@intentius/chant-lexicon-aws 0.41.20 → 0.44.1

package/dist/okf/types/EC2Fleet.md

@@ -0,0 +1,30 @@
+---
+type: resource-type
+title: EC2Fleet
+description: aws resource type AWS::EC2::EC2Fleet
+name: EC2Fleet
+lexicon: aws
+resource_type: AWS::EC2::EC2Fleet
+---
+`AWS::EC2::EC2Fleet`, a resource type of the aws lexicon.
+
+## Properties
+
+- `LaunchTemplateConfigs` (`EC2Fleet_FleetLaunchTemplateConfigRequest[]`, required)
+- `TargetCapacitySpecification` (`EC2Fleet_TargetCapacitySpecificationRequest`, required)
+- `Context` (`string`, optional)
+- `ExcessCapacityTerminationPolicy` (`"no-termination" | "termination"`, optional)
+- `FleetId` (`string`, optional)
+- `OnDemandOptions` (`EC2Fleet_OnDemandOptionsRequest`, optional)
+- `ReplaceUnhealthyInstances` (`boolean`, optional)
+- `ReservedCapacityOptions` (`EC2Fleet_ReservedCapacityOptionsRequest`, optional)
+- `SpotOptions` (`EC2Fleet_SpotOptionsRequest`, optional)
+- `TagSpecifications` (`EC2Fleet_TagSpecification[]`, optional)
+- `TerminateInstancesWithExpiration` (`boolean`, optional)
+- `Type` (`"instant" | "maintain" | "request"`, optional)
+- `ValidFrom` (`string`, optional)
+- `ValidUntil` (`string`, optional)
+
+## Attributes
+
+- `FleetId`

package/dist/okf/types/EC2Route.md

@@ -0,0 +1,37 @@
+---
+type: resource-type
+title: EC2Route
+description: aws resource type AWS::EC2::Route
+name: EC2Route
+lexicon: aws
+resource_type: AWS::EC2::Route
+---
+`AWS::EC2::Route`, a resource type of the aws lexicon.
+
+## Properties
+
+- `RouteTableId` (`string`, required): The ID of the route table for the route.
+- `CarrierGatewayId` (`string`, optional): The ID of the carrier gateway. You can only use this option when the VPC contains a subnet which is associated with a Wavelength Zone.
+- `CidrBlock` (`string`, optional)
+- `CoreNetworkArn` (`string`, optional): The Amazon Resource Name (ARN) of the core network.
+- `DestinationCidrBlock` (`string`, optional): The IPv4 CIDR address block used for the destination match. Routing decisions are based on the most specific match. We modify the specified CIDR block to its canonical form; for example, if you specify ``100.68.0.18/18``, we modify it to ``100.68.0.0/18``.
+- `DestinationIpv6CidrBlock` (`string`, optional): The IPv6 CIDR block used for the destination match. Routing decisions are based on the most specific match.
+- `DestinationPrefixListId` (`string`, optional): The ID of a prefix list used for the destination match.
+- `EgressOnlyInternetGatewayId` (`string`, optional): [IPv6 traffic only] The ID of an egress-only internet gateway.
+- `GatewayId` (`string`, optional): The ID of an internet gateway or virtual private gateway attached to your VPC.
+- `InstanceId` (`string`, optional): The ID of a NAT instance in your VPC. The operation fails if you specify an instance ID unless exactly one network interface is attached.
+- `LocalGatewayId` (`string`, optional): The ID of the local gateway.
+- `NatGatewayId` (`string`, optional): [IPv4 traffic only] The ID of a NAT gateway.
+- `NetworkInterfaceId` (`string`, optional): The ID of a network interface.
+- `OdbNetworkArn` (`string`, optional): The Amazon Resource Name (ARN) of the ODB network.
+- `TransitGatewayId` (`string`, optional): The ID of a transit gateway.
+- `VpcEndpointId` (`string`, optional): The ID of a VPC endpoint. Supported for Gateway Load Balancer endpoints only.
+- `VpcPeeringConnectionId` (`string`, optional): The ID of a VPC peering connection.
+
+## Attributes
+
+- `CidrBlock`
+
+## Governed by
+
+- [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns

package/dist/okf/types/EC2SecurityGroupIngress.md

@@ -0,0 +1,34 @@
+---
+type: resource-type
+title: EC2SecurityGroupIngress
+description: aws resource type AWS::EC2::SecurityGroupIngress
+name: EC2SecurityGroupIngress
+lexicon: aws
+resource_type: AWS::EC2::SecurityGroupIngress
+---
+`AWS::EC2::SecurityGroupIngress`, a resource type of the aws lexicon.
+
+## Properties
+
+- `IpProtocol` (`string`, required): The IP protocol name (tcp, udp, icmp, icmpv6) or number (see Protocol Numbers). [VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp, udp, icmp, or icmpv6 allows traffic on all ports, regardless of any port range you specify. For tcp, udp, and icmp, you must specify a port range. For icmpv6, the port range is optional; if you omit the port range, traffic for all types and codes is allowed.
+- `CidrIp` (`string`, optional): The IPv4 ranges
+- `CidrIpv6` (`string`, optional): [VPC only] The IPv6 ranges
+- `Description` (`string`, optional): Updates the description of an ingress (inbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously
+- `FromPort` (`number`, optional): The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes. Use this for ICMP and any protocol that uses ports.
+- `GroupId` (`string`, optional): The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID. You must specify the GroupName property or the GroupId property. For security groups that are in a VPC, you must use the GroupId property.
+- `GroupName` (`string`, optional): The name of the security group.
+- `Id` (`string`, optional): The Security Group Rule Id
+- `SourcePrefixListId` (`string`, optional): [EC2-VPC only] The ID of a prefix list.
+- `SourceSecurityGroupId` (`string`, optional): The ID of the security group. You must specify either the security group ID or the security group name. For security groups in a nondefault VPC, you must specify the security group ID.
+- `SourceSecurityGroupName` (`string`, optional): [EC2-Classic, default VPC] The name of the source security group. You must specify the GroupName property or the GroupId property. For security groups that are in a VPC, you must use the GroupId property.
+- `SourceSecurityGroupOwnerId` (`string`, optional): [nondefault VPC] The AWS account ID that owns the source security group. You can't specify this property with an IP address range. If you specify SourceSecurityGroupName or SourceSecurityGroupId and that security group is owned by a different account than the account creating the stack, you must specify the SourceSecurityGroupOwnerId; otherwise, this property is optional.
+- `ToPort` (`number`, optional): The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes. Use this for ICMP and any protocol that uses ports.
+
+## Attributes
+
+- `Id`
+
+## Governed by
+
+- [WAW019](/rules/WAW019.md): Security group allows unrestricted ingress on sensitive ports (SSH, RDP, database)
+- [WAW049](/rules/WAW049.md): Security group allows unrestricted ingress on a port other than ALB:80/443

package/dist/okf/types/EC2Volume.md

@@ -0,0 +1,36 @@
+---
+type: resource-type
+title: EC2Volume
+description: aws resource type AWS::EC2::Volume
+name: EC2Volume
+lexicon: aws
+resource_type: AWS::EC2::Volume
+---
+`AWS::EC2::Volume`, a resource type of the aws lexicon.
+
+## Properties
+
+- `AutoEnableIO` (`boolean`, optional): Indicates whether the volume is auto-enabled for I/O operations. By default, EBS disables I/O to the volume from attached EC2 instances when it determines that a volume's data is potentially inconsistent. If the consistency of the volume is not a concern, and you prefer that the volume be made available immediately if it's impaired, you can configure the volume to automatically enable I/O.
+- `AvailabilityZone` (`string`, optional): The ID of the Availability Zone in which to create the volume. For example, ``us-east-1a``. Either ``AvailabilityZone`` or ``AvailabilityZoneId`` must be specified, but not both. If you are creating a volume copy, omit this parameter. The volume copy is created in the same Availability Zone as the source volume.
+- `AvailabilityZoneId` (`string`, optional): The ID of the Availability Zone in which to create the volume. For example, ``use1-az1``. Either ``AvailabilityZone`` or ``AvailabilityZoneId`` must be specified, but not both. If you are creating a volume copy, omit this parameter. The volume copy is created in the same Availability Zone as the source volume.
+- `Encrypted` (`boolean`, optional): Indicates whether the volume should be encrypted. The effect of setting the encryption state to ``true`` depends on the volume origin (new, from a snapshot, or from an existing volume), starting encryption state, ownership, and whether encryption by default is enabled. For more information, see [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#encryption-by-default) in the *Amazon EBS User Guide*. If you are creating a volume copy, omit this parameter. The volume is automatically encrypted with the same KMS key as the source volume. You can't copy unencrypted volumes.
+- `Iops` (`number`, optional): The number of I/O operations per second (IOPS) to provision for the volume. Required for ``io1`` and ``io2`` volumes. Optional for ``gp3`` volumes. Omit for all other volume types. Valid ranges: + gp3: ``3,000``(*default*)``- 80,000`` IOPS + io1: ``100 - 64,000`` IOPS + io2: ``100 - 256,000`` IOPS [Instances built on the Nitro System](https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-nitro-instances.html) can support up to 256,000 IOPS. Other instances can support up to 32,000 IOPS.
+- `KmsKeyId` (`string`, optional): The identifier of the kms-key-long to use for Amazon EBS encryption. If ``KmsKeyId`` is specified, the encrypted state must be ``true``. If you omit this property and your account is enabled for encryption by default, or *Encrypted* is set to ``true``, then the volume is encrypted using the default key specified for your account. If your account does not have a default key, then the volume is encrypted using the aws-managed-key. Alternatively, if you want to specify a different key, you can specify one of the following: + Key ID. For example, 1234abcd-12ab-34cd-56ef-1234567890ab. + Key alias. Specify the alias for the key, prefixed with ``alias/``. For example, for a key with the alias ``my_cmk``, use ``alias/my_cmk``. Or to specify the aws-managed-key, use ``alias/aws/ebs``. + Key ARN. For example, arn:aws:kms:us-east-1:012345678910:key/1234abcd-12ab-34cd-56ef-1234567890ab. + Alias ARN. For example, arn:aws:kms:us-east-1:012345678910:alias/ExampleAlias. If you are creating a volume copy, omit this parameter. The volume is automatically encrypted with the same KMS key as the source volume. You can't copy unencrypted volumes.
+- `MultiAttachEnabled` (`boolean`, optional): Indicates whether Amazon EBS Multi-Attach is enabled. CFNlong does not currently support updating a single-attach volume to be multi-attach enabled, updating a multi-attach enabled volume to be single-attach, or updating the size or number of I/O operations per second (IOPS) of a multi-attach enabled volume.
+- `OutpostArn` (`string`, optional): The Amazon Resource Name (ARN) of the Outpost on which to create the volume. If you intend to use a volume with an instance running on an outpost, then you must create the volume on the same outpost as the instance. You can't use a volume created in an AWS Region with an instance on an AWS outpost, or the other way around.
+- `Size` (`number`, optional): The size of the volume, in GiBs. + Required for new empty volumes. + Optional for volumes created from snapshots and volume copies. In this case, the size defaults to the size of the snapshot or source volume. You can optionally specify a size that is equal to or larger than the size of the source snapshot or volume. Supported volume sizes: + gp2: ``1 - 16,384`` GiB + gp3: ``1 - 65,536`` GiB + io1: ``4 - 16,384`` GiB + io2: ``4 - 65,536`` GiB + st1 and sc1: ``125 - 16,384`` GiB + standard: ``1 - 1024`` GiB
+- `SnapshotId` (`string`, optional): The snapshot from which to create the volume. Only specify to create a volume from a snapshot. To create a new empty volume, omit this parameter and specify a value for ``Size`` instead. To create a volume copy, omit this parameter and specify ``SourceVolumeId`` instead.
+- `SourceVolumeId` (`string`, optional): The ID of the source EBS volume to copy. When specified, the volume is created as an exact copy of the specified volume. Only specify to create a volume copy. To create a new empty volume or to create a volume from a snapshot, omit this parameter,
+- `Tags` (`EC2Volume_Tag[]`, optional): The tags to apply to the volume during creation.
+- `Throughput` (`number`, optional): The throughput to provision for a volume, with a maximum of 2,000 MiB/s. This parameter is valid only for ``gp3`` volumes. The default value is 125. Valid Range: Minimum value of 125. Maximum value of 2000. The maximum ratio of throughput to IOPS is 0.25 MiB/s per IOPS. For example, a volume with 3,000 IOPS can have a maximum throughput of 750 MiB/s (3,000 x 0.25).
+- `VolumeId` (`string`, optional)
+- `VolumeInitializationRate` (`number`, optional): Specifies the Amazon EBS Provisioned Rate for Volume Initialization (volume initialization rate), in MiB/s, at which to download the snapshot blocks from Amazon S3 to the volume. This is also known as *volume initialization*. Specifying a volume initialization rate ensures that the volume is initialized at a predictable and consistent rate after creation. This parameter is supported only for volumes created from snapshots. Omit this parameter if: + You want to create the volume using fast snapshot restore. You must specify a snapshot that is enabled for fast snapshot restore. In this case, the volume is fully initialized at creation. If you specify a snapshot that is enabled for fast snapshot restore and a volume initialization rate, the volume will be initialized at the specified rate instead of fast snapshot restore. + You want to create a volume that is initialized at the default rate. For more information, see [Initialize Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/initalize-volume.html) in the *Amazon EC2 User Guide*. Valid range: 100 - 300 MiB/s
+- `VolumeType` (`string`, optional): The volume type. This parameter can be one of the following values: + General Purpose SSD: ``gp2`` | ``gp3`` + Provisioned IOPS SSD: ``io1`` | ``io2`` + Throughput Optimized HDD: ``st1`` + Cold HDD: ``sc1`` + Magnetic: ``standard`` Throughput Optimized HDD (``st1``) and Cold HDD (``sc1``) volumes can't be used as boot volumes. For more information, see [Amazon EBS volume types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volume-types.html) in the *Amazon EBS User Guide*. Default: ``gp2``
+
+## Attributes
+
+- `VolumeId`
+
+## Governed by
+
+- [WAW028](/rules/WAW028.md): EBS volume is not encrypted — enable encryption at rest

package/dist/okf/types/ECRRegistryPolicy.md

@@ -0,0 +1,18 @@
+---
+type: resource-type
+title: ECRRegistryPolicy
+description: aws resource type AWS::ECR::RegistryPolicy
+name: ECRRegistryPolicy
+lexicon: aws
+resource_type: AWS::ECR::RegistryPolicy
+---
+`AWS::ECR::RegistryPolicy`, a resource type of the aws lexicon.
+
+## Properties
+
+- `PolicyText` (`Record<string, unknown>`, required): The JSON policy text for your registry.
+- `RegistryId` (`string`, optional)
+
+## Attributes
+
+- `RegistryId`

package/dist/okf/types/ECRRepository.md

@@ -0,0 +1,33 @@
+---
+type: resource-type
+title: ECRRepository
+description: aws resource type AWS::ECR::Repository
+name: ECRRepository
+lexicon: aws
+resource_type: AWS::ECR::Repository
+---
+`AWS::ECR::Repository`, a resource type of the aws lexicon.
+
+## Properties
+
+- `Arn` (`string`, optional)
+- `EmptyOnDelete` (`boolean`, optional): If true, deleting the repository force deletes the contents of the repository. If false, the repository must be empty before attempting to delete it.
+- `EncryptionConfiguration` (`ECRRepository_EncryptionConfiguration`, optional): The encryption configuration for the repository. This determines how the contents of your repository are encrypted at rest.
+- `ImageScanningConfiguration` (`ECRRepository_ImageScanningConfiguration`, optional): The ``imageScanningConfiguration`` parameter is being deprecated, in favor of specifying the image scanning configuration at the registry level. For more information, see ``PutRegistryScanningConfiguration``. The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
+- `ImageTagMutability` (`"IMMUTABLE" | "IMMUTABLE_WITH_EXCLUSION" | "MUTABLE" | "MUTABLE_WITH_EXCLUSION"`, optional): The tag mutability setting for the repository. If this parameter is omitted, the default setting of ``MUTABLE`` will be used which will allow image tags to be overwritten. If ``IMMUTABLE`` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+- `ImageTagMutabilityExclusionFilters` (`ECRRepository_ImageTagMutabilityExclusionFilter[]`, optional): A list of filters that specify which image tags are excluded from the repository's image tag mutability setting.
+- `LifecyclePolicy` (`ECRRepository_LifecyclePolicy`, optional): Creates or updates a lifecycle policy. For information about lifecycle policy syntax, see [Lifecycle policy template](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html).
+- `RepositoryName` (`string`, optional): The name to use for the repository. The repository name may be specified on its own (such as ``nginx-web-app``) or it can be prepended with a namespace to group the repository into a category (such as ``project-a/nginx-web-app``). If you don't specify a name, CFNlong generates a unique physical ID and uses that ID for the repository name. For more information, see [Name type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html). The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
+- `RepositoryPolicyText` (`Record<string, unknown>`, optional): The JSON repository policy text to apply to the repository. For more information, see [Amazon ECR repository policies](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html) in the *Amazon Elastic Container Registry User Guide*.
+- `RepositoryUri` (`string`, optional)
+- `Tags` (`ECRRepository_Tag[]`, optional): An array of key-value pairs to apply to this resource.
+
+## Attributes
+
+- `Arn`
+- `RepositoryUri`
+
+## Governed by
+
+- [WAW053](/rules/WAW053.md): ECR repository does not scan images on push
+- [WAW054](/rules/WAW054.md): ECR repository does not have immutable image tags

package/dist/okf/types/ECSCapacityProvider.md

@@ -0,0 +1,17 @@
+---
+type: resource-type
+title: ECSCapacityProvider
+description: aws resource type AWS::ECS::CapacityProvider
+name: ECSCapacityProvider
+lexicon: aws
+resource_type: AWS::ECS::CapacityProvider
+---
+`AWS::ECS::CapacityProvider`, a resource type of the aws lexicon.
+
+## Properties
+
+- `AutoScalingGroupProvider` (`ECSCapacityProvider_AutoScalingGroupProvider`, optional)
+- `ClusterName` (`string`, optional)
+- `ManagedInstancesProvider` (`ECSCapacityProvider_ManagedInstancesProvider`, optional)
+- `Name` (`string`, optional)
+- `Tags` (`ECSCapacityProvider_Tag[]`, optional)

package/dist/okf/types/EFSAccessPoint.md

@@ -0,0 +1,24 @@
+---
+type: resource-type
+title: EFSAccessPoint
+description: aws resource type AWS::EFS::AccessPoint
+name: EFSAccessPoint
+lexicon: aws
+resource_type: AWS::EFS::AccessPoint
+---
+`AWS::EFS::AccessPoint`, a resource type of the aws lexicon.
+
+## Properties
+
+- `FileSystemId` (`string`, required): The ID of the EFS file system that the access point applies to. Accepts only the ID format for input when specifying a file system, for example ``fs-0123456789abcedf2``.
+- `AccessPointId` (`string`, optional)
+- `AccessPointTags` (`EFSAccessPoint_AccessPointTag[]`, optional): An array of key-value pairs to apply to this resource. For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html).
+- `Arn` (`string`, optional)
+- `ClientToken` (`string`, optional): The opaque string specified in the request to ensure idempotent creation.
+- `PosixUser` (`EFSAccessPoint_PosixUser`, optional): The full POSIX identity, including the user ID, group ID, and secondary group IDs on the access point that is used for all file operations by NFS clients using the access point.
+- `RootDirectory` (`EFSAccessPoint_RootDirectory`, optional): The directory on the EFS file system that the access point exposes as the root directory to NFS clients using the access point.
+
+## Attributes
+
+- `AccessPointId`
+- `Arn`

package/dist/okf/types/EFSFileSystem.md

@@ -0,0 +1,34 @@
+---
+type: resource-type
+title: EFSFileSystem
+description: aws resource type AWS::EFS::FileSystem
+name: EFSFileSystem
+lexicon: aws
+resource_type: AWS::EFS::FileSystem
+---
+`AWS::EFS::FileSystem`, a resource type of the aws lexicon.
+
+## Properties
+
+- `Arn` (`string`, optional)
+- `AvailabilityZoneName` (`string`, optional): For One Zone file systems, specify the AWS Availability Zone in which to create the file system. Use the format ``us-east-1a`` to specify the Availability Zone. For more information about One Zone file systems, see [EFS file system types](https://docs.aws.amazon.com/efs/latest/ug/availability-durability.html#file-system-type) in the *Amazon EFS User Guide*. One Zone file systems are not available in all Availability Zones in AWS-Regions where Amazon EFS is available.
+- `BackupPolicy` (`EFSFileSystem_BackupPolicy`, optional): Use the ``BackupPolicy`` to turn automatic backups on or off for the file system.
+- `BypassPolicyLockoutSafetyCheck` (`boolean`, optional): (Optional) A boolean that specifies whether or not to bypass the ``FileSystemPolicy`` lockout safety check. The lockout safety check determines whether the policy in the request will lock out, or prevent, the IAM principal that is making the request from making future ``PutFileSystemPolicy`` requests on this file system. Set ``BypassPolicyLockoutSafetyCheck`` to ``True`` only when you intend to prevent the IAM principal that is making the request from making subsequent ``PutFileSystemPolicy`` requests on this file system. The default value is ``False``.
+- `Encrypted` (`boolean`, optional): A Boolean value that, if true, creates an encrypted file system. When creating an encrypted file system, you have the option of specifying a KmsKeyId for an existing kms-key-long. If you don't specify a kms-key, then the default kms-key for EFS, ``/aws/elasticfilesystem``, is used to protect the encrypted file system.
+- `FileSystemId` (`string`, optional)
+- `FileSystemPolicy` (`Record<string, unknown>`, optional): The ``FileSystemPolicy`` for the EFS file system. A file system policy is an IAM resource policy used to control NFS access to an EFS file system. For more information, see [Using to control NFS access to Amazon EFS](https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html) in the *Amazon EFS User Guide*.
+- `FileSystemProtection` (`EFSFileSystem_FileSystemProtection`, optional): Describes the protection on the file system.
+- `FileSystemTags` (`EFSFileSystem_ElasticFileSystemTag[]`, optional): Use to create one or more tags associated with the file system. Each tag is a user-defined key-value pair. Name your file system on creation by including a ``"Key":"Name","Value":"{value}"`` key-value pair. Each key must be unique. For more information, see [Tagging resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) in the *General Reference Guide*.
+- `KmsKeyId` (`string`, optional): The ID of the kms-key-long to be used to protect the encrypted file system. This parameter is only required if you want to use a nondefault kms-key. If this parameter is not specified, the default kms-key for EFS is used. This ID can be in one of the following formats: + Key ID - A unique identifier of the key, for example ``1234abcd-12ab-34cd-56ef-1234567890ab``. + ARN - An Amazon Resource Name (ARN) for the key, for example ``arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab``. + Key alias - A previously created display name for a key, for example ``alias/projectKey1``. + Key alias ARN - An ARN for a key alias, for example ``arn:aws:kms:us-west-2:444455556666:alias/projectKey1``. If ``KmsKeyId`` is specified, the ``Encrypted`` parameter must be set to true.
+- `LifecyclePolicies` (`EFSFileSystem_LifecyclePolicy[]`, optional): An array of ``LifecyclePolicy`` objects that define the file system's ``LifecycleConfiguration`` object. A ``LifecycleConfiguration`` object informs Lifecycle management of the following: + When to move files in the file system from primary storage to IA storage. + When to move files in the file system from primary storage or IA storage to Archive storage. + When to move files that are in IA or Archive storage to primary storage. EFS requires that each ``LifecyclePolicy`` object have only a single transition. This means that in a request body, ``LifecyclePolicies`` needs to be structured as an array of ``LifecyclePolicy`` objects, one object for each transition, ``TransitionToIA``, ``TransitionToArchive````TransitionToPrimaryStorageClass``. See the example requests in the following section for more information.
+- `PerformanceMode` (`string`, optional): The performance mode of the file system. We recommend ``generalPurpose`` performance mode for all file systems. File systems using the ``maxIO`` performance mode can scale to higher levels of aggregate throughput and operations per second with a tradeoff of slightly higher latencies for most file operations. The performance mode can't be changed after the file system has been created. The ``maxIO`` mode is not supported on One Zone file systems. Due to the higher per-operation latencies with Max I/O, we recommend using General Purpose performance mode for all file systems. Default is ``generalPurpose``.
+- `ProvisionedThroughputInMibps` (`number`, optional): The throughput, measured in mebibytes per second (MiBps), that you want to provision for a file system that you're creating. Required if ``ThroughputMode`` is set to ``provisioned``. Valid values are 1-3414 MiBps, with the upper limit depending on Region. To increase this limit, contact SUP. For more information, see [Amazon EFS quotas that you can increase](https://docs.aws.amazon.com/efs/latest/ug/limits.html#soft-limits) in the *Amazon EFS User Guide*.
+- `ReplicationConfiguration` (`EFSFileSystem_ReplicationConfiguration`, optional): Describes the replication configuration for a specific file system.
+- `ThroughputMode` (`string`, optional): Specifies the throughput mode for the file system. The mode can be ``bursting``, ``provisioned``, or ``elastic``. If you set ``ThroughputMode`` to ``provisioned``, you must also set a value for ``ProvisionedThroughputInMibps``. After you create the file system, you can decrease your file system's Provisioned throughput or change between the throughput modes, with certain time restrictions. For more information, see [Specifying throughput with provisioned mode](https://docs.aws.amazon.com/efs/latest/ug/performance.html#provisioned-throughput) in the *Amazon EFS User Guide*. Default is ``bursting``.
+
+## Attributes
+
+- `Arn`
+- `FileSystemId`
+- `ReplicationConfiguration.Destinations.*.Status`
+- `ReplicationConfiguration.Destinations.*.StatusMessage`

package/dist/okf/types/EFSMountTarget.md

@@ -0,0 +1,23 @@
+---
+type: resource-type
+title: EFSMountTarget
+description: aws resource type AWS::EFS::MountTarget
+name: EFSMountTarget
+lexicon: aws
+resource_type: AWS::EFS::MountTarget
+---
+`AWS::EFS::MountTarget`, a resource type of the aws lexicon.
+
+## Properties
+
+- `FileSystemId` (`string`, required): The ID of the file system for which to create the mount target.
+- `SecurityGroups` (`string[]`, required): VPC security group IDs, of the form ``sg-xxxxxxxx``. These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see [Amazon VPC Quotas](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) in the *Amazon VPC User Guide* (see the *Security Groups* table). If you don't specify a security group, then Amazon EFS uses the default security group for the subnet's VPC.
+- `SubnetId` (`string`, required): The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. The subnet type must be the same type as the ``IpAddressType``.
+- `Id` (`string`, optional)
+- `IpAddress` (`string`, optional): If the ``IpAddressType`` for the mount target is IPv4 ( ``IPV4_ONLY`` or ``DUAL_STACK``), then specify the IPv4 address to use. If you do not specify an ``IpAddress``, then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId``.
+- `IpAddressType` (`"DUAL_STACK" | "IPV4_ONLY" | "IPV6_ONLY"`, optional): The IP address type for the mount target. The possible values are ``IPV4_ONLY`` (only IPv4 addresses), ``IPV6_ONLY`` (only IPv6 addresses), and ``DUAL_STACK`` (dual-stack, both IPv4 and IPv6 addresses). If you don’t specify an ``IpAddressType``, then ``IPV4_ONLY`` is used. The ``IPAddressType`` must match the IP type of the subnet. Additionally, the ``IPAddressType`` parameter overrides the value set as the default IP address for the subnet in the VPC. For example, if the ``IPAddressType`` is ``IPV4_ONLY`` and ``AssignIpv6AddressOnCreation`` is ``true``, then IPv4 is used for the mount target. For more information, see [Modify the IP addressing attributes of your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html).
+- `Ipv6Address` (`string`, optional): If the ``IPAddressType`` for the mount target is IPv6 (``IPV6_ONLY`` or ``DUAL_STACK``), then specify the IPv6 address to use. If you do not specify an ``Ipv6Address``, then Amazon EFS selects an unused IP address from the subnet specified for ``SubnetId``.
+
+## Attributes
+
+- `Id`

package/dist/okf/types/EIP.md

@@ -0,0 +1,27 @@
+---
+type: resource-type
+title: EIP
+description: aws resource type AWS::EC2::EIP
+name: EIP
+lexicon: aws
+resource_type: AWS::EC2::EIP
+---
+`AWS::EC2::EIP`, a resource type of the aws lexicon.
+
+## Properties
+
+- `Address` (`string`, optional): An Elastic IP address or a carrier IP address in a Wavelength Zone.
+- `AllocationId` (`string`, optional)
+- `Domain` (`string`, optional): The network (``vpc``). If you define an Elastic IP address and associate it with a VPC that is defined in the same template, you must declare a dependency on the VPC-gateway attachment by using the [DependsOn Attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html) on this resource.
+- `InstanceId` (`string`, optional): The ID of the instance. Updates to the ``InstanceId`` property may require *some interruptions*. Updates on an EIP reassociates the address on its associated resource.
+- `IpamPoolId` (`string`, optional): The ID of an IPAM pool which has an Amazon-provided or BYOIP public IPv4 CIDR provisioned to it. For more information, see [Allocate sequential Elastic IP addresses from an IPAM pool](https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-eip-pool.html) in the *Amazon VPC IPAM User Guide*.
+- `NetworkBorderGroup` (`string`, optional): A unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. Use this parameter to limit the IP address to this location. IP addresses cannot move between network border groups. Use [DescribeAvailabilityZones](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html) to view the network border groups.
+- `PublicIp` (`string`, optional)
+- `PublicIpv4Pool` (`string`, optional): The ID of an address pool that you own. Use this parameter to let Amazon EC2 select an address from the address pool. Updates to the ``PublicIpv4Pool`` property may require *some interruptions*. Updates on an EIP reassociates the address on its associated resource.
+- `Tags` (`EIP_Tag[]`, optional): Any tags assigned to the Elastic IP address. Updates to the ``Tags`` property may require *some interruptions*. Updates on an EIP reassociates the address on its associated resource.
+- `TransferAddress` (`string`, optional): The Elastic IP address you are accepting for transfer. You can only accept one transferred address. For more information on Elastic IP address transfers, see [Transfer Elastic IP addresses](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html#transfer-EIPs-intro) in the *Amazon Virtual Private Cloud User Guide*.
+
+## Attributes
+
+- `AllocationId`
+- `PublicIp`

package/dist/okf/types/EIPAssociation.md

@@ -0,0 +1,22 @@
+---
+type: resource-type
+title: EIPAssociation
+description: aws resource type AWS::EC2::EIPAssociation
+name: EIPAssociation
+lexicon: aws
+resource_type: AWS::EC2::EIPAssociation
+---
+`AWS::EC2::EIPAssociation`, a resource type of the aws lexicon.
+
+## Properties
+
+- `AllocationId` (`string`, optional): The allocation ID. This is required.
+- `EIP` (`any`, optional)
+- `Id` (`string`, optional)
+- `InstanceId` (`string`, optional): The ID of the instance. The instance must have exactly one attached network interface. You can specify either the instance ID or the network interface ID, but not both.
+- `NetworkInterfaceId` (`string`, optional): The ID of the network interface. If the instance has more than one network interface, you must specify a network interface ID. You can specify either the instance ID or the network interface ID, but not both.
+- `PrivateIpAddress` (`string`, optional): The primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.
+
+## Attributes
+
+- `Id`

package/dist/okf/types/EKSCapability.md

@@ -0,0 +1,34 @@
+---
+type: resource-type
+title: EKSCapability
+description: aws resource type AWS::EKS::Capability
+name: EKSCapability
+lexicon: aws
+resource_type: AWS::EKS::Capability
+---
+`AWS::EKS::Capability`, a resource type of the aws lexicon.
+
+## Properties
+
+- `CapabilityName` (`string`, required): A unique name for the capability. The name must be unique within your cluster and can contain alphanumeric characters, hyphens, and underscores.
+- `ClusterName` (`string`, required): The name of the EKS cluster where you want to create the capability.
+- `DeletePropagationPolicy` (`"RETAIN"`, required): Specifies how Kubernetes resources managed by the capability should be handled when the capability is deleted. Currently, the only supported value is RETAIN which retains all Kubernetes resources managed by the capability when the capability is deleted.
+- `RoleArn` (`string`, required): The Amazon Resource Name (ARN) of the IAM role that the capability uses to interact with AWS services. This role must have a trust policy that allows the EKS service principal to assume it, and it must have the necessary permissions for the capability type you're creating.
+- `Type` (`"ACK" | "ARGOCD" | "KRO"`, required): The type of capability to create. Valid values are: ACK (AWS Controllers for Kubernetes, which lets you manage AWS resources directly from Kubernetes), ARGOCD (Argo CD for GitOps-based continuous delivery), or KRO (Kube Resource Orchestrator for composing and managing custom Kubernetes resources).
+- `Arn` (`string`, optional): The Amazon Resource Name (ARN) of the capability.
+- `Configuration` (`EKSCapability_CapabilityConfiguration`, optional): The configuration settings for the capability. The structure of this object varies depending on the capability type. For Argo CD capabilities, you can configure IAM Identity Center integration, RBAC role mappings, and network access settings.
+- `CreatedAt` (`string`, optional): The Unix epoch timestamp in seconds for when the capability was created.
+- `ModifiedAt` (`string`, optional): The Unix epoch timestamp in seconds for when the capability was last modified.
+- `Status` (`string`, optional): The current status of the capability. Valid values include: CREATING (the capability is being created), ACTIVE (the capability is running and available), UPDATING (the capability is being updated), DELETING (the capability is being deleted), CREATE_FAILED (the capability creation failed), UPDATE_FAILED (the capability update failed), or DELETE_FAILED (the capability deletion failed).
+- `Tags` (`EKSCapability_Tag[]`, optional): An array of key-value pairs to apply to this resource.
+- `Version` (`string`, optional): The version of the capability software that is currently running.
+
+## Attributes
+
+- `Arn`
+- `Configuration.ArgoCd.AwsIdc.IdcManagedApplicationArn`
+- `Configuration.ArgoCd.ServerUrl`
+- `CreatedAt`
+- `ModifiedAt`
+- `Status`
+- `Version`

package/dist/okf/types/EKSCluster.md

@@ -0,0 +1,54 @@
+---
+type: resource-type
+title: EKSCluster
+description: aws resource type AWS::EKS::Cluster
+name: EKSCluster
+lexicon: aws
+resource_type: AWS::EKS::Cluster
+---
+`AWS::EKS::Cluster`, a resource type of the aws lexicon.
+
+## Properties
+
+- `ResourcesVpcConfig` (`EKSCluster_ResourcesVpcConfig`, required)
+- `RoleArn` (`string`, required): The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.
+- `AccessConfig` (`EKSCluster_AccessConfig`, optional)
+- `Arn` (`string`, optional): The ARN of the cluster, such as arn:aws:eks:us-west-2:666666666666:cluster/prod.
+- `BootstrapSelfManagedAddons` (`boolean`, optional): Set this value to false to avoid creating the default networking add-ons when the cluster is created.
+- `CertificateAuthorityData` (`string`, optional): The certificate-authority-data for your cluster.
+- `ClusterSecurityGroupId` (`string`, optional): The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control plane to data plane communication.
+- `ComputeConfig` (`EKSCluster_ComputeConfig`, optional)
+- `ControlPlaneScalingConfig` (`EKSCluster_ControlPlaneScalingConfig`, optional)
+- `DeletionProtection` (`boolean`, optional): Set this value to true to enable deletion protection for the cluster.
+- `EncryptionConfig` (`EKSCluster_EncryptionConfig[]`, optional)
+- `EncryptionConfigKeyArn` (`string`, optional): Amazon Resource Name (ARN) or alias of the customer master key (CMK).
+- `Endpoint` (`string`, optional): The endpoint for your Kubernetes API server, such as https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com.
+- `Force` (`boolean`, optional): Force cluster version update
+- `Id` (`string`, optional): The unique ID given to your cluster.
+- `KubernetesNetworkConfig` (`EKSCluster_KubernetesNetworkConfig`, optional)
+- `Logging` (`EKSCluster_Logging`, optional)
+- `Name` (`string`, optional): The unique name to give to your cluster.
+- `OpenIdConnectIssuerUrl` (`string`, optional): The issuer URL for the cluster's OIDC identity provider, such as https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E. If you need to remove https:// from this output value, you can include the following code in your template.
+- `OutpostConfig` (`EKSCluster_OutpostConfig`, optional)
+- `RemoteNetworkConfig` (`EKSCluster_RemoteNetworkConfig`, optional)
+- `RollbackConfig` (`EKSCluster_RollbackConfig`, optional)
+- `StorageConfig` (`EKSCluster_StorageConfig`, optional)
+- `Tags` (`EKSCluster_Tag[]`, optional): An array of key-value pairs to apply to this resource.
+- `UpgradePolicy` (`EKSCluster_UpgradePolicy`, optional)
+- `Version` (`string`, optional): The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.
+- `ZonalShiftConfig` (`EKSCluster_ZonalShiftConfig`, optional)
+
+## Attributes
+
+- `Arn`
+- `CertificateAuthorityData`
+- `ClusterSecurityGroupId`
+- `EncryptionConfigKeyArn`
+- `Endpoint`
+- `Id`
+- `KubernetesNetworkConfig.ServiceIpv6Cidr`
+- `OpenIdConnectIssuerUrl`
+
+## Governed by
+
+- [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns

package/dist/okf/types/EMRCluster.md

@@ -0,0 +1,46 @@
+---
+type: resource-type
+title: EMRCluster
+description: aws resource type AWS::EMR::Cluster
+name: EMRCluster
+lexicon: aws
+resource_type: AWS::EMR::Cluster
+---
+`AWS::EMR::Cluster`, a resource type of the aws lexicon.
+
+## Properties
+
+- `Instances` (`EMRCluster_JobFlowInstancesConfig`, required)
+- `JobFlowRole` (`string`, required)
+- `Name` (`string`, required)
+- `ServiceRole` (`string`, required)
+- `AdditionalInfo` (`Record<string, unknown>`, optional)
+- `Applications` (`EMRCluster_Application[]`, optional)
+- `AutoScalingRole` (`string`, optional)
+- `AutoTerminationPolicy` (`EMRCluster_AutoTerminationPolicy`, optional)
+- `BootstrapActions` (`EMRCluster_BootstrapActionConfig[]`, optional)
+- `Configurations` (`EMRCluster_Configuration[]`, optional)
+- `CustomAmiId` (`string`, optional)
+- `EbsRootVolumeIops` (`number`, optional)
+- `EbsRootVolumeSize` (`number`, optional)
+- `EbsRootVolumeThroughput` (`number`, optional)
+- `Id` (`string`, optional)
+- `KerberosAttributes` (`EMRCluster_KerberosAttributes`, optional)
+- `LogEncryptionKmsKeyId` (`string`, optional)
+- `LogUri` (`string`, optional)
+- `ManagedScalingPolicy` (`EMRCluster_ManagedScalingPolicy`, optional)
+- `MasterPublicDNS` (`string`, optional)
+- `OSReleaseLabel` (`string`, optional)
+- `PlacementGroupConfigs` (`EMRCluster_PlacementGroupConfig[]`, optional)
+- `ReleaseLabel` (`string`, optional)
+- `ScaleDownBehavior` (`string`, optional)
+- `SecurityConfiguration` (`string`, optional)
+- `StepConcurrencyLevel` (`number`, optional)
+- `Steps` (`EMRCluster_StepConfig[]`, optional)
+- `Tags` (`EMRCluster_Tag[]`, optional)
+- `VisibleToAllUsers` (`boolean`, optional)
+
+## Attributes
+
+- `Id`
+- `MasterPublicDNS`

package/dist/okf/types/EMRContainersEndpoint.md

@@ -0,0 +1,43 @@
+---
+type: resource-type
+title: EMRContainersEndpoint
+description: aws resource type AWS::EMRContainers::Endpoint
+name: EMRContainersEndpoint
+lexicon: aws
+resource_type: AWS::EMRContainers::Endpoint
+---
+`AWS::EMRContainers::Endpoint`, a resource type of the aws lexicon.
+
+## Properties
+
+- `ExecutionRoleArn` (`string`, required): The execution role ARN for the managed endpoint.
+- `ReleaseLabel` (`string`, required): The Amazon EMR release label.
+- `Type` (`string`, required): The type of the managed endpoint.
+- `VirtualClusterId` (`string`, required): The ID of the virtual cluster for which the managed endpoint is created.
+- `Arn` (`string`, optional): The ARN of the managed endpoint.
+- `AuthProxyUrl` (`string`, optional): The auth proxy URL for Spark Connect connections.
+- `CertificateAuthority` (`EMRContainersEndpoint_Certificate`, optional): The certificate authority for the managed endpoint.
+- `ConfigurationOverrides` (`EMRContainersEndpoint_ConfigurationOverrides`, optional): The configuration overrides for the managed endpoint.
+- `CreatedAt` (`string`, optional): The date and time when the managed endpoint was created.
+- `FailureReason` (`string`, optional): The reason for a failed managed endpoint.
+- `Id` (`string`, optional): The ID of the managed endpoint.
+- `Name` (`string`, optional): The name of the managed endpoint.
+- `SecurityGroup` (`string`, optional): The security group associated with the managed endpoint.
+- `ServerUrl` (`string`, optional): The server URL of the managed endpoint.
+- `SessionIdleTimeoutInMinutes` (`number`, optional): The idle timeout in minutes for sessions on the managed endpoint.
+- `State` (`string`, optional): The state of the managed endpoint.
+- `StateDetails` (`string`, optional): Additional details about the state of the managed endpoint.
+- `Tags` (`EMRContainersEndpoint_Tag[]`, optional): An array of key-value pairs to apply to this managed endpoint.
+
+## Attributes
+
+- `Arn`
+- `AuthProxyUrl`
+- `CertificateAuthority`
+- `CreatedAt`
+- `FailureReason`
+- `Id`
+- `SecurityGroup`
+- `ServerUrl`
+- `State`
+- `StateDetails`

package/dist/okf/types/EMRContainersSecurityConfiguration.md

@@ -0,0 +1,23 @@
+---
+type: resource-type
+title: EMRContainersSecurityConfiguration
+description: aws resource type AWS::EMRContainers::SecurityConfiguration
+name: EMRContainersSecurityConfiguration
+lexicon: aws
+resource_type: AWS::EMRContainers::SecurityConfiguration
+---
+`AWS::EMRContainers::SecurityConfiguration`, a resource type of the aws lexicon.
+
+## Properties
+
+- `SecurityConfigurationData` (`EMRContainersSecurityConfiguration_SecurityConfigurationData`, required): Security configuration input for the security configuration.
+- `Arn` (`string`, optional): The ARN of the security configuration.
+- `ContainerProvider` (`EMRContainersSecurityConfiguration_ContainerProvider`, optional): Container provider for the security configuration.
+- `Id` (`string`, optional): The ID of the security configuration.
+- `Name` (`string`, optional): The name of the security configuration.
+- `Tags` (`EMRContainersSecurityConfiguration_Tag[]`, optional): An array of key-value pairs to apply to this security configuration.
+
+## Attributes
+
+- `Arn`
+- `Id`

package/dist/okf/types/EMRSecurityConfiguration.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: EMRSecurityConfiguration
+description: aws resource type AWS::EMR::SecurityConfiguration
+name: EMRSecurityConfiguration
+lexicon: aws
+resource_type: AWS::EMR::SecurityConfiguration
+---
+`AWS::EMR::SecurityConfiguration`, a resource type of the aws lexicon.
+
+## Properties
+
+- `SecurityConfiguration` (`Record<string, unknown>`, required): The security configuration details in JSON format.
+- `Name` (`string`, optional): The name of the security configuration.