394,10 @@ module Aws::SSM
     #   `arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/parameter-store/high-throughput-enabled`.
     #   The setting ID can be one of the following.
     #
+    #   * `/ssm/automation/customer-script-log-destination`
+    #
+    #   * `/ssm/automation/customer-script-log-group-name`
+    #
     #   * `/ssm/parameter-store/default-parameter-tier`
     #
     #   * `/ssm/parameter-store/high-throughput-enabled`
@@ -20018,6 +20419,12 @@ module Aws::SSM
     #   For the `/ssm/parameter-store/high-throughput-enabled`, and
     #   `/ssm/managed-instance/activation-tier` setting IDs, the setting
     #   value can be true or false.
+    #
+    #   For the `/ssm/automation/customer-script-log-destination` setting
+    #   ID, the setting value can be CloudWatch.
+    #
+    #   For the `/ssm/automation/customer-script-log-group-name` setting ID,
+    #   the setting value can be the name of a CloudWatch Logs log group.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/UpdateServiceSettingRequest AWS API Documentation