aws-sdk-ssm 1.144.0 → 1.145.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e1f222b054c2cb6f9c4014c39882f20197f02cf5bfd6007619ea81da447f576
-  data.tar.gz: f3068a350d6f4b15cc245c68cc33d62c8704060238116b5be87a361da7485712
+  metadata.gz: f4df763ac4c3ef285412a65d4887525b9307f6a2c162d61aaf39b03083e67a76
+  data.tar.gz: 81d2827e2472333d871b4e045305759909decb4e7c43df205921285e3754aa77
 SHA512:
-  metadata.gz: b139f19fbd3e23eb3672f177ec51002c725d1f2478aa0c2ea9f21d1b84890bef441e381d00c3a6842fc9b5f059d5f0e32eeaf71142d8b8b88d2d26103003ef48
-  data.tar.gz: 943cd6e1c12b5dec846024f333db23c0b1e1043c6da40ae599e7875ad87216bea14495b4a0ab5ea6055afb4a1ab720a77b8239865e0210c25a0403d5ac252eda
+  metadata.gz: 88ebd26902f41e82c78591109018c347a19dcc5cd493462ed5097fe5de64d4a4290ef585311bdface7cbe7faacf5979fcdc94ae4965452221409dbb2af797b69
+  data.tar.gz: fc967ad47d3e5d270c429530087adb0665a43b3df5acf367073dd99a84c50d50ee28d8587d493af52e655190bcb1ef3ddb7e7eb05f3226679969e2487501c2c9

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.145.0 (2022-11-16)
+------------------
+
+* Feature - This release adds support for cross account access in CreateOpsItem, UpdateOpsItem and GetOpsItem. It introduces new APIs to setup resource policies for SSM resources: PutResourcePolicy, GetResourcePolicies and DeleteResourcePolicy.
+
 1.144.0 (2022-11-07)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.144.0
+1.145.0

data/lib/aws-sdk-ssm/client.rb

@@ -640,6 +640,11 @@ module Aws::SSM
     #   [Create an IAM service role for a hybrid environment][1] in the
     #   *Amazon Web Services Systems Manager User Guide*.
     #
+    #   <note markdown="1"> You can't specify an IAM service-linked role for this parameter. You
+    #   must create a unique role.
+    #
+    #    </note>
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-service-role.html
@@ -1640,8 +1645,23 @@ module Aws::SSM
     #   Information about the OpsItem.
     #
     # @option params [String] :ops_item_type
-    #   The type of OpsItem to create. Currently, the only valid values are
-    #   `/aws/changerequest` and `/aws/issue`.
+    #   The type of OpsItem to create. Systems Manager supports the following
+    #   types of OpsItems:
+    #
+    #   * `/aws/issue`
+    #
+    #     This type of OpsItem is used for default OpsItems created by
+    #     OpsCenter.
+    #
+    #   * `/aws/changerequest`
+    #
+    #     This type of OpsItem is used by Change Manager for reviewing and
+    #     approving or rejecting change requests.
+    #
+    #   * `/aws/insights`
+    #
+    #     This type of OpsItem is used by OpsCenter for aggregating and
+    #     reporting on duplicate OpsItems.
     #
     # @option params [Hash<String,Types::OpsItemDataValue>] :operational_data
     #   Operational data is custom data that provides useful reference details
@@ -1740,9 +1760,21 @@ module Aws::SSM
     #   The time specified in a change request for a runbook workflow to end.
     #   Currently supported only for the OpsItem type `/aws/changerequest`.
     #
+    # @option params [String] :account_id
+    #   The target Amazon Web Services account where you want to create an
+    #   OpsItem. To make this call, your account must be configured to work
+    #   with OpsItems across accounts. For more information, see [Setting up
+    #   OpsCenter to work with OpsItems across accounts][1] in the *Amazon Web
+    #   Services Systems Manager User Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-OpsCenter-multiple-accounts.html
+    #
     # @return [Types::CreateOpsItemResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateOpsItemResponse#ops_item_id #ops_item_id} => String
+    #   * {Types::CreateOpsItemResponse#ops_item_arn #ops_item_arn} => String
     #
     # @example Request syntax with placeholder values
     #
@@ -1780,11 +1812,13 @@ module Aws::SSM
     #     actual_end_time: Time.now,
     #     planned_start_time: Time.now,
     #     planned_end_time: Time.now,
+    #     account_id: "OpsItemAccountId",
     #   })
     #
     # @example Response structure
     #
     #   resp.ops_item_id #=> String
+    #   resp.ops_item_arn #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/CreateOpsItem AWS API Documentation
     #
@@ -2477,6 +2511,44 @@ module Aws::SSM
       req.send_request(options)
     end
 
+    # Deletes a Systems Manager resource policy. A resource policy helps you
+    # to define the IAM entity (for example, an Amazon Web Services account)
+    # that can manage your Systems Manager resources. Currently,
+    # `OpsItemGroup` is the only resource that supports Systems Manager
+    # resource policies. The resource policy for `OpsItemGroup` enables
+    # Amazon Web Services accounts to view and interact with OpsCenter
+    # operational work items (OpsItems).
+    #
+    # @option params [required, String] :resource_arn
+    #   Amazon Resource Name (ARN) of the resource to which the policies are
+    #   attached.
+    #
+    # @option params [required, String] :policy_id
+    #   The policy ID.
+    #
+    # @option params [required, String] :policy_hash
+    #   ID of the current policy version. The hash helps to prevent multiple
+    #   calls from attempting to overwrite a policy.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_resource_policy({
+    #     resource_arn: "ResourceArnString", # required
+    #     policy_id: "PolicyId", # required
+    #     policy_hash: "PolicyHash", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/DeleteResourcePolicy AWS API Documentation
+    #
+    # @overload delete_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def delete_resource_policy(params = {}, options = {})
+      req = build_request(:delete_resource_policy, params)
+      req.send_request(options)
+    end
+
     # Removes the server or virtual machine from the list of registered
     # servers. You can reregister the node again at any time. If you don't
     # plan to use Run Command on the server, we suggest uninstalling SSM
@@ -4669,7 +4741,7 @@ module Aws::SSM
     #   resp = client.describe_ops_items({
     #     ops_item_filters: [
     #       {
-    #         key: "Status", # required, accepts Status, CreatedBy, Source, Priority, Title, OpsItemId, CreatedTime, LastModifiedTime, ActualStartTime, ActualEndTime, PlannedStartTime, PlannedEndTime, OperationalData, OperationalDataKey, OperationalDataValue, ResourceId, AutomationId, Category, Severity, OpsItemType, ChangeRequestByRequesterArn, ChangeRequestByRequesterName, ChangeRequestByApproverArn, ChangeRequestByApproverName, ChangeRequestByTemplate, ChangeRequestByTargetsResourceGroup, InsightByType
+    #         key: "Status", # required, accepts Status, CreatedBy, Source, Priority, Title, OpsItemId, CreatedTime, LastModifiedTime, ActualStartTime, ActualEndTime, PlannedStartTime, PlannedEndTime, OperationalData, OperationalDataKey, OperationalDataValue, ResourceId, AutomationId, Category, Severity, OpsItemType, ChangeRequestByRequesterArn, ChangeRequestByRequesterName, ChangeRequestByApproverArn, ChangeRequestByApproverName, ChangeRequestByTemplate, ChangeRequestByTargetsResourceGroup, InsightByType, AccountId
     #         values: ["OpsItemFilterValue"], # required
     #         operator: "Equal", # required, accepts Equal, Contains, GreaterThan, LessThan
     #       },
@@ -6252,6 +6324,9 @@ module Aws::SSM
     # @option params [required, String] :ops_item_id
     #   The ID of the OpsItem that you want to get.
     #
+    # @option params [String] :ops_item_arn
+    #   The OpsItem Amazon Resource Name (ARN).
+    #
     # @return [Types::GetOpsItemResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::GetOpsItemResponse#ops_item #ops_item} => Types::OpsItem
@@ -6260,6 +6335,7 @@ module Aws::SSM
     #
     #   resp = client.get_ops_item({
     #     ops_item_id: "OpsItemId", # required
+    #     ops_item_arn: "OpsItemArn",
     #   })
     #
     # @example Response structure
@@ -6289,6 +6365,7 @@ module Aws::SSM
     #   resp.ops_item.actual_end_time #=> Time
     #   resp.ops_item.planned_start_time #=> Time
     #   resp.ops_item.planned_end_time #=> Time
+    #   resp.ops_item.ops_item_arn #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/GetOpsItem AWS API Documentation
     #
@@ -6836,6 +6913,53 @@ module Aws::SSM
       req.send_request(options)
     end
 
+    # Returns an array of the `Policy` object.
+    #
+    # @option params [required, String] :resource_arn
+    #   Amazon Resource Name (ARN) of the resource to which the policies are
+    #   attached.
+    #
+    # @option params [String] :next_token
+    #   A token to start the list. Use this token to get the next set of
+    #   results.
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of items to return for this call. The call also
+    #   returns a token that you can specify in a subsequent call to get the
+    #   next set of results.
+    #
+    # @return [Types::GetResourcePoliciesResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetResourcePoliciesResponse#next_token #next_token} => String
+    #   * {Types::GetResourcePoliciesResponse#policies #policies} => Array&lt;Types::GetResourcePoliciesResponseEntry&gt;
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_resource_policies({
+    #     resource_arn: "ResourceArnString", # required
+    #     next_token: "String",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.next_token #=> String
+    #   resp.policies #=> Array
+    #   resp.policies[0].policy_id #=> String
+    #   resp.policies[0].policy_hash #=> String
+    #   resp.policies[0].policy #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/GetResourcePolicies AWS API Documentation
+    #
+    # @overload get_resource_policies(params = {})
+    # @param [Hash] params ({})
+    def get_resource_policies(params = {}, options = {})
+      req = build_request(:get_resource_policies, params)
+      req.send_request(options)
+    end
+
     # `ServiceSetting` is an account-level setting for an Amazon Web
     # Services service. This setting defines how a user interacts with or
     # uses a service or a feature of a service. For example, if an Amazon
@@ -8652,6 +8776,56 @@ module Aws::SSM
       req.send_request(options)
     end
 
+    # Creates or updates a Systems Manager resource policy. A resource
+    # policy helps you to define the IAM entity (for example, an Amazon Web
+    # Services account) that can manage your Systems Manager resources.
+    # Currently, `OpsItemGroup` is the only resource that supports Systems
+    # Manager resource policies. The resource policy for `OpsItemGroup`
+    # enables Amazon Web Services accounts to view and interact with
+    # OpsCenter operational work items (OpsItems).
+    #
+    # @option params [required, String] :resource_arn
+    #   Amazon Resource Name (ARN) of the resource to which the policies are
+    #   attached.
+    #
+    # @option params [required, String] :policy
+    #   A policy you want to associate with a resource.
+    #
+    # @option params [String] :policy_id
+    #   The policy ID.
+    #
+    # @option params [String] :policy_hash
+    #   ID of the current policy version. The hash helps to prevent a
+    #   situation where multiple users attempt to overwrite a policy.
+    #
+    # @return [Types::PutResourcePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutResourcePolicyResponse#policy_id #policy_id} => String
+    #   * {Types::PutResourcePolicyResponse#policy_hash #policy_hash} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_resource_policy({
+    #     resource_arn: "ResourceArnString", # required
+    #     policy: "Policy", # required
+    #     policy_id: "PolicyId",
+    #     policy_hash: "PolicyHash",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_id #=> String
+    #   resp.policy_hash #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/PutResourcePolicy AWS API Documentation
+    #
+    # @overload put_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def put_resource_policy(params = {}, options = {})
+      req = build_request(:put_resource_policy, params)
+      req.send_request(options)
+    end
+
     # Defines the default patch baseline for the relevant operating system.
     #
     # To reset the Amazon Web Services-predefined patch baseline as the
@@ -11376,7 +11550,21 @@ module Aws::SSM
     #   The ID of the managed node where you want to update the role.
     #
     # @option params [required, String] :iam_role
-    #   The IAM role you want to assign or change.
+    #   The name of the Identity and Access Management (IAM) role that you
+    #   want to assign to the managed node. This IAM role must provide
+    #   AssumeRole permissions for the Amazon Web Services Systems Manager
+    #   service principal `ssm.amazonaws.com`. For more information, see
+    #   [Create an IAM service role for a hybrid environment][1] in the
+    #   *Amazon Web Services Systems Manager User Guide*.
+    #
+    #   <note markdown="1"> You can't specify an IAM service-linked role for this parameter. You
+    #   must create a unique role.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-service-role.html
     #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
@@ -11506,6 +11694,9 @@ module Aws::SSM
     #   The time specified in a change request for a runbook workflow to end.
     #   Currently supported only for the OpsItem type `/aws/changerequest`.
     #
+    # @option params [String] :ops_item_arn
+    #   The OpsItem Amazon Resource Name (ARN).
+    #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
     # @example Request syntax with placeholder values
@@ -11539,6 +11730,7 @@ module Aws::SSM
     #     actual_end_time: Time.now,
     #     planned_start_time: Time.now,
     #     planned_end_time: Time.now,
+    #     ops_item_arn: "OpsItemArn",
     #   })
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/UpdateOpsItem AWS API Documentation
@@ -11926,7 +12118,7 @@ module Aws::SSM
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-ssm'
-      context[:gem_version] = '1.144.0'
+      context[:gem_version] = '1.145.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-ssm/client_api.rb

@@ -241,6 +241,8 @@ module Aws::SSM
     DeletePatchBaselineResult = Shapes::StructureShape.new(name: 'DeletePatchBaselineResult')
     DeleteResourceDataSyncRequest = Shapes::StructureShape.new(name: 'DeleteResourceDataSyncRequest')
     DeleteResourceDataSyncResult = Shapes::StructureShape.new(name: 'DeleteResourceDataSyncResult')
+    DeleteResourcePolicyRequest = Shapes::StructureShape.new(name: 'DeleteResourcePolicyRequest')
+    DeleteResourcePolicyResponse = Shapes::StructureShape.new(name: 'DeleteResourcePolicyResponse')
     DeliveryTimedOutCount = Shapes::IntegerShape.new(name: 'DeliveryTimedOutCount')
     DeregisterManagedInstanceRequest = Shapes::StructureShape.new(name: 'DeregisterManagedInstanceRequest')
     DeregisterManagedInstanceResult = Shapes::StructureShape.new(name: 'DeregisterManagedInstanceResult')
@@ -443,6 +445,10 @@ module Aws::SSM
     GetPatchBaselineForPatchGroupResult = Shapes::StructureShape.new(name: 'GetPatchBaselineForPatchGroupResult')
     GetPatchBaselineRequest = Shapes::StructureShape.new(name: 'GetPatchBaselineRequest')
     GetPatchBaselineResult = Shapes::StructureShape.new(name: 'GetPatchBaselineResult')
+    GetResourcePoliciesRequest = Shapes::StructureShape.new(name: 'GetResourcePoliciesRequest')
+    GetResourcePoliciesResponse = Shapes::StructureShape.new(name: 'GetResourcePoliciesResponse')
+    GetResourcePoliciesResponseEntries = Shapes::ListShape.new(name: 'GetResourcePoliciesResponseEntries')
+    GetResourcePoliciesResponseEntry = Shapes::StructureShape.new(name: 'GetResourcePoliciesResponseEntry')
     GetServiceSettingRequest = Shapes::StructureShape.new(name: 'GetServiceSettingRequest')
     GetServiceSettingResult = Shapes::StructureShape.new(name: 'GetServiceSettingResult')
     HierarchyLevelLimitExceededException = Shapes::StructureShape.new(name: 'HierarchyLevelLimitExceededException')
@@ -741,7 +747,10 @@ module Aws::SSM
     OpsFilterValue = Shapes::StringShape.new(name: 'OpsFilterValue')
     OpsFilterValueList = Shapes::ListShape.new(name: 'OpsFilterValueList')
     OpsItem = Shapes::StructureShape.new(name: 'OpsItem')
+    OpsItemAccessDeniedException = Shapes::StructureShape.new(name: 'OpsItemAccessDeniedException')
+    OpsItemAccountId = Shapes::StringShape.new(name: 'OpsItemAccountId')
     OpsItemAlreadyExistsException = Shapes::StructureShape.new(name: 'OpsItemAlreadyExistsException')
+    OpsItemArn = Shapes::StringShape.new(name: 'OpsItemArn')
     OpsItemCategory = Shapes::StringShape.new(name: 'OpsItemCategory')
     OpsItemDataKey = Shapes::StringShape.new(name: 'OpsItemDataKey')
     OpsItemDataType = Shapes::StringShape.new(name: 'OpsItemDataType')
@@ -946,6 +955,9 @@ module Aws::SSM
     PlatformType = Shapes::StringShape.new(name: 'PlatformType')
     PlatformTypeList = Shapes::ListShape.new(name: 'PlatformTypeList')
     PoliciesLimitExceededException = Shapes::StructureShape.new(name: 'PoliciesLimitExceededException')
+    Policy = Shapes::StringShape.new(name: 'Policy')
+    PolicyHash = Shapes::StringShape.new(name: 'PolicyHash')
+    PolicyId = Shapes::StringShape.new(name: 'PolicyId')
     Product = Shapes::StringShape.new(name: 'Product')
     ProgressCounters = Shapes::StructureShape.new(name: 'ProgressCounters')
     PutComplianceItemsRequest = Shapes::StructureShape.new(name: 'PutComplianceItemsRequest')
@@ -955,6 +967,8 @@ module Aws::SSM
     PutInventoryResult = Shapes::StructureShape.new(name: 'PutInventoryResult')
     PutParameterRequest = Shapes::StructureShape.new(name: 'PutParameterRequest')
     PutParameterResult = Shapes::StructureShape.new(name: 'PutParameterResult')
+    PutResourcePolicyRequest = Shapes::StructureShape.new(name: 'PutResourcePolicyRequest')
+    PutResourcePolicyResponse = Shapes::StructureShape.new(name: 'PutResourcePolicyResponse')
     RebootOption = Shapes::StringShape.new(name: 'RebootOption')
     Region = Shapes::StringShape.new(name: 'Region')
     Regions = Shapes::ListShape.new(name: 'Regions')
@@ -980,6 +994,7 @@ module Aws::SSM
     ResetServiceSettingRequest = Shapes::StructureShape.new(name: 'ResetServiceSettingRequest')
     ResetServiceSettingResult = Shapes::StructureShape.new(name: 'ResetServiceSettingResult')
     ResolvedTargets = Shapes::StructureShape.new(name: 'ResolvedTargets')
+    ResourceArnString = Shapes::StringShape.new(name: 'ResourceArnString')
     ResourceComplianceSummaryItem = Shapes::StructureShape.new(name: 'ResourceComplianceSummaryItem')
     ResourceComplianceSummaryItemList = Shapes::ListShape.new(name: 'ResourceComplianceSummaryItemList')
     ResourceCount = Shapes::IntegerShape.new(name: 'ResourceCount')
@@ -1019,6 +1034,11 @@ module Aws::SSM
     ResourceId = Shapes::StringShape.new(name: 'ResourceId')
     ResourceInUseException = Shapes::StructureShape.new(name: 'ResourceInUseException')
     ResourceLimitExceededException = Shapes::StructureShape.new(name: 'ResourceLimitExceededException')
+    ResourcePolicyConflictException = Shapes::StructureShape.new(name: 'ResourcePolicyConflictException')
+    ResourcePolicyInvalidParameterException = Shapes::StructureShape.new(name: 'ResourcePolicyInvalidParameterException')
+    ResourcePolicyLimitExceededException = Shapes::StructureShape.new(name: 'ResourcePolicyLimitExceededException')
+    ResourcePolicyMaxResults = Shapes::IntegerShape.new(name: 'ResourcePolicyMaxResults')
+    ResourcePolicyParameterNamesList = Shapes::ListShape.new(name: 'ResourcePolicyParameterNamesList')
     ResourceType = Shapes::StringShape.new(name: 'ResourceType')
     ResourceTypeForTagging = Shapes::StringShape.new(name: 'ResourceTypeForTagging')
     ResponseCode = Shapes::IntegerShape.new(name: 'ResponseCode')
@@ -1786,9 +1806,11 @@ module Aws::SSM
     CreateOpsItemRequest.add_member(:actual_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "ActualEndTime"))
     CreateOpsItemRequest.add_member(:planned_start_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "PlannedStartTime"))
     CreateOpsItemRequest.add_member(:planned_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "PlannedEndTime"))
+    CreateOpsItemRequest.add_member(:account_id, Shapes::ShapeRef.new(shape: OpsItemAccountId, location_name: "AccountId"))
     CreateOpsItemRequest.struct_class = Types::CreateOpsItemRequest
 
     CreateOpsItemResponse.add_member(:ops_item_id, Shapes::ShapeRef.new(shape: String, location_name: "OpsItemId"))
+    CreateOpsItemResponse.add_member(:ops_item_arn, Shapes::ShapeRef.new(shape: OpsItemArn, location_name: "OpsItemArn"))
     CreateOpsItemResponse.struct_class = Types::CreateOpsItemResponse
 
     CreateOpsMetadataRequest.add_member(:resource_id, Shapes::ShapeRef.new(shape: OpsMetadataResourceId, required: true, location_name: "ResourceId"))
@@ -1894,6 +1916,13 @@ module Aws::SSM
 
     DeleteResourceDataSyncResult.struct_class = Types::DeleteResourceDataSyncResult
 
+    DeleteResourcePolicyRequest.add_member(:resource_arn, Shapes::ShapeRef.new(shape: ResourceArnString, required: true, location_name: "ResourceArn"))
+    DeleteResourcePolicyRequest.add_member(:policy_id, Shapes::ShapeRef.new(shape: PolicyId, required: true, location_name: "PolicyId"))
+    DeleteResourcePolicyRequest.add_member(:policy_hash, Shapes::ShapeRef.new(shape: PolicyHash, required: true, location_name: "PolicyHash"))
+    DeleteResourcePolicyRequest.struct_class = Types::DeleteResourcePolicyRequest
+
+    DeleteResourcePolicyResponse.struct_class = Types::DeleteResourcePolicyResponse
+
     DeregisterManagedInstanceRequest.add_member(:instance_id, Shapes::ShapeRef.new(shape: ManagedInstanceId, required: true, location_name: "InstanceId"))
     DeregisterManagedInstanceRequest.struct_class = Types::DeregisterManagedInstanceRequest
 
@@ -2620,6 +2649,7 @@ module Aws::SSM
     GetMaintenanceWindowTaskResult.struct_class = Types::GetMaintenanceWindowTaskResult
 
     GetOpsItemRequest.add_member(:ops_item_id, Shapes::ShapeRef.new(shape: OpsItemId, required: true, location_name: "OpsItemId"))
+    GetOpsItemRequest.add_member(:ops_item_arn, Shapes::ShapeRef.new(shape: OpsItemArn, location_name: "OpsItemArn"))
     GetOpsItemRequest.struct_class = Types::GetOpsItemRequest
 
     GetOpsItemResponse.add_member(:ops_item, Shapes::ShapeRef.new(shape: OpsItem, location_name: "OpsItem"))
@@ -2713,6 +2743,22 @@ module Aws::SSM
     GetPatchBaselineResult.add_member(:sources, Shapes::ShapeRef.new(shape: PatchSourceList, location_name: "Sources"))
     GetPatchBaselineResult.struct_class = Types::GetPatchBaselineResult
 
+    GetResourcePoliciesRequest.add_member(:resource_arn, Shapes::ShapeRef.new(shape: ResourceArnString, required: true, location_name: "ResourceArn"))
+    GetResourcePoliciesRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: String, location_name: "NextToken"))
+    GetResourcePoliciesRequest.add_member(:max_results, Shapes::ShapeRef.new(shape: ResourcePolicyMaxResults, location_name: "MaxResults"))
+    GetResourcePoliciesRequest.struct_class = Types::GetResourcePoliciesRequest
+
+    GetResourcePoliciesResponse.add_member(:next_token, Shapes::ShapeRef.new(shape: String, location_name: "NextToken"))
+    GetResourcePoliciesResponse.add_member(:policies, Shapes::ShapeRef.new(shape: GetResourcePoliciesResponseEntries, location_name: "Policies"))
+    GetResourcePoliciesResponse.struct_class = Types::GetResourcePoliciesResponse
+
+    GetResourcePoliciesResponseEntries.member = Shapes::ShapeRef.new(shape: GetResourcePoliciesResponseEntry)
+
+    GetResourcePoliciesResponseEntry.add_member(:policy_id, Shapes::ShapeRef.new(shape: PolicyId, location_name: "PolicyId"))
+    GetResourcePoliciesResponseEntry.add_member(:policy_hash, Shapes::ShapeRef.new(shape: PolicyHash, location_name: "PolicyHash"))
+    GetResourcePoliciesResponseEntry.add_member(:policy, Shapes::ShapeRef.new(shape: Policy, location_name: "Policy"))
+    GetResourcePoliciesResponseEntry.struct_class = Types::GetResourcePoliciesResponseEntry
+
     GetServiceSettingRequest.add_member(:setting_id, Shapes::ShapeRef.new(shape: ServiceSettingId, required: true, location_name: "SettingId"))
     GetServiceSettingRequest.struct_class = Types::GetServiceSettingRequest
 
@@ -3510,8 +3556,12 @@ module Aws::SSM
     OpsItem.add_member(:actual_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "ActualEndTime"))
     OpsItem.add_member(:planned_start_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "PlannedStartTime"))
     OpsItem.add_member(:planned_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "PlannedEndTime"))
+    OpsItem.add_member(:ops_item_arn, Shapes::ShapeRef.new(shape: OpsItemArn, location_name: "OpsItemArn"))
     OpsItem.struct_class = Types::OpsItem
 
+    OpsItemAccessDeniedException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
+    OpsItemAccessDeniedException.struct_class = Types::OpsItemAccessDeniedException
+
     OpsItemAlreadyExistsException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
     OpsItemAlreadyExistsException.add_member(:ops_item_id, Shapes::ShapeRef.new(shape: String, location_name: "OpsItemId"))
     OpsItemAlreadyExistsException.struct_class = Types::OpsItemAlreadyExistsException
@@ -3931,6 +3981,16 @@ module Aws::SSM
     PutParameterResult.add_member(:tier, Shapes::ShapeRef.new(shape: ParameterTier, location_name: "Tier"))
     PutParameterResult.struct_class = Types::PutParameterResult
 
+    PutResourcePolicyRequest.add_member(:resource_arn, Shapes::ShapeRef.new(shape: ResourceArnString, required: true, location_name: "ResourceArn"))
+    PutResourcePolicyRequest.add_member(:policy, Shapes::ShapeRef.new(shape: Policy, required: true, location_name: "Policy"))
+    PutResourcePolicyRequest.add_member(:policy_id, Shapes::ShapeRef.new(shape: PolicyId, location_name: "PolicyId"))
+    PutResourcePolicyRequest.add_member(:policy_hash, Shapes::ShapeRef.new(shape: PolicyHash, location_name: "PolicyHash"))
+    PutResourcePolicyRequest.struct_class = Types::PutResourcePolicyRequest
+
+    PutResourcePolicyResponse.add_member(:policy_id, Shapes::ShapeRef.new(shape: PolicyId, location_name: "PolicyId"))
+    PutResourcePolicyResponse.add_member(:policy_hash, Shapes::ShapeRef.new(shape: PolicyHash, location_name: "PolicyHash"))
+    PutResourcePolicyResponse.struct_class = Types::PutResourcePolicyResponse
+
     Regions.member = Shapes::ShapeRef.new(shape: Region)
 
     RegisterDefaultPatchBaselineRequest.add_member(:baseline_id, Shapes::ShapeRef.new(shape: BaselineId, required: true, location_name: "BaselineId"))
@@ -4094,6 +4154,20 @@ module Aws::SSM
     ResourceLimitExceededException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
     ResourceLimitExceededException.struct_class = Types::ResourceLimitExceededException
 
+    ResourcePolicyConflictException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
+    ResourcePolicyConflictException.struct_class = Types::ResourcePolicyConflictException
+
+    ResourcePolicyInvalidParameterException.add_member(:parameter_names, Shapes::ShapeRef.new(shape: ResourcePolicyParameterNamesList, location_name: "ParameterNames"))
+    ResourcePolicyInvalidParameterException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
+    ResourcePolicyInvalidParameterException.struct_class = Types::ResourcePolicyInvalidParameterException
+
+    ResourcePolicyLimitExceededException.add_member(:limit, Shapes::ShapeRef.new(shape: Integer, location_name: "Limit"))
+    ResourcePolicyLimitExceededException.add_member(:limit_type, Shapes::ShapeRef.new(shape: String, location_name: "LimitType"))
+    ResourcePolicyLimitExceededException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "Message"))
+    ResourcePolicyLimitExceededException.struct_class = Types::ResourcePolicyLimitExceededException
+
+    ResourcePolicyParameterNamesList.member = Shapes::ShapeRef.new(shape: String)
+
     ResultAttribute.add_member(:type_name, Shapes::ShapeRef.new(shape: InventoryItemTypeName, required: true, location_name: "TypeName"))
     ResultAttribute.struct_class = Types::ResultAttribute
 
@@ -4565,6 +4639,7 @@ module Aws::SSM
     UpdateOpsItemRequest.add_member(:actual_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "ActualEndTime"))
     UpdateOpsItemRequest.add_member(:planned_start_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "PlannedStartTime"))
     UpdateOpsItemRequest.add_member(:planned_end_time, Shapes::ShapeRef.new(shape: DateTime, location_name: "PlannedEndTime"))
+    UpdateOpsItemRequest.add_member(:ops_item_arn, Shapes::ShapeRef.new(shape: OpsItemArn, location_name: "OpsItemArn"))
     UpdateOpsItemRequest.struct_class = Types::UpdateOpsItemRequest
 
     UpdateOpsItemResponse.struct_class = Types::UpdateOpsItemResponse
@@ -4775,6 +4850,7 @@ module Aws::SSM
         o.errors << Shapes::ShapeRef.new(shape: OpsItemAlreadyExistsException)
         o.errors << Shapes::ShapeRef.new(shape: OpsItemLimitExceededException)
         o.errors << Shapes::ShapeRef.new(shape: OpsItemInvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: OpsItemAccessDeniedException)
       end)
 
       api.add_operation(:create_ops_metadata, Seahorse::Model::Operation.new.tap do |o|
@@ -4923,6 +4999,17 @@ module Aws::SSM
         o.errors << Shapes::ShapeRef.new(shape: ResourceDataSyncInvalidConfigurationException)
       end)
 
+      api.add_operation(:delete_resource_policy, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "DeleteResourcePolicy"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: DeleteResourcePolicyRequest)
+        o.output = Shapes::ShapeRef.new(shape: DeleteResourcePolicyResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
+        o.errors << Shapes::ShapeRef.new(shape: ResourcePolicyInvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourcePolicyConflictException)
+      end)
+
       api.add_operation(:deregister_managed_instance, Seahorse::Model::Operation.new.tap do |o|
         o.name = "DeregisterManagedInstance"
         o.http_method = "POST"
@@ -5658,6 +5745,7 @@ module Aws::SSM
         o.output = Shapes::ShapeRef.new(shape: GetOpsItemResponse)
         o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
         o.errors << Shapes::ShapeRef.new(shape: OpsItemNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: OpsItemAccessDeniedException)
       end)
 
       api.add_operation(:get_ops_metadata, Seahorse::Model::Operation.new.tap do |o|
@@ -5771,6 +5859,22 @@ module Aws::SSM
         o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
       end)
 
+      api.add_operation(:get_resource_policies, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "GetResourcePolicies"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: GetResourcePoliciesRequest)
+        o.output = Shapes::ShapeRef.new(shape: GetResourcePoliciesResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
+        o.errors << Shapes::ShapeRef.new(shape: ResourcePolicyInvalidParameterException)
+        o[:pager] = Aws::Pager.new(
+          limit_key: "max_results",
+          tokens: {
+            "next_token" => "next_token"
+          }
+        )
+      end)
+
       api.add_operation(:get_service_setting, Seahorse::Model::Operation.new.tap do |o|
         o.name = "GetServiceSetting"
         o.http_method = "POST"
@@ -6126,6 +6230,18 @@ module Aws::SSM
         o.errors << Shapes::ShapeRef.new(shape: IncompatiblePolicyException)
       end)
 
+      api.add_operation(:put_resource_policy, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "PutResourcePolicy"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: PutResourcePolicyRequest)
+        o.output = Shapes::ShapeRef.new(shape: PutResourcePolicyResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
+        o.errors << Shapes::ShapeRef.new(shape: ResourcePolicyInvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourcePolicyLimitExceededException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourcePolicyConflictException)
+      end)
+
       api.add_operation(:register_default_patch_baseline, Seahorse::Model::Operation.new.tap do |o|
         o.name = "RegisterDefaultPatchBaseline"
         o.http_method = "POST"
@@ -6450,6 +6566,7 @@ module Aws::SSM
         o.errors << Shapes::ShapeRef.new(shape: OpsItemAlreadyExistsException)
         o.errors << Shapes::ShapeRef.new(shape: OpsItemLimitExceededException)
         o.errors << Shapes::ShapeRef.new(shape: OpsItemInvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: OpsItemAccessDeniedException)
       end)
 
       api.add_operation(:update_ops_metadata, Seahorse::Model::Operation.new.tap do |o|

data/lib/aws-sdk-ssm/endpoints.rb

@@ -333,6 +333,20 @@ module Aws::SSM
       end
     end
 
+    class DeleteResourcePolicy
+      def self.build(context)
+        unless context.config.regional_endpoint
+          endpoint = context.config.endpoint.to_s
+        end
+        Aws::SSM::EndpointParameters.new(
+          region: context.config.region,
+          use_dual_stack: context.config.use_dualstack_endpoint,
+          use_fips: context.config.use_fips_endpoint,
+          endpoint: endpoint,
+        )
+      end
+    end
+
     class DeregisterManagedInstance
       def self.build(context)
         unless context.config.regional_endpoint
@@ -1173,6 +1187,20 @@ module Aws::SSM
       end
     end
 
+    class GetResourcePolicies
+      def self.build(context)
+        unless context.config.regional_endpoint
+          endpoint = context.config.endpoint.to_s
+        end
+        Aws::SSM::EndpointParameters.new(
+          region: context.config.region,
+          use_dual_stack: context.config.use_dualstack_endpoint,
+          use_fips: context.config.use_fips_endpoint,
+          endpoint: endpoint,
+        )
+      end
+    end
+
     class GetServiceSetting
       def self.build(context)
         unless context.config.regional_endpoint
@@ -1481,6 +1509,20 @@ module Aws::SSM
       end
     end
 
+    class PutResourcePolicy
+      def self.build(context)
+        unless context.config.regional_endpoint
+          endpoint = context.config.endpoint.to_s
+        end
+        Aws::SSM::EndpointParameters.new(
+          region: context.config.region,
+          use_dual_stack: context.config.use_dualstack_endpoint,
+          use_fips: context.config.use_fips_endpoint,
+          endpoint: endpoint,
+        )
+      end
+    end
+
     class RegisterDefaultPatchBaseline
       def self.build(context)
         unless context.config.regional_endpoint