@pulumi/aws 4.29.0 → 4.31.0

package/types/input.d.ts

@@ -150,6 +150,7 @@ export interface ProviderDefaultTags {
 }
 export interface ProviderEndpoint {
     accessanalyzer?: pulumi.Input<string>;
+    account?: pulumi.Input<string>;
     acm?: pulumi.Input<string>;
     acmpca?: pulumi.Input<string>;
     alexaforbusiness?: pulumi.Input<string>;
@@ -4045,7 +4046,7 @@ export declare namespace apprunner {
         /**
          * The Amazon Resource Name (ARN) of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
          */
-        instanceRoleArn: pulumi.Input<string>;
+        instanceRoleArn?: pulumi.Input<string>;
         /**
          * The amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `2048|3072|4096|(2|3|4) GB`.
          */
@@ -4451,6 +4452,10 @@ export declare namespace athena {
          * Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
          */
         enforceWorkgroupConfiguration?: pulumi.Input<boolean>;
+        /**
+         * Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). Documented below.
+         */
+        engineVersion?: pulumi.Input<inputs.athena.WorkgroupConfigurationEngineVersion>;
         /**
          * Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
          */
@@ -4464,6 +4469,16 @@ export declare namespace athena {
          */
         resultConfiguration?: pulumi.Input<inputs.athena.WorkgroupConfigurationResultConfiguration>;
     }
+    interface WorkgroupConfigurationEngineVersion {
+        /**
+         * The engine version on which the query runs. If `selectedEngineVersion` is set to `AUTO`, the effective engine version is chosen by Athena.
+         */
+        effectiveEngineVersion?: pulumi.Input<string>;
+        /**
+         * The requested engine version. Defaults to `AUTO`.
+         */
+        selectedEngineVersion?: pulumi.Input<string>;
+    }
     interface WorkgroupConfigurationResultConfiguration {
         /**
          * Configuration block with encryption settings. Documented below.
@@ -5479,17 +5494,33 @@ export declare namespace cfg {
          */
         resourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface RemediationConfigurationExecutionControls {
+        /**
+         * Configuration block for SSM controls. See below.
+         */
+        ssmControls?: pulumi.Input<inputs.cfg.RemediationConfigurationExecutionControlsSsmControls>;
+    }
+    interface RemediationConfigurationExecutionControlsSsmControls {
+        /**
+         * Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+         */
+        concurrentExecutionRatePercentage?: pulumi.Input<number>;
+        /**
+         * Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+         */
+        errorPercentage?: pulumi.Input<number>;
+    }
     interface RemediationConfigurationParameter {
         /**
-         * The name of the attribute.
+         * Name of the attribute.
          */
         name: pulumi.Input<string>;
         /**
-         * The value is dynamic and changes at run-time.
+         * Value is dynamic and changes at run-time.
          */
         resourceValue?: pulumi.Input<string>;
         /**
-         * The value is static and does not change at run-time.
+         * Value is static and does not change at run-time.
          */
         staticValue?: pulumi.Input<string>;
     }
@@ -6620,7 +6651,11 @@ export declare namespace cloudtrail {
          */
         dataResources?: pulumi.Input<pulumi.Input<inputs.cloudtrail.TrailEventSelectorDataResource>[]>;
         /**
-         * Whether to include management events for your trail.
+         * A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `includeManagementEvents` must be set to`true` to allow this.
+         */
+        excludeManagementEventSources?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * Whether to include management events for your trail. Defaults to `true`.
          */
         includeManagementEvents?: pulumi.Input<boolean>;
         /**
@@ -8585,19 +8620,23 @@ export declare namespace dlm {
     }
     interface LifecyclePolicyPolicyDetailsSchedule {
         /**
-         * Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+         * Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
          */
         copyTags?: pulumi.Input<boolean>;
         /**
          * See the `createRule` block. Max of 1 per schedule.
          */
         createRule: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCreateRule>;
+        /**
+         * See the `crossRegionCopyRule` block. Max of 3 per schedule.
+         */
+        crossRegionCopyRules?: pulumi.Input<pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule>[]>;
         /**
          * A name for the schedule.
          */
         name: pulumi.Input<string>;
         /**
-         * See the `retainRule` block. Max of 1 per schedule.
+         * The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
          */
         retainRule: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleRetainRule>;
         /**
@@ -8609,11 +8648,11 @@ export declare namespace dlm {
     }
     interface LifecyclePolicyPolicyDetailsScheduleCreateRule {
         /**
-         * How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
          */
         interval: pulumi.Input<number>;
         /**
-         * The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
          */
         intervalUnit?: pulumi.Input<string>;
         /**
@@ -8621,6 +8660,52 @@ export declare namespace dlm {
          */
         times?: pulumi.Input<string>;
     }
+    interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule {
+        /**
+         * The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+         */
+        cmkArn?: pulumi.Input<string>;
+        /**
+         * Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+         */
+        copyTags?: pulumi.Input<boolean>;
+        /**
+         * The AMI deprecation rule for cross-Region AMI copies created by the rule. See the `deprecateRule` block.
+         */
+        deprecateRule?: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule>;
+        /**
+         * To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+         */
+        encrypted: pulumi.Input<boolean>;
+        /**
+         * The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the `retainRule` block. Max of 1 per schedule.
+         */
+        retainRule?: pulumi.Input<inputs.dlm.LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule>;
+        /**
+         * The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+         */
+        target: pulumi.Input<string>;
+    }
+    interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleDeprecateRule {
+        /**
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+         */
+        interval: pulumi.Input<number>;
+        /**
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+         */
+        intervalUnit: pulumi.Input<string>;
+    }
+    interface LifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule {
+        /**
+         * The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+         */
+        interval: pulumi.Input<number>;
+        /**
+         * The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+         */
+        intervalUnit: pulumi.Input<string>;
+    }
     interface LifecyclePolicyPolicyDetailsScheduleRetainRule {
         /**
          * How many snapshots to keep. Must be an integer between 1 and 1000.
@@ -9610,38 +9695,38 @@ export declare namespace ec2 {
          */
         values: string[];
     }
-    interface GetCoipPoolsFilterArgs {
+    interface GetCoipPoolsFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A COIP Pool will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
-    interface GetCoipPoolsFilter {
+    interface GetCoipPoolsFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A COIP Pool will be selected if any one of the given values matches.
          */
-        values: string[];
-    }
-    interface GetCustomerGatewayFilter {
-        name: string;
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GetCustomerGatewayFilterArgs {
         name: pulumi.Input<string>;
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface GetCustomerGatewayFilter {
+        name: string;
+        values: string[];
+    }
     interface GetDedicatedHostFilterArgs {
         /**
          * The name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html).
@@ -9714,16 +9799,16 @@ export declare namespace ec2 {
         memorySize?: pulumi.Input<number>;
         name?: pulumi.Input<string>;
     }
-    interface GetInstanceTypeInferenceAcceleratorArgs {
-        count?: pulumi.Input<number>;
-        manufacturer?: pulumi.Input<string>;
-        name?: pulumi.Input<string>;
-    }
     interface GetInstanceTypeInferenceAccelerator {
         count?: number;
         manufacturer?: string;
         name?: string;
     }
+    interface GetInstanceTypeInferenceAcceleratorArgs {
+        count?: pulumi.Input<number>;
+        manufacturer?: pulumi.Input<string>;
+        name?: pulumi.Input<string>;
+    }
     interface GetInstanceTypeInstanceDisk {
         count?: number;
         size?: number;
@@ -9774,6 +9859,26 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface GetInstanceTypesFilter {
+        /**
+         * Name of the filter.
+         */
+        name: string;
+        /**
+         * List of one or more values for the filter.
+         */
+        values: string[];
+    }
+    interface GetInstanceTypesFilterArgs {
+        /**
+         * Name of the filter.
+         */
+        name: pulumi.Input<string>;
+        /**
+         * List of one or more values for the filter.
+         */
+        values: pulumi.Input<pulumi.Input<string>[]>;
+    }
     interface GetInstancesFilter {
         name: string;
         values: string[];
@@ -9870,53 +9975,53 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetLocalGatewayRouteTableFilter {
+    interface GetLocalGatewayRouteTableFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A local gateway route table will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetLocalGatewayRouteTableFilterArgs {
+    interface GetLocalGatewayRouteTableFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A local gateway route table will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
-    interface GetLocalGatewayRouteTablesFilterArgs {
+    interface GetLocalGatewayRouteTablesFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A Local Gateway Route Table will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
-    interface GetLocalGatewayRouteTablesFilter {
+    interface GetLocalGatewayRouteTablesFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A Local Gateway Route Table will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GetLocalGatewayVirtualInterfaceFilterArgs {
         /**
@@ -9958,16 +10063,6 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetLocalGatewayVirtualInterfaceGroupsFilter {
-        /**
-         * Name of the filter.
-         */
-        name: string;
-        /**
-         * List of one or more values for the filter.
-         */
-        values: string[];
-    }
     interface GetLocalGatewayVirtualInterfaceGroupsFilterArgs {
         /**
          * Name of the filter.
@@ -9978,15 +10073,13 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetLocalGatewaysFilter {
+    interface GetLocalGatewayVirtualInterfaceGroupsFilter {
         /**
-         * The name of the field to filter by, as defined by
-         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGateways.html).
+         * Name of the filter.
          */
         name: string;
         /**
-         * Set of values that are accepted for the given field.
-         * A Local Gateway will be selected if any one of the given values matches.
+         * List of one or more values for the filter.
          */
         values: string[];
     }
@@ -10002,13 +10095,15 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetManagedPrefixListFilter {
+    interface GetLocalGatewaysFilter {
         /**
-         * The name of the filter field. Valid values can be found in the EC2 [DescribeManagedPrefixLists](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html) API Reference.
+         * The name of the field to filter by, as defined by
+         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGateways.html).
          */
         name: string;
         /**
-         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+         * Set of values that are accepted for the given field.
+         * A Local Gateway will be selected if any one of the given values matches.
          */
         values: string[];
     }
@@ -10022,17 +10117,15 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetNatGatewayFilterArgs {
+    interface GetManagedPrefixListFilter {
         /**
-         * The name of the field to filter by, as defined by
-         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
+         * The name of the filter field. Valid values can be found in the EC2 [DescribeManagedPrefixLists](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html) API Reference.
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
-         * Set of values that are accepted for the given field.
-         * An Nat Gateway will be selected if any one of the given values matches.
+         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
     interface GetNatGatewayFilter {
         /**
@@ -10046,17 +10139,17 @@ export declare namespace ec2 {
          */
         values: string[];
     }
-    interface GetNetworkAclsFilter {
+    interface GetNatGatewayFilterArgs {
         /**
          * The name of the field to filter by, as defined by
-         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkAcls.html).
+         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
-         * A VPC will be selected if any one of the given values matches.
+         * An Nat Gateway will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GetNetworkAclsFilterArgs {
         /**
@@ -10070,6 +10163,18 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface GetNetworkAclsFilter {
+        /**
+         * The name of the field to filter by, as defined by
+         * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkAcls.html).
+         */
+        name: string;
+        /**
+         * Set of values that are accepted for the given field.
+         * A VPC will be selected if any one of the given values matches.
+         */
+        values: string[];
+    }
     interface GetNetworkInterfaceFilterArgs {
         name: pulumi.Input<string>;
         values: pulumi.Input<pulumi.Input<string>[]>;
@@ -10140,29 +10245,29 @@ export declare namespace ec2 {
          */
         values: string[];
     }
-    interface GetRouteTablesFilter {
+    interface GetRouteTablesFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A Route Table will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetRouteTablesFilterArgs {
+    interface GetRouteTablesFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A Route Table will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
     interface GetSecurityGroupFilterArgs {
         /**
@@ -10188,33 +10293,33 @@ export declare namespace ec2 {
          */
         values: string[];
     }
-    interface GetSecurityGroupsFilter {
-        name: string;
-        values: string[];
-    }
     interface GetSecurityGroupsFilterArgs {
         name: pulumi.Input<string>;
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetSpotPriceFilter {
+    interface GetSecurityGroupsFilter {
+        name: string;
+        values: string[];
+    }
+    interface GetSpotPriceFilterArgs {
         /**
          * Name of the filter.
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * List of one or more values for the filter.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetSpotPriceFilterArgs {
+    interface GetSpotPriceFilter {
         /**
          * Name of the filter.
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * List of one or more values for the filter.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
     interface GetSubnetFilter {
         /**
@@ -10262,55 +10367,55 @@ export declare namespace ec2 {
          */
         values: string[];
     }
-    interface GetSubnetsFilter {
+    interface GetSubnetsFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
          * For example, if matching against tag `Name`, use:
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * Subnet IDs will be selected if any one of the given values match.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetSubnetsFilterArgs {
+    interface GetSubnetsFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
          * For example, if matching against tag `Name`, use:
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * Subnet IDs will be selected if any one of the given values match.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
-    interface GetTransitGatewayRouteTablesFilter {
+    interface GetTransitGatewayRouteTablesFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayRouteTables.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A Transit Gateway Route Table will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetTransitGatewayRouteTablesFilterArgs {
+    interface GetTransitGatewayRouteTablesFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayRouteTables.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A Transit Gateway Route Table will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
     interface GetVpcDhcpOptionsFilter {
         /**
@@ -10376,40 +10481,36 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetVpcFilterArgs {
+    interface GetVpcFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A VPC will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
-    interface GetVpcFilter {
+    interface GetVpcFilterArgs {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
          * A VPC will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetVpcPeeringConnectionFilter {
-        /**
-         * The name of the field to filter by, as defined by
-         * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
-         */
+    interface GetVpcIamPoolFilterArgs {
+        name: pulumi.Input<string>;
+        values: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface GetVpcIamPoolFilter {
         name: string;
-        /**
-         * Set of values that are accepted for the given field.
-         * A VPC Peering Connection will be selected if any one of the given values matches.
-         */
         values: string[];
     }
     interface GetVpcPeeringConnectionFilterArgs {
@@ -10424,17 +10525,17 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
-    interface GetVpcPeeringConnectionsFilterArgs {
+    interface GetVpcPeeringConnectionFilter {
         /**
          * The name of the field to filter by, as defined by
          * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
          */
-        name: pulumi.Input<string>;
+        name: string;
         /**
          * Set of values that are accepted for the given field.
          * A VPC Peering Connection will be selected if any one of the given values matches.
          */
-        values: pulumi.Input<pulumi.Input<string>[]>;
+        values: string[];
     }
     interface GetVpcPeeringConnectionsFilter {
         /**
@@ -10448,17 +10549,17 @@ export declare namespace ec2 {
          */
         values: string[];
     }
-    interface GetVpcsFilter {
+    interface GetVpcPeeringConnectionsFilterArgs {
         /**
          * The name of the field to filter by, as defined by
-         * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
+         * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
          */
-        name: string;
+        name: pulumi.Input<string>;
         /**
          * Set of values that are accepted for the given field.
-         * A VPC will be selected if any one of the given values matches.
+         * A VPC Peering Connection will be selected if any one of the given values matches.
          */
-        values: string[];
+        values: pulumi.Input<pulumi.Input<string>[]>;
     }
     interface GetVpcsFilterArgs {
         /**
@@ -10472,6 +10573,18 @@ export declare namespace ec2 {
          */
         values: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface GetVpcsFilter {
+        /**
+         * The name of the field to filter by, as defined by
+         * [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
+         */
+        name: string;
+        /**
+         * Set of values that are accepted for the given field.
+         * A VPC will be selected if any one of the given values matches.
+         */
+        values: string[];
+    }
     interface GetVpnGatewayFilter {
         /**
          * The name of the field to filter by, as defined by
@@ -11620,6 +11733,22 @@ export declare namespace ec2 {
          */
         value?: pulumi.Input<string>;
     }
+    interface VpcIpamOperatingRegion {
+        /**
+         * The name of the Region you want to add to the IPAM.
+         */
+        regionName: pulumi.Input<string>;
+    }
+    interface VpcIpamPoolCidrCidrAuthorizationContext {
+        /**
+         * The plain-text authorization message for the prefix and account.
+         */
+        message?: pulumi.Input<string>;
+        /**
+         * The signed authorization message for the prefix and account.
+         */
+        signature?: pulumi.Input<string>;
+    }
     interface VpcPeeringConnectionAccepter {
         /**
          * Allow a local linked EC2-Classic instance to communicate
@@ -14470,6 +14599,101 @@ export declare namespace fsx {
          */
         ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface OntapStorageVirtualMachineActiveDirectoryConfiguration {
+        /**
+         * The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. It is limited to 15 characters because of standard NetBIOS naming limits.
+         */
+        netbiosName?: pulumi.Input<string>;
+        selfManagedActiveDirectoryConfiguration?: pulumi.Input<inputs.fsx.OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration>;
+    }
+    interface OntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration {
+        /**
+         * A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+         */
+        dnsIps: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+         */
+        domainName: pulumi.Input<string>;
+        /**
+         * The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+         */
+        fileSystemAdministratorsGroup?: pulumi.Input<string>;
+        organizationalUnitDistinguidshedName?: pulumi.Input<string>;
+        /**
+         * The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+         */
+        password: pulumi.Input<string>;
+        /**
+         * The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+         */
+        username: pulumi.Input<string>;
+    }
+    interface OntapStorageVirtualMachineEndpoint {
+        /**
+         * An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See Endpoint.
+         */
+        iscses?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointIscse>[]>;
+        /**
+         * An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See Endpoint.
+         */
+        managements?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointManagement>[]>;
+        /**
+         * An endpoint for accessing data on your storage virtual machine via NFS protocol. See Endpoint.
+         */
+        nfs?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointNf>[]>;
+        /**
+         * An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an activeDirectoryConfiguration has been set. See Endpoint.
+         */
+        smbs?: pulumi.Input<pulumi.Input<inputs.fsx.OntapStorageVirtualMachineEndpointSmb>[]>;
+    }
+    interface OntapStorageVirtualMachineEndpointIscse {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface OntapStorageVirtualMachineEndpointManagement {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface OntapStorageVirtualMachineEndpointNf {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface OntapStorageVirtualMachineEndpointSmb {
+        /**
+         * The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+         */
+        dnsName?: pulumi.Input<string>;
+        /**
+         * IP addresses of the storage virtual machine endpoint.
+         */
+        ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface OntapVolumeTieringPolicy {
+        coolingPeriod?: pulumi.Input<number>;
+        /**
+         * Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+         */
+        name?: pulumi.Input<string>;
+    }
     interface WindowsFileSystemAuditLogConfiguration {
         /**
          * The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `fileAccessAuditLogLevel` and `fileShareAccessAuditLogLevel` are not set to `DISABLED`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `aws-fsx` prefix. If you do not provide a destination in `auditLogDestionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
@@ -15794,6 +16018,26 @@ export declare namespace imagebuilder {
          */
         userIds?: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface GetImageRecipesFilterArgs {
+        /**
+         * The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+         */
+        name: pulumi.Input<string>;
+        /**
+         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+         */
+        values: pulumi.Input<pulumi.Input<string>[]>;
+    }
+    interface GetImageRecipesFilter {
+        /**
+         * The name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+         */
+        name: string;
+        /**
+         * Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+         */
+        values: string[];
+    }
     interface ImageImageTestsConfiguration {
         /**
          * Whether image tests are enabled. Defaults to `true`.
@@ -22484,7 +22728,7 @@ export declare namespace s3 {
         /**
          * A configuration block that specifies the time threshold for emitting the `s3:Replication:OperationMissedThreshold` event documented below.
          */
-        eventThreshold: pulumi.Input<inputs.s3.BucketReplicationConfigRuleDestinationMetricsEventThreshold>;
+        eventThreshold?: pulumi.Input<inputs.s3.BucketReplicationConfigRuleDestinationMetricsEventThreshold>;
         /**
          * The status of the Destination Metrics. Either `"Enabled"` or `"Disabled"`.
          */
@@ -25665,6 +25909,10 @@ export declare namespace ssm {
          * The S3 bucket prefix. Results stored in the root if not configured.
          */
         s3KeyPrefix?: pulumi.Input<string>;
+        /**
+         * The S3 bucket region.
+         */
+        s3Region?: pulumi.Input<string>;
     }
     interface AssociationTarget {
         /**
@@ -26002,6 +26250,22 @@ export declare namespace storagegateway {
     }
 }
 export declare namespace synthetics {
+    interface CanaryArtifactConfig {
+        /**
+         * Configuration of the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3. See S3 Encryption.
+         */
+        s3Encryption?: pulumi.Input<inputs.synthetics.CanaryArtifactConfigS3Encryption>;
+    }
+    interface CanaryArtifactConfigS3Encryption {
+        /**
+         * The encryption method to use for artifacts created by this canary. Valid values are: `SSE-S3` and `SSE-KMS`.
+         */
+        encryptionMode?: pulumi.Input<string>;
+        /**
+         * The ARN of the customer-managed KMS key to use, if you specify `SSE-KMS` for `encryptionMode`.
+         */
+        kmsKeyArn?: pulumi.Input<string>;
+    }
     interface CanaryRunConfig {
         /**
          * Whether this canary is to use active AWS X-Ray tracing when it runs. You can enable active tracing only for canaries that use version syn-nodejs-2.0 or later for their canary runtime.
@@ -26752,6 +27016,20 @@ export declare namespace wafv2 {
          */
         regexString: pulumi.Input<string>;
     }
+    interface RuleGroupCustomResponseBody {
+        /**
+         * The payload of the custom response.
+         */
+        content: pulumi.Input<string>;
+        /**
+         * The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+         */
+        contentType: pulumi.Input<string>;
+        /**
+         * A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+         */
+        key: pulumi.Input<string>;
+    }
     interface RuleGroupRule {
         /**
          * The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `aws.wafv2.WebAcl` level can override the rule action setting. See Action below for details.
@@ -26765,6 +27043,10 @@ export declare namespace wafv2 {
          * If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
          */
         priority: pulumi.Input<number>;
+        /**
+         * Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+         */
+        ruleLabels?: pulumi.Input<pulumi.Input<inputs.wafv2.RuleGroupRuleRuleLabel>[]>;
         /**
          * The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
          */
@@ -26802,7 +27084,7 @@ export declare namespace wafv2 {
     }
     interface RuleGroupRuleActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -26817,6 +27099,10 @@ export declare namespace wafv2 {
         customResponse?: pulumi.Input<inputs.wafv2.RuleGroupRuleActionBlockCustomResponse>;
     }
     interface RuleGroupRuleActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: pulumi.Input<string>;
         /**
          * The HTTP status code to return to the client.
          */
@@ -26828,7 +27114,7 @@ export declare namespace wafv2 {
     }
     interface RuleGroupRuleActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -26850,7 +27136,7 @@ export declare namespace wafv2 {
     }
     interface RuleGroupRuleActionCountCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -26858,6 +27144,12 @@ export declare namespace wafv2 {
          */
         value: pulumi.Input<string>;
     }
+    interface RuleGroupRuleRuleLabel {
+        /**
+         * The label string.
+         */
+        name: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatement {
         /**
          * A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
@@ -26875,6 +27167,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -26923,6 +27219,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -26967,6 +27267,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -27108,6 +27412,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -27532,6 +27846,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -27551,6 +27875,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -27692,6 +28020,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -28011,6 +28349,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -28152,6 +28494,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -28876,6 +29228,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -28899,6 +29261,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -28943,6 +29309,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -29084,6 +29454,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -29508,6 +29888,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -29527,6 +29917,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -29668,6 +30062,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -29987,6 +30391,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -30128,6 +30536,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -30751,6 +31169,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -30795,6 +31217,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -30936,6 +31362,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -31360,6 +31796,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -31379,6 +31825,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -31520,6 +31970,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -31839,6 +32299,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -31980,6 +32444,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface RuleGroupRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface RuleGroupRuleStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -32908,6 +33382,20 @@ export declare namespace wafv2 {
          */
         sampledRequestsEnabled: pulumi.Input<boolean>;
     }
+    interface WebAclCustomResponseBody {
+        /**
+         * The payload of the custom response.
+         */
+        content: pulumi.Input<string>;
+        /**
+         * The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+         */
+        contentType: pulumi.Input<string>;
+        /**
+         * A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the Custom Response block.
+         */
+        key: pulumi.Input<string>;
+    }
     interface WebAclDefaultAction {
         /**
          * Specifies that AWS WAF should allow requests by default. See Allow below for details.
@@ -32932,7 +33420,7 @@ export declare namespace wafv2 {
     }
     interface WebAclDefaultActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -32947,6 +33435,10 @@ export declare namespace wafv2 {
         customResponse?: pulumi.Input<inputs.wafv2.WebAclDefaultActionBlockCustomResponse>;
     }
     interface WebAclDefaultActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: pulumi.Input<string>;
         /**
          * The HTTP status code to return to the client.
          */
@@ -32958,7 +33450,7 @@ export declare namespace wafv2 {
     }
     interface WebAclDefaultActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -33089,6 +33581,10 @@ export declare namespace wafv2 {
          * If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
          */
         priority: pulumi.Input<number>;
+        /**
+         * Labels to apply to web requests that match the rule match statement. See Rule Label below for details.
+         */
+        ruleLabels?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleRuleLabel>[]>;
         /**
          * The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See Statement below for details.
          */
@@ -33126,7 +33622,7 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleActionAllowCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -33141,6 +33637,10 @@ export declare namespace wafv2 {
         customResponse?: pulumi.Input<inputs.wafv2.WebAclRuleActionBlockCustomResponse>;
     }
     interface WebAclRuleActionBlockCustomResponse {
+        /**
+         * References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+         */
+        customResponseBodyKey?: pulumi.Input<string>;
         /**
          * The HTTP status code to return to the client.
          */
@@ -33152,7 +33652,7 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleActionBlockCustomResponseResponseHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -33174,7 +33674,7 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleActionCountCustomRequestHandlingInsertHeader {
         /**
-         * The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+         * The label string.
          */
         name: pulumi.Input<string>;
         /**
@@ -33196,6 +33696,12 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleOverrideActionNone {
     }
+    interface WebAclRuleRuleLabel {
+        /**
+         * The label string.
+         */
+        name: pulumi.Input<string>;
+    }
     interface WebAclRuleStatement {
         /**
          * A logical rule statement used to combine other rule statements with AND logic. See AND Statement below for details.
@@ -33213,6 +33719,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementLabelMatchStatement>;
         /**
          * A rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See Managed Rule Group Statement below for details.
          */
@@ -33273,6 +33783,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -33321,6 +33835,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -33365,6 +33883,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -33506,6 +34028,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -33930,6 +34462,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -33949,6 +34491,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -34090,6 +34636,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -34409,6 +34965,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -34550,6 +35110,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -35274,6 +35844,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -35297,6 +35877,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -35341,6 +35925,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -35482,6 +36070,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -35906,6 +36504,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -35925,6 +36533,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -36066,6 +36678,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -36385,6 +37007,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -36526,6 +37152,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -37149,6 +37785,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -37193,6 +37833,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -37334,6 +37978,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -37758,6 +38412,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -37777,6 +38441,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -37918,6 +38586,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -38237,6 +38915,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -38378,6 +39060,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementAndStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -39402,6 +40094,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatement {
         /**
          * The `rules` whose actions are set to `COUNT` by the web ACL, regardless of the action that is set on the rule. See Excluded Rule below for details.
@@ -39443,6 +40145,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -39491,6 +40197,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -39535,6 +40245,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -39676,6 +40390,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -40100,6 +40824,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -40119,6 +40853,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -40260,6 +40998,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -40579,6 +41327,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -40720,6 +41472,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -41444,6 +42206,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -41467,6 +42239,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -41511,6 +42287,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -41652,6 +42432,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -42076,6 +42866,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -42095,6 +42895,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -42236,6 +43040,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -42555,6 +43369,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -42696,6 +43514,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -43319,6 +44147,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -43363,6 +44195,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -43504,6 +44340,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -43928,6 +44774,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -43947,6 +44803,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -44088,6 +44948,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -44407,6 +45277,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -44548,6 +45422,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -45471,6 +46355,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -45519,6 +46407,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -45563,6 +46455,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -45704,6 +46600,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -46128,6 +47034,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -46147,6 +47063,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -46288,6 +47208,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -46607,6 +47537,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -46748,6 +47682,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -47472,6 +48416,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -47495,6 +48449,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -47539,6 +48497,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -47680,6 +48642,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -48104,6 +49076,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -48123,6 +49105,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -48264,6 +49250,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -48583,6 +49579,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -48724,6 +49724,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -49347,6 +50357,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -49391,6 +50405,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -49532,6 +50550,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -49956,6 +50984,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -49975,6 +51013,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -50116,6 +51158,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -50435,6 +51487,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -50576,6 +51632,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementNotStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -51499,6 +52565,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -51547,6 +52617,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -51591,6 +52665,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -51732,6 +52810,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -52156,6 +53244,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -52175,6 +53273,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -52316,6 +53418,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -52635,6 +53747,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -52776,6 +53892,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -53500,6 +54626,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -53523,6 +54659,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -53567,6 +54707,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -53708,6 +54852,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -54132,6 +55286,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -54151,6 +55315,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -54292,6 +55460,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -54611,6 +55789,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -54752,6 +55934,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -55375,6 +56567,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -55419,6 +56615,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -55560,6 +56760,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -55984,6 +57194,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -56003,6 +57223,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -56144,6 +57368,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -56463,6 +57697,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -56604,6 +57842,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementOrStatementStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -57549,6 +58797,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -57597,6 +58849,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -57641,6 +58897,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -57782,6 +59042,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -58206,6 +59476,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -58225,6 +59505,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -58366,6 +59650,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -58685,6 +59979,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -58826,6 +60124,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -59550,6 +60858,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -59573,6 +60891,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -59617,6 +60939,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -59758,6 +61084,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -60182,6 +61518,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -60201,6 +61547,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -60342,6 +61692,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -60661,6 +62021,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -60802,6 +62166,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -61425,6 +62799,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A logical rule statement used to negate the results of another rule statement. See NOT Statement below for details.
          */
@@ -61469,6 +62847,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -61610,6 +62992,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementAndStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -62034,6 +63426,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatement {
         /**
          * The statement to negate. You can use any statement that can be nested. See Statement above for details.
@@ -62053,6 +63455,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -62194,6 +63600,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementNotStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
@@ -62513,6 +63929,10 @@ export declare namespace wafv2 {
          * A rule statement used to detect web requests coming from particular IP addresses or address ranges. See IP Set Reference Statement below for details.
          */
         ipSetReferenceStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementIpSetReferenceStatement>;
+        /**
+         * A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See Label Match Statement below for details.
+         */
+        labelMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement>;
         /**
          * A rule statement used to search web request components for matches with regular expressions. See Regex Pattern Set Reference Statement below for details.
          */
@@ -62654,6 +64074,16 @@ export declare namespace wafv2 {
          */
         position: pulumi.Input<string>;
     }
+    interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementLabelMatchStatement {
+        /**
+         * The string to match against.
+         */
+        key: pulumi.Input<string>;
+        /**
+         * Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+         */
+        scope: pulumi.Input<string>;
+    }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatementStatementOrStatementStatementRegexPatternSetReferenceStatement {
         /**
          * The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.