@aws-sdk/client-detective 3.45.0 → 3.47.2

package/dist-es/runtimeConfig.js

@@ -1,21 +1,28 @@
-import { __assign } from "tslib";
+import { __assign, __awaiter, __generator } from "tslib";
 import packageInfo from "../package.json";
 import { decorateDefaultCredentialProvider } from "@aws-sdk/client-sts";
 import { NODE_REGION_CONFIG_FILE_OPTIONS, NODE_REGION_CONFIG_OPTIONS, NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, } from "@aws-sdk/config-resolver";
 import { defaultProvider as credentialDefaultProvider } from "@aws-sdk/credential-provider-node";
 import { Hash } from "@aws-sdk/hash-node";
-import { NODE_MAX_ATTEMPT_CONFIG_OPTIONS, NODE_RETRY_MODE_CONFIG_OPTIONS } from "@aws-sdk/middleware-retry";
+import { DEFAULT_RETRY_MODE, NODE_MAX_ATTEMPT_CONFIG_OPTIONS, NODE_RETRY_MODE_CONFIG_OPTIONS, } from "@aws-sdk/middleware-retry";
 import { loadConfig as loadNodeConfig } from "@aws-sdk/node-config-provider";
-import { NodeHttpHandler, streamCollector } from "@aws-sdk/node-http-handler";
+import { NodeHttpHandler as RequestHandler, streamCollector } from "@aws-sdk/node-http-handler";
 import { fromBase64, toBase64 } from "@aws-sdk/util-base64-node";
 import { calculateBodyLength } from "@aws-sdk/util-body-length-node";
 import { defaultUserAgent } from "@aws-sdk/util-user-agent-node";
 import { fromUtf8, toUtf8 } from "@aws-sdk/util-utf8-node";
 import { getRuntimeConfig as getSharedRuntimeConfig } from "./runtimeConfig.shared";
-import { emitWarningIfUnsupportedVersion } from "@aws-sdk/smithy-client";
+import { loadConfigsForDefaultMode } from "@aws-sdk/smithy-client";
+import { resolveDefaultsModeConfig } from "@aws-sdk/util-defaults-mode-node";
 export var getRuntimeConfig = function (config) {
     var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
-    emitWarningIfUnsupportedVersion(process.version);
+    var defaultsMode = resolveDefaultsModeConfig(config);
+    var defaultConfigProvider = function () { return defaultsMode().then(loadConfigsForDefaultMode); };
     var clientSharedValues = getSharedRuntimeConfig(config);
-    return __assign(__assign(__assign({}, clientSharedValues), config), { runtime: "node", base64Decoder: (_a = config === null || config === void 0 ? void 0 : config.base64Decoder) !== null && _a !== void 0 ? _a : fromBase64, base64Encoder: (_b = config === null || config === void 0 ? void 0 : config.base64Encoder) !== null && _b !== void 0 ? _b : toBase64, bodyLengthChecker: (_c = config === null || config === void 0 ? void 0 : config.bodyLengthChecker) !== null && _c !== void 0 ? _c : calculateBodyLength, credentialDefaultProvider: (_d = config === null || config === void 0 ? void 0 : config.credentialDefaultProvider) !== null && _d !== void 0 ? _d : decorateDefaultCredentialProvider(credentialDefaultProvider), defaultUserAgentProvider: (_e = config === null || config === void 0 ? void 0 : config.defaultUserAgentProvider) !== null && _e !== void 0 ? _e : defaultUserAgent({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }), maxAttempts: (_f = config === null || config === void 0 ? void 0 : config.maxAttempts) !== null && _f !== void 0 ? _f : loadNodeConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS), region: (_g = config === null || config === void 0 ? void 0 : config.region) !== null && _g !== void 0 ? _g : loadNodeConfig(NODE_REGION_CONFIG_OPTIONS, NODE_REGION_CONFIG_FILE_OPTIONS), requestHandler: (_h = config === null || config === void 0 ? void 0 : config.requestHandler) !== null && _h !== void 0 ? _h : new NodeHttpHandler(), retryMode: (_j = config === null || config === void 0 ? void 0 : config.retryMode) !== null && _j !== void 0 ? _j : loadNodeConfig(NODE_RETRY_MODE_CONFIG_OPTIONS), sha256: (_k = config === null || config === void 0 ? void 0 : config.sha256) !== null && _k !== void 0 ? _k : Hash.bind(null, "sha256"), streamCollector: (_l = config === null || config === void 0 ? void 0 : config.streamCollector) !== null && _l !== void 0 ? _l : streamCollector, useDualstackEndpoint: (_m = config === null || config === void 0 ? void 0 : config.useDualstackEndpoint) !== null && _m !== void 0 ? _m : loadNodeConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS), useFipsEndpoint: (_o = config === null || config === void 0 ? void 0 : config.useFipsEndpoint) !== null && _o !== void 0 ? _o : loadNodeConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS), utf8Decoder: (_p = config === null || config === void 0 ? void 0 : config.utf8Decoder) !== null && _p !== void 0 ? _p : fromUtf8, utf8Encoder: (_q = config === null || config === void 0 ? void 0 : config.utf8Encoder) !== null && _q !== void 0 ? _q : toUtf8 });
+    return __assign(__assign(__assign({}, clientSharedValues), config), { runtime: "node", defaultsMode: defaultsMode, base64Decoder: (_a = config === null || config === void 0 ? void 0 : config.base64Decoder) !== null && _a !== void 0 ? _a : fromBase64, base64Encoder: (_b = config === null || config === void 0 ? void 0 : config.base64Encoder) !== null && _b !== void 0 ? _b : toBase64, bodyLengthChecker: (_c = config === null || config === void 0 ? void 0 : config.bodyLengthChecker) !== null && _c !== void 0 ? _c : calculateBodyLength, credentialDefaultProvider: (_d = config === null || config === void 0 ? void 0 : config.credentialDefaultProvider) !== null && _d !== void 0 ? _d : decorateDefaultCredentialProvider(credentialDefaultProvider), defaultUserAgentProvider: (_e = config === null || config === void 0 ? void 0 : config.defaultUserAgentProvider) !== null && _e !== void 0 ? _e : defaultUserAgent({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }), maxAttempts: (_f = config === null || config === void 0 ? void 0 : config.maxAttempts) !== null && _f !== void 0 ? _f : loadNodeConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS), region: (_g = config === null || config === void 0 ? void 0 : config.region) !== null && _g !== void 0 ? _g : loadNodeConfig(NODE_REGION_CONFIG_OPTIONS, NODE_REGION_CONFIG_FILE_OPTIONS), requestHandler: (_h = config === null || config === void 0 ? void 0 : config.requestHandler) !== null && _h !== void 0 ? _h : new RequestHandler(defaultConfigProvider), retryMode: (_j = config === null || config === void 0 ? void 0 : config.retryMode) !== null && _j !== void 0 ? _j : loadNodeConfig(__assign(__assign({}, NODE_RETRY_MODE_CONFIG_OPTIONS), { default: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4, defaultConfigProvider()];
+                    case 1: return [2, (_a.sent()).retryMode || DEFAULT_RETRY_MODE];
+                }
+            }); }); } })), sha256: (_k = config === null || config === void 0 ? void 0 : config.sha256) !== null && _k !== void 0 ? _k : Hash.bind(null, "sha256"), streamCollector: (_l = config === null || config === void 0 ? void 0 : config.streamCollector) !== null && _l !== void 0 ? _l : streamCollector, useDualstackEndpoint: (_m = config === null || config === void 0 ? void 0 : config.useDualstackEndpoint) !== null && _m !== void 0 ? _m : loadNodeConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS), useFipsEndpoint: (_o = config === null || config === void 0 ? void 0 : config.useFipsEndpoint) !== null && _o !== void 0 ? _o : loadNodeConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS), utf8Decoder: (_p = config === null || config === void 0 ? void 0 : config.utf8Decoder) !== null && _p !== void 0 ? _p : fromUtf8, utf8Encoder: (_q = config === null || config === void 0 ? void 0 : config.utf8Encoder) !== null && _q !== void 0 ? _q : toUtf8 });
 };

package/dist-types/Detective.d.ts

@@ -4,32 +4,49 @@ import { CreateGraphCommandInput, CreateGraphCommandOutput } from "./commands/Cr
 import { CreateMembersCommandInput, CreateMembersCommandOutput } from "./commands/CreateMembersCommand";
 import { DeleteGraphCommandInput, DeleteGraphCommandOutput } from "./commands/DeleteGraphCommand";
 import { DeleteMembersCommandInput, DeleteMembersCommandOutput } from "./commands/DeleteMembersCommand";
+import { DescribeOrganizationConfigurationCommandInput, DescribeOrganizationConfigurationCommandOutput } from "./commands/DescribeOrganizationConfigurationCommand";
+import { DisableOrganizationAdminAccountCommandInput, DisableOrganizationAdminAccountCommandOutput } from "./commands/DisableOrganizationAdminAccountCommand";
 import { DisassociateMembershipCommandInput, DisassociateMembershipCommandOutput } from "./commands/DisassociateMembershipCommand";
+import { EnableOrganizationAdminAccountCommandInput, EnableOrganizationAdminAccountCommandOutput } from "./commands/EnableOrganizationAdminAccountCommand";
 import { GetMembersCommandInput, GetMembersCommandOutput } from "./commands/GetMembersCommand";
 import { ListGraphsCommandInput, ListGraphsCommandOutput } from "./commands/ListGraphsCommand";
 import { ListInvitationsCommandInput, ListInvitationsCommandOutput } from "./commands/ListInvitationsCommand";
 import { ListMembersCommandInput, ListMembersCommandOutput } from "./commands/ListMembersCommand";
+import { ListOrganizationAdminAccountsCommandInput, ListOrganizationAdminAccountsCommandOutput } from "./commands/ListOrganizationAdminAccountsCommand";
 import { ListTagsForResourceCommandInput, ListTagsForResourceCommandOutput } from "./commands/ListTagsForResourceCommand";
 import { RejectInvitationCommandInput, RejectInvitationCommandOutput } from "./commands/RejectInvitationCommand";
 import { StartMonitoringMemberCommandInput, StartMonitoringMemberCommandOutput } from "./commands/StartMonitoringMemberCommand";
 import { TagResourceCommandInput, TagResourceCommandOutput } from "./commands/TagResourceCommand";
 import { UntagResourceCommandInput, UntagResourceCommandOutput } from "./commands/UntagResourceCommand";
+import { UpdateOrganizationConfigurationCommandInput, UpdateOrganizationConfigurationCommandOutput } from "./commands/UpdateOrganizationConfigurationCommand";
 import { DetectiveClient } from "./DetectiveClient";
 /**
- * <p>Detective uses machine learning and purpose-built visualizations to help you analyze and
- *          investigate security issues across your Amazon Web Services (AWS) workloads. Detective automatically
- *          extracts time-based events such as login attempts, API calls, and network traffic from
- *          AWS CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by
- *          Amazon GuardDuty.</p>
- *          <p>The Detective API primarily supports the creation and management of behavior graphs. A
- *          behavior graph contains the extracted data from a set of member accounts, and is created
- *          and managed by an administrator account.</p>
- *          <p>Every behavior graph is specific to a Region. You can only use the API to manage graphs
- *          that belong to the Region that is associated with the currently selected endpoint.</p>
- *          <p>A Detective administrator account can use the Detective API to do the following:</p>
+ * <p>Detective uses machine learning and purpose-built visualizations to help you to
+ *          analyze and investigate security issues across your Amazon Web Services (Amazon Web Services) workloads. Detective automatically extracts time-based events such
+ *          as login attempts, API calls, and network traffic from CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by
+ *             Amazon GuardDuty.</p>
+ *          <p>The Detective API primarily supports the creation and management of behavior
+ *          graphs. A behavior graph contains the extracted data from a set of member accounts, and is
+ *          created and managed by an administrator account.</p>
+ *          <p>To add a member account to the behavior graph, the administrator account sends an
+ *          invitation to the account. When the account accepts the invitation, it becomes a member
+ *          account in the behavior graph.</p>
+ *          <p>Detective is also integrated with Organizations. The organization
+ *          management account designates the Detective administrator account for the
+ *          organization. That account becomes the administrator account for the organization behavior
+ *          graph. The Detective administrator account can enable any organization account as
+ *          a member account in the organization behavior graph. The organization accounts do not
+ *          receive invitations. The Detective administrator account can also invite other
+ *          accounts to the organization behavior graph.</p>
+ *          <p>Every behavior graph is specific to a Region. You can only use the API to manage
+ *          behavior graphs that belong to the Region that is associated with the currently selected
+ *          endpoint.</p>
+ *          <p>The administrator account for a behavior graph can use the Detective API to do
+ *          the following:</p>
  *          <ul>
  *             <li>
- *                <p>Enable and disable Detective. Enabling Detective creates a new behavior graph.</p>
+ *                <p>Enable and disable Detective. Enabling Detective creates a new
+ *                behavior graph.</p>
  *             </li>
  *             <li>
  *                <p>View the list of member accounts in a behavior graph.</p>
@@ -40,8 +57,23 @@ import { DetectiveClient } from "./DetectiveClient";
  *             <li>
  *                <p>Remove member accounts from a behavior graph.</p>
  *             </li>
+ *             <li>
+ *                <p>Apply tags to a behavior graph.</p>
+ *             </li>
+ *          </ul>
+ *          <p>The organization management account can use the Detective API to select the
+ *          delegated administrator for Detective.</p>
+ *          <p>The Detective administrator account for an organization can use the Detective API to do the following:</p>
+ *          <ul>
+ *             <li>
+ *                <p>Perform all of the functions of an administrator account.</p>
+ *             </li>
+ *             <li>
+ *                <p>Determine whether to automatically enable new organization accounts as member
+ *                accounts in the organization behavior graph.</p>
+ *             </li>
  *          </ul>
- *          <p>A member account can use the Detective API to do the following:</p>
+ *          <p>An invited member account can use the Detective API to do the following:</p>
  *          <ul>
  *             <li>
  *                <p>View the list of behavior graphs that they are invited to.</p>
@@ -60,7 +92,8 @@ import { DetectiveClient } from "./DetectiveClient";
  *          <note>
  *             <p>We replaced the term "master account" with the term "administrator account." An
  *             administrator account is used to centrally manage multiple accounts. In the case of
- *             Detective, the administrator account manages the accounts in their behavior graph.</p>
+ *                Detective, the administrator account manages the accounts in their behavior
+ *             graph.</p>
  *          </note>
  */
 export declare class Detective extends DetectiveClient {
@@ -75,15 +108,15 @@ export declare class Detective extends DetectiveClient {
     acceptInvitation(args: AcceptInvitationCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: AcceptInvitationCommandOutput) => void): void;
     /**
      * <p>Creates a new behavior graph for the calling account, and sets that account as the
-     *          administrator account. This operation is called by the account that is enabling
-     *          Detective.</p>
-     *          <p>Before you try to enable Detective, make sure that your account has been enrolled in
-     *          Amazon GuardDuty for at least 48 hours. If you do not meet this requirement, you cannot enable
-     *          Detective. If you do meet the GuardDuty prerequisite, then when you make the request to enable
-     *          Detective, it checks whether your data volume is within the Detective quota. If it exceeds the
-     *          quota, then you cannot enable Detective. </p>
-     *          <p>The operation also enables Detective for the calling account in the currently selected
-     *          Region. It returns the ARN of the new behavior graph.</p>
+     *          administrator account. This operation is called by the account that is enabling Detective.</p>
+     *          <p>Before you try to enable Detective, make sure that your account has been
+     *          enrolled in Amazon GuardDuty for at least 48 hours. If you do not meet this
+     *          requirement, you cannot enable Detective. If you do meet the GuardDuty
+     *          prerequisite, then when you make the request to enable Detective, it checks
+     *          whether your data volume is within the Detective quota. If it exceeds the quota,
+     *          then you cannot enable Detective. </p>
+     *          <p>The operation also enables Detective for the calling account in the currently
+     *          selected Region. It returns the ARN of the new behavior graph.</p>
      *          <p>
      *             <code>CreateGraph</code> triggers a process to create the corresponding data tables for
      *          the new behavior graph.</p>
@@ -95,21 +128,31 @@ export declare class Detective extends DetectiveClient {
     createGraph(args: CreateGraphCommandInput, cb: (err: any, data?: CreateGraphCommandOutput) => void): void;
     createGraph(args: CreateGraphCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateGraphCommandOutput) => void): void;
     /**
-     * <p>Sends a request to invite the specified AWS accounts to be member accounts in the
-     *          behavior graph. This operation can only be called by the administrator account for a
-     *          behavior graph. </p>
+     * <p>
+     *             <code>CreateMembers</code> is used to send invitations to accounts. For the organization
+     *          behavior graph, the Detective administrator account uses
+     *             <code>CreateMembers</code> to enable organization accounts as member accounts.</p>
+     *          <p>For invited accounts, <code>CreateMembers</code> sends a request to invite the specified
+     *             Amazon Web Services accounts to be member accounts in the behavior graph. This operation
+     *          can only be called by the administrator account for a behavior graph. </p>
      *          <p>
      *             <code>CreateMembers</code> verifies the accounts and then invites the verified accounts.
      *          The administrator can optionally specify to not send invitation emails to the member
      *          accounts. This would be used when the administrator manages their member accounts
      *          centrally.</p>
-     *          <p>The request provides the behavior graph ARN and the list of accounts to invite.</p>
+     *          <p>For organization accounts in the organization behavior graph, <code>CreateMembers</code>
+     *          attempts to enable the accounts. The organization accounts do not receive
+     *          invitations.</p>
+     *          <p>The request provides the behavior graph ARN and the list of accounts to invite or to
+     *          enable.</p>
      *          <p>The response separates the requested accounts into two lists:</p>
      *          <ul>
      *             <li>
-     *                <p>The accounts that <code>CreateMembers</code> was able to start the verification
-     *                for. This list includes member accounts that are being verified, that have passed
-     *                verification and are to be invited, and that have failed verification.</p>
+     *                <p>The accounts that <code>CreateMembers</code> was able to process. For invited
+     *                accounts, includes member accounts that are being verified, that have passed
+     *                verification and are to be invited, and that have failed verification. For
+     *                organization accounts in the organization behavior graph, includes accounts that can
+     *                be enabled and that cannot be enabled.</p>
      *             </li>
      *             <li>
      *                <p>The accounts that <code>CreateMembers</code> was unable to process. This list
@@ -123,7 +166,7 @@ export declare class Detective extends DetectiveClient {
     createMembers(args: CreateMembersCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateMembersCommandOutput) => void): void;
     /**
      * <p>Disables the specified behavior graph and queues it to be deleted. This operation
-     *          removes the graph from each member account's list of behavior graphs.</p>
+     *          removes the behavior graph from each member account's list of behavior graphs.</p>
      *          <p>
      *             <code>DeleteGraph</code> can only be called by the administrator account for a behavior
      *          graph.</p>
@@ -132,22 +175,67 @@ export declare class Detective extends DetectiveClient {
     deleteGraph(args: DeleteGraphCommandInput, cb: (err: any, data?: DeleteGraphCommandOutput) => void): void;
     deleteGraph(args: DeleteGraphCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DeleteGraphCommandOutput) => void): void;
     /**
-     * <p>Deletes one or more member accounts from the administrator account's behavior graph.
-     *          This operation can only be called by a Detective administrator account. That account cannot use
-     *             <code>DeleteMembers</code> to delete their own account from the behavior graph. To
-     *          disable a behavior graph, the administrator account uses the <code>DeleteGraph</code> API
-     *          method.</p>
+     * <p>Removes the specified member accounts from the behavior graph. The removed accounts no
+     *          longer contribute data to the behavior graph. This operation can only be called by the
+     *          administrator account for the behavior graph.</p>
+     *          <p>For invited accounts, the removed accounts are deleted from the list of accounts in the
+     *          behavior graph. To restore the account, the administrator account must send another
+     *          invitation.</p>
+     *          <p>For organization accounts in the organization behavior graph, the Detective
+     *          administrator account can always enable the organization account again. Organization
+     *          accounts that are not enabled as member accounts are not included in the
+     *             <code>ListMembers</code> results for the organization behavior graph.</p>
+     *          <p>An administrator account cannot use <code>DeleteMembers</code> to remove their own
+     *          account from the behavior graph. To disable a behavior graph, the administrator account
+     *          uses the <code>DeleteGraph</code> API method.</p>
      */
     deleteMembers(args: DeleteMembersCommandInput, options?: __HttpHandlerOptions): Promise<DeleteMembersCommandOutput>;
     deleteMembers(args: DeleteMembersCommandInput, cb: (err: any, data?: DeleteMembersCommandOutput) => void): void;
     deleteMembers(args: DeleteMembersCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DeleteMembersCommandOutput) => void): void;
+    /**
+     * <p>Returns information about the configuration for the organization behavior graph.
+     *          Currently indicates whether to automatically enable new organization accounts as member
+     *          accounts.</p>
+     *          <p>Can only be called by the Detective administrator account for the organization. </p>
+     */
+    describeOrganizationConfiguration(args: DescribeOrganizationConfigurationCommandInput, options?: __HttpHandlerOptions): Promise<DescribeOrganizationConfigurationCommandOutput>;
+    describeOrganizationConfiguration(args: DescribeOrganizationConfigurationCommandInput, cb: (err: any, data?: DescribeOrganizationConfigurationCommandOutput) => void): void;
+    describeOrganizationConfiguration(args: DescribeOrganizationConfigurationCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DescribeOrganizationConfigurationCommandOutput) => void): void;
+    /**
+     * <p>Removes the Detective administrator account for the organization in the current
+     *          Region. Deletes the behavior graph for that account.</p>
+     *          <p>Can only be called by the organization management account. Before you can select a
+     *          different Detective administrator account, you must remove the Detective
+     *          administrator account in all Regions.</p>
+     */
+    disableOrganizationAdminAccount(args: DisableOrganizationAdminAccountCommandInput, options?: __HttpHandlerOptions): Promise<DisableOrganizationAdminAccountCommandOutput>;
+    disableOrganizationAdminAccount(args: DisableOrganizationAdminAccountCommandInput, cb: (err: any, data?: DisableOrganizationAdminAccountCommandOutput) => void): void;
+    disableOrganizationAdminAccount(args: DisableOrganizationAdminAccountCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DisableOrganizationAdminAccountCommandOutput) => void): void;
     /**
      * <p>Removes the member account from the specified behavior graph. This operation can only be
-     *          called by a member account that has the <code>ENABLED</code> status.</p>
+     *          called by an invited member account that has the <code>ENABLED</code> status.</p>
+     *          <p>
+     *             <code>DisassociateMembership</code> cannot be called by an organization account in the
+     *          organization behavior graph. For the organization behavior graph, the Detective
+     *          administrator account determines which organization accounts to enable or disable as member
+     *          accounts.</p>
      */
     disassociateMembership(args: DisassociateMembershipCommandInput, options?: __HttpHandlerOptions): Promise<DisassociateMembershipCommandOutput>;
     disassociateMembership(args: DisassociateMembershipCommandInput, cb: (err: any, data?: DisassociateMembershipCommandOutput) => void): void;
     disassociateMembership(args: DisassociateMembershipCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DisassociateMembershipCommandOutput) => void): void;
+    /**
+     * <p>Designates the Detective administrator account for the organization in the
+     *          current Region.</p>
+     *          <p>If the account does not have Detective enabled, then enables Detective
+     *          for that account and creates a new behavior graph.</p>
+     *          <p>Can only be called by the organization management account.</p>
+     *          <p>The Detective administrator account for an organization must be the same in all
+     *          Regions. If you already designated a Detective administrator account in another
+     *          Region, then you must designate the same account.</p>
+     */
+    enableOrganizationAdminAccount(args: EnableOrganizationAdminAccountCommandInput, options?: __HttpHandlerOptions): Promise<EnableOrganizationAdminAccountCommandOutput>;
+    enableOrganizationAdminAccount(args: EnableOrganizationAdminAccountCommandInput, cb: (err: any, data?: EnableOrganizationAdminAccountCommandOutput) => void): void;
+    enableOrganizationAdminAccount(args: EnableOrganizationAdminAccountCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: EnableOrganizationAdminAccountCommandOutput) => void): void;
     /**
      * <p>Returns the membership details for specified member accounts for a behavior
      *          graph.</p>
@@ -166,7 +254,7 @@ export declare class Detective extends DetectiveClient {
     listGraphs(args: ListGraphsCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: ListGraphsCommandOutput) => void): void;
     /**
      * <p>Retrieves the list of open and accepted behavior graph invitations for the member
-     *          account. This operation can only be called by a member account.</p>
+     *          account. This operation can only be called by an invited member account.</p>
      *          <p>Open invitations are invitations that the member account has not responded to.</p>
      *          <p>The results do not include behavior graphs for which the member account declined the
      *          invitation. The results also do not include behavior graphs that the member account
@@ -176,12 +264,23 @@ export declare class Detective extends DetectiveClient {
     listInvitations(args: ListInvitationsCommandInput, cb: (err: any, data?: ListInvitationsCommandOutput) => void): void;
     listInvitations(args: ListInvitationsCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: ListInvitationsCommandOutput) => void): void;
     /**
-     * <p>Retrieves the list of member accounts for a behavior graph. Does not return member
-     *          accounts that were removed from the behavior graph.</p>
+     * <p>Retrieves the list of member accounts for a behavior graph.</p>
+     *          <p>For invited accounts, the results do not include member accounts that were removed from
+     *          the behavior graph.</p>
+     *          <p>For the organization behavior graph, the results do not include organization accounts
+     *          that the Detective administrator account has not enabled as member
+     *          accounts.</p>
      */
     listMembers(args: ListMembersCommandInput, options?: __HttpHandlerOptions): Promise<ListMembersCommandOutput>;
     listMembers(args: ListMembersCommandInput, cb: (err: any, data?: ListMembersCommandOutput) => void): void;
     listMembers(args: ListMembersCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: ListMembersCommandOutput) => void): void;
+    /**
+     * <p>Returns information about the Detective administrator account for an
+     *          organization. Can only be called by the organization management account.</p>
+     */
+    listOrganizationAdminAccounts(args: ListOrganizationAdminAccountsCommandInput, options?: __HttpHandlerOptions): Promise<ListOrganizationAdminAccountsCommandOutput>;
+    listOrganizationAdminAccounts(args: ListOrganizationAdminAccountsCommandInput, cb: (err: any, data?: ListOrganizationAdminAccountsCommandOutput) => void): void;
+    listOrganizationAdminAccounts(args: ListOrganizationAdminAccountsCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: ListOrganizationAdminAccountsCommandOutput) => void): void;
     /**
      * <p>Returns the tag values that are assigned to a behavior graph.</p>
      */
@@ -190,7 +289,12 @@ export declare class Detective extends DetectiveClient {
     listTagsForResource(args: ListTagsForResourceCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: ListTagsForResourceCommandOutput) => void): void;
     /**
      * <p>Rejects an invitation to contribute the account data to a behavior graph. This operation
-     *          must be called by a member account that has the <code>INVITED</code> status.</p>
+     *          must be called by an invited member account that has the <code>INVITED</code>
+     *          status.</p>
+     *          <p>
+     *             <code>RejectInvitation</code> cannot be called by an organization account in the
+     *          organization behavior graph. In the organization behavior graph, organization accounts do
+     *          not receive an invitation.</p>
      */
     rejectInvitation(args: RejectInvitationCommandInput, options?: __HttpHandlerOptions): Promise<RejectInvitationCommandOutput>;
     rejectInvitation(args: RejectInvitationCommandInput, cb: (err: any, data?: RejectInvitationCommandOutput) => void): void;
@@ -202,7 +306,7 @@ export declare class Detective extends DetectiveClient {
      *          <ul>
      *             <li>
      *                <p>If Detective enabled the member account, then the new status is
-     *                <code>ENABLED</code>.</p>
+     *                   <code>ENABLED</code>.</p>
      *             </li>
      *             <li>
      *                <p>If Detective cannot enable the member account, the status remains
@@ -225,4 +329,12 @@ export declare class Detective extends DetectiveClient {
     untagResource(args: UntagResourceCommandInput, options?: __HttpHandlerOptions): Promise<UntagResourceCommandOutput>;
     untagResource(args: UntagResourceCommandInput, cb: (err: any, data?: UntagResourceCommandOutput) => void): void;
     untagResource(args: UntagResourceCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: UntagResourceCommandOutput) => void): void;
+    /**
+     * <p>Updates the configuration for the Organizations integration in the current Region.
+     *          Can only be called by the Detective administrator account for the
+     *          organization.</p>
+     */
+    updateOrganizationConfiguration(args: UpdateOrganizationConfigurationCommandInput, options?: __HttpHandlerOptions): Promise<UpdateOrganizationConfigurationCommandOutput>;
+    updateOrganizationConfiguration(args: UpdateOrganizationConfigurationCommandInput, cb: (err: any, data?: UpdateOrganizationConfigurationCommandOutput) => void): void;
+    updateOrganizationConfiguration(args: UpdateOrganizationConfigurationCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: UpdateOrganizationConfigurationCommandOutput) => void): void;
 }

package/dist-types/DetectiveClient.d.ts

@@ -4,25 +4,30 @@ import { RetryInputConfig, RetryResolvedConfig } from "@aws-sdk/middleware-retry
 import { AwsAuthInputConfig, AwsAuthResolvedConfig } from "@aws-sdk/middleware-signing";
 import { UserAgentInputConfig, UserAgentResolvedConfig } from "@aws-sdk/middleware-user-agent";
 import { HttpHandler as __HttpHandler } from "@aws-sdk/protocol-http";
-import { Client as __Client, SmithyConfiguration as __SmithyConfiguration, SmithyResolvedConfiguration as __SmithyResolvedConfiguration } from "@aws-sdk/smithy-client";
+import { Client as __Client, DefaultsMode, SmithyConfiguration as __SmithyConfiguration, SmithyResolvedConfiguration as __SmithyResolvedConfiguration } from "@aws-sdk/smithy-client";
 import { Credentials as __Credentials, Decoder as __Decoder, Encoder as __Encoder, HashConstructor as __HashConstructor, HttpHandlerOptions as __HttpHandlerOptions, Logger as __Logger, Provider as __Provider, Provider, RegionInfoProvider, StreamCollector as __StreamCollector, UrlParser as __UrlParser, UserAgent as __UserAgent } from "@aws-sdk/types";
 import { AcceptInvitationCommandInput, AcceptInvitationCommandOutput } from "./commands/AcceptInvitationCommand";
 import { CreateGraphCommandInput, CreateGraphCommandOutput } from "./commands/CreateGraphCommand";
 import { CreateMembersCommandInput, CreateMembersCommandOutput } from "./commands/CreateMembersCommand";
 import { DeleteGraphCommandInput, DeleteGraphCommandOutput } from "./commands/DeleteGraphCommand";
 import { DeleteMembersCommandInput, DeleteMembersCommandOutput } from "./commands/DeleteMembersCommand";
+import { DescribeOrganizationConfigurationCommandInput, DescribeOrganizationConfigurationCommandOutput } from "./commands/DescribeOrganizationConfigurationCommand";
+import { DisableOrganizationAdminAccountCommandInput, DisableOrganizationAdminAccountCommandOutput } from "./commands/DisableOrganizationAdminAccountCommand";
 import { DisassociateMembershipCommandInput, DisassociateMembershipCommandOutput } from "./commands/DisassociateMembershipCommand";
+import { EnableOrganizationAdminAccountCommandInput, EnableOrganizationAdminAccountCommandOutput } from "./commands/EnableOrganizationAdminAccountCommand";
 import { GetMembersCommandInput, GetMembersCommandOutput } from "./commands/GetMembersCommand";
 import { ListGraphsCommandInput, ListGraphsCommandOutput } from "./commands/ListGraphsCommand";
 import { ListInvitationsCommandInput, ListInvitationsCommandOutput } from "./commands/ListInvitationsCommand";
 import { ListMembersCommandInput, ListMembersCommandOutput } from "./commands/ListMembersCommand";
+import { ListOrganizationAdminAccountsCommandInput, ListOrganizationAdminAccountsCommandOutput } from "./commands/ListOrganizationAdminAccountsCommand";
 import { ListTagsForResourceCommandInput, ListTagsForResourceCommandOutput } from "./commands/ListTagsForResourceCommand";
 import { RejectInvitationCommandInput, RejectInvitationCommandOutput } from "./commands/RejectInvitationCommand";
 import { StartMonitoringMemberCommandInput, StartMonitoringMemberCommandOutput } from "./commands/StartMonitoringMemberCommand";
 import { TagResourceCommandInput, TagResourceCommandOutput } from "./commands/TagResourceCommand";
 import { UntagResourceCommandInput, UntagResourceCommandOutput } from "./commands/UntagResourceCommand";
-export declare type ServiceInputTypes = AcceptInvitationCommandInput | CreateGraphCommandInput | CreateMembersCommandInput | DeleteGraphCommandInput | DeleteMembersCommandInput | DisassociateMembershipCommandInput | GetMembersCommandInput | ListGraphsCommandInput | ListInvitationsCommandInput | ListMembersCommandInput | ListTagsForResourceCommandInput | RejectInvitationCommandInput | StartMonitoringMemberCommandInput | TagResourceCommandInput | UntagResourceCommandInput;
-export declare type ServiceOutputTypes = AcceptInvitationCommandOutput | CreateGraphCommandOutput | CreateMembersCommandOutput | DeleteGraphCommandOutput | DeleteMembersCommandOutput | DisassociateMembershipCommandOutput | GetMembersCommandOutput | ListGraphsCommandOutput | ListInvitationsCommandOutput | ListMembersCommandOutput | ListTagsForResourceCommandOutput | RejectInvitationCommandOutput | StartMonitoringMemberCommandOutput | TagResourceCommandOutput | UntagResourceCommandOutput;
+import { UpdateOrganizationConfigurationCommandInput, UpdateOrganizationConfigurationCommandOutput } from "./commands/UpdateOrganizationConfigurationCommand";
+export declare type ServiceInputTypes = AcceptInvitationCommandInput | CreateGraphCommandInput | CreateMembersCommandInput | DeleteGraphCommandInput | DeleteMembersCommandInput | DescribeOrganizationConfigurationCommandInput | DisableOrganizationAdminAccountCommandInput | DisassociateMembershipCommandInput | EnableOrganizationAdminAccountCommandInput | GetMembersCommandInput | ListGraphsCommandInput | ListInvitationsCommandInput | ListMembersCommandInput | ListOrganizationAdminAccountsCommandInput | ListTagsForResourceCommandInput | RejectInvitationCommandInput | StartMonitoringMemberCommandInput | TagResourceCommandInput | UntagResourceCommandInput | UpdateOrganizationConfigurationCommandInput;
+export declare type ServiceOutputTypes = AcceptInvitationCommandOutput | CreateGraphCommandOutput | CreateMembersCommandOutput | DeleteGraphCommandOutput | DeleteMembersCommandOutput | DescribeOrganizationConfigurationCommandOutput | DisableOrganizationAdminAccountCommandOutput | DisassociateMembershipCommandOutput | EnableOrganizationAdminAccountCommandOutput | GetMembersCommandOutput | ListGraphsCommandOutput | ListInvitationsCommandOutput | ListMembersCommandOutput | ListOrganizationAdminAccountsCommandOutput | ListTagsForResourceCommandOutput | RejectInvitationCommandOutput | StartMonitoringMemberCommandOutput | TagResourceCommandOutput | UntagResourceCommandOutput | UpdateOrganizationConfigurationCommandOutput;
 export interface ClientDefaults extends Partial<__SmithyResolvedConfiguration<__HttpHandlerOptions>> {
     /**
      * The HTTP handler to use. Fetch in browser and Https in Nodejs.
@@ -123,6 +128,10 @@ export interface ClientDefaults extends Partial<__SmithyResolvedConfiguration<__
      * @internal
      */
     defaultUserAgentProvider?: Provider<__UserAgent>;
+    /**
+     * The {@link DefaultsMode} that will be used to determine how certain default configuration options are resolved in the SDK.
+     */
+    defaultsMode?: DefaultsMode | Provider<DefaultsMode>;
 }
 declare type DetectiveClientConfigType = Partial<__SmithyConfiguration<__HttpHandlerOptions>> & ClientDefaults & RegionInputConfig & EndpointsInputConfig & RetryInputConfig & HostHeaderInputConfig & AwsAuthInputConfig & UserAgentInputConfig;
 /**
@@ -137,20 +146,32 @@ declare type DetectiveClientResolvedConfigType = __SmithyResolvedConfiguration<_
 export interface DetectiveClientResolvedConfig extends DetectiveClientResolvedConfigType {
 }
 /**
- * <p>Detective uses machine learning and purpose-built visualizations to help you analyze and
- *          investigate security issues across your Amazon Web Services (AWS) workloads. Detective automatically
- *          extracts time-based events such as login attempts, API calls, and network traffic from
- *          AWS CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by
- *          Amazon GuardDuty.</p>
- *          <p>The Detective API primarily supports the creation and management of behavior graphs. A
- *          behavior graph contains the extracted data from a set of member accounts, and is created
- *          and managed by an administrator account.</p>
- *          <p>Every behavior graph is specific to a Region. You can only use the API to manage graphs
- *          that belong to the Region that is associated with the currently selected endpoint.</p>
- *          <p>A Detective administrator account can use the Detective API to do the following:</p>
+ * <p>Detective uses machine learning and purpose-built visualizations to help you to
+ *          analyze and investigate security issues across your Amazon Web Services (Amazon Web Services) workloads. Detective automatically extracts time-based events such
+ *          as login attempts, API calls, and network traffic from CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by
+ *             Amazon GuardDuty.</p>
+ *          <p>The Detective API primarily supports the creation and management of behavior
+ *          graphs. A behavior graph contains the extracted data from a set of member accounts, and is
+ *          created and managed by an administrator account.</p>
+ *          <p>To add a member account to the behavior graph, the administrator account sends an
+ *          invitation to the account. When the account accepts the invitation, it becomes a member
+ *          account in the behavior graph.</p>
+ *          <p>Detective is also integrated with Organizations. The organization
+ *          management account designates the Detective administrator account for the
+ *          organization. That account becomes the administrator account for the organization behavior
+ *          graph. The Detective administrator account can enable any organization account as
+ *          a member account in the organization behavior graph. The organization accounts do not
+ *          receive invitations. The Detective administrator account can also invite other
+ *          accounts to the organization behavior graph.</p>
+ *          <p>Every behavior graph is specific to a Region. You can only use the API to manage
+ *          behavior graphs that belong to the Region that is associated with the currently selected
+ *          endpoint.</p>
+ *          <p>The administrator account for a behavior graph can use the Detective API to do
+ *          the following:</p>
  *          <ul>
  *             <li>
- *                <p>Enable and disable Detective. Enabling Detective creates a new behavior graph.</p>
+ *                <p>Enable and disable Detective. Enabling Detective creates a new
+ *                behavior graph.</p>
  *             </li>
  *             <li>
  *                <p>View the list of member accounts in a behavior graph.</p>
@@ -161,8 +182,23 @@ export interface DetectiveClientResolvedConfig extends DetectiveClientResolvedCo
  *             <li>
  *                <p>Remove member accounts from a behavior graph.</p>
  *             </li>
+ *             <li>
+ *                <p>Apply tags to a behavior graph.</p>
+ *             </li>
+ *          </ul>
+ *          <p>The organization management account can use the Detective API to select the
+ *          delegated administrator for Detective.</p>
+ *          <p>The Detective administrator account for an organization can use the Detective API to do the following:</p>
+ *          <ul>
+ *             <li>
+ *                <p>Perform all of the functions of an administrator account.</p>
+ *             </li>
+ *             <li>
+ *                <p>Determine whether to automatically enable new organization accounts as member
+ *                accounts in the organization behavior graph.</p>
+ *             </li>
  *          </ul>
- *          <p>A member account can use the Detective API to do the following:</p>
+ *          <p>An invited member account can use the Detective API to do the following:</p>
  *          <ul>
  *             <li>
  *                <p>View the list of behavior graphs that they are invited to.</p>
@@ -181,7 +217,8 @@ export interface DetectiveClientResolvedConfig extends DetectiveClientResolvedCo
  *          <note>
  *             <p>We replaced the term "master account" with the term "administrator account." An
  *             administrator account is used to centrally manage multiple accounts. In the case of
- *             Detective, the administrator account manages the accounts in their behavior graph.</p>
+ *                Detective, the administrator account manages the accounts in their behavior
+ *             graph.</p>
  *          </note>
  */
 export declare class DetectiveClient extends __Client<__HttpHandlerOptions, ServiceInputTypes, ServiceOutputTypes, DetectiveClientResolvedConfig> {

package/dist-types/commands/CreateGraphCommand.d.ts

@@ -8,15 +8,15 @@ export interface CreateGraphCommandOutput extends CreateGraphResponse, __Metadat
 }
 /**
  * <p>Creates a new behavior graph for the calling account, and sets that account as the
- *          administrator account. This operation is called by the account that is enabling
- *          Detective.</p>
- *          <p>Before you try to enable Detective, make sure that your account has been enrolled in
- *          Amazon GuardDuty for at least 48 hours. If you do not meet this requirement, you cannot enable
- *          Detective. If you do meet the GuardDuty prerequisite, then when you make the request to enable
- *          Detective, it checks whether your data volume is within the Detective quota. If it exceeds the
- *          quota, then you cannot enable Detective. </p>
- *          <p>The operation also enables Detective for the calling account in the currently selected
- *          Region. It returns the ARN of the new behavior graph.</p>
+ *          administrator account. This operation is called by the account that is enabling Detective.</p>
+ *          <p>Before you try to enable Detective, make sure that your account has been
+ *          enrolled in Amazon GuardDuty for at least 48 hours. If you do not meet this
+ *          requirement, you cannot enable Detective. If you do meet the GuardDuty
+ *          prerequisite, then when you make the request to enable Detective, it checks
+ *          whether your data volume is within the Detective quota. If it exceeds the quota,
+ *          then you cannot enable Detective. </p>
+ *          <p>The operation also enables Detective for the calling account in the currently
+ *          selected Region. It returns the ARN of the new behavior graph.</p>
  *          <p>
  *             <code>CreateGraph</code> triggers a process to create the corresponding data tables for
  *          the new behavior graph.</p>

package/dist-types/commands/CreateMembersCommand.d.ts

@@ -7,21 +7,31 @@ export interface CreateMembersCommandInput extends CreateMembersRequest {
 export interface CreateMembersCommandOutput extends CreateMembersResponse, __MetadataBearer {
 }
 /**
- * <p>Sends a request to invite the specified AWS accounts to be member accounts in the
- *          behavior graph. This operation can only be called by the administrator account for a
- *          behavior graph. </p>
+ * <p>
+ *             <code>CreateMembers</code> is used to send invitations to accounts. For the organization
+ *          behavior graph, the Detective administrator account uses
+ *             <code>CreateMembers</code> to enable organization accounts as member accounts.</p>
+ *          <p>For invited accounts, <code>CreateMembers</code> sends a request to invite the specified
+ *             Amazon Web Services accounts to be member accounts in the behavior graph. This operation
+ *          can only be called by the administrator account for a behavior graph. </p>
  *          <p>
  *             <code>CreateMembers</code> verifies the accounts and then invites the verified accounts.
  *          The administrator can optionally specify to not send invitation emails to the member
  *          accounts. This would be used when the administrator manages their member accounts
  *          centrally.</p>
- *          <p>The request provides the behavior graph ARN and the list of accounts to invite.</p>
+ *          <p>For organization accounts in the organization behavior graph, <code>CreateMembers</code>
+ *          attempts to enable the accounts. The organization accounts do not receive
+ *          invitations.</p>
+ *          <p>The request provides the behavior graph ARN and the list of accounts to invite or to
+ *          enable.</p>
  *          <p>The response separates the requested accounts into two lists:</p>
  *          <ul>
  *             <li>
- *                <p>The accounts that <code>CreateMembers</code> was able to start the verification
- *                for. This list includes member accounts that are being verified, that have passed
- *                verification and are to be invited, and that have failed verification.</p>
+ *                <p>The accounts that <code>CreateMembers</code> was able to process. For invited
+ *                accounts, includes member accounts that are being verified, that have passed
+ *                verification and are to be invited, and that have failed verification. For
+ *                organization accounts in the organization behavior graph, includes accounts that can
+ *                be enabled and that cannot be enabled.</p>
  *             </li>
  *             <li>
  *                <p>The accounts that <code>CreateMembers</code> was unable to process. This list

package/dist-types/commands/DeleteGraphCommand.d.ts

@@ -8,7 +8,7 @@ export interface DeleteGraphCommandOutput extends __MetadataBearer {
 }
 /**
  * <p>Disables the specified behavior graph and queues it to be deleted. This operation
- *          removes the graph from each member account's list of behavior graphs.</p>
+ *          removes the behavior graph from each member account's list of behavior graphs.</p>
  *          <p>
  *             <code>DeleteGraph</code> can only be called by the administrator account for a behavior
  *          graph.</p>

package/dist-types/commands/DeleteMembersCommand.d.ts

@@ -7,11 +7,19 @@ export interface DeleteMembersCommandInput extends DeleteMembersRequest {
 export interface DeleteMembersCommandOutput extends DeleteMembersResponse, __MetadataBearer {
 }
 /**
- * <p>Deletes one or more member accounts from the administrator account's behavior graph.
- *          This operation can only be called by a Detective administrator account. That account cannot use
- *             <code>DeleteMembers</code> to delete their own account from the behavior graph. To
- *          disable a behavior graph, the administrator account uses the <code>DeleteGraph</code> API
- *          method.</p>
+ * <p>Removes the specified member accounts from the behavior graph. The removed accounts no
+ *          longer contribute data to the behavior graph. This operation can only be called by the
+ *          administrator account for the behavior graph.</p>
+ *          <p>For invited accounts, the removed accounts are deleted from the list of accounts in the
+ *          behavior graph. To restore the account, the administrator account must send another
+ *          invitation.</p>
+ *          <p>For organization accounts in the organization behavior graph, the Detective
+ *          administrator account can always enable the organization account again. Organization
+ *          accounts that are not enabled as member accounts are not included in the
+ *             <code>ListMembers</code> results for the organization behavior graph.</p>
+ *          <p>An administrator account cannot use <code>DeleteMembers</code> to remove their own
+ *          account from the behavior graph. To disable a behavior graph, the administrator account
+ *          uses the <code>DeleteGraph</code> API method.</p>
  * @example
  * Use a bare-bones client and the command you need to make an API call.
  * ```javascript