@pulumi/aws 5.19.0 → 5.20.0

package/types/output.d.ts

@@ -923,10 +923,20 @@ export declare namespace alb {
          */
         enabled?: boolean;
         /**
-         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, and `sourceIp` for NLBs.
+         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, `sourceIp` for NLBs, and `sourceIpDestIp`, `sourceIpDestIpProto` for GWLBs.
          */
         type: string;
     }
+    interface TargetGroupTargetFailover {
+        /**
+         * Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onUnhealthy`. Default: `noRebalance`.
+         */
+        onDeregistration: string;
+        /**
+         * Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onDeregistration`. Default: `noRebalance`.
+         */
+        onUnhealthy: string;
+    }
 }
 export declare namespace amp {
     interface WorkspaceLoggingConfiguration {
@@ -3784,10 +3794,20 @@ export declare namespace applicationloadbalancing {
          */
         enabled?: boolean;
         /**
-         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, and `sourceIp` for NLBs.
+         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, `sourceIp` for NLBs, and `sourceIpDestIp`, `sourceIpDestIpProto` for GWLBs.
          */
         type: string;
     }
+    interface TargetGroupTargetFailover {
+        /**
+         * Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onUnhealthy`. Default: `noRebalance`.
+         */
+        onDeregistration: string;
+        /**
+         * Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onDeregistration`. Default: `noRebalance`.
+         */
+        onUnhealthy: string;
+    }
 }
 export declare namespace appmesh {
     interface GatewayRouteSpec {
@@ -5728,20 +5748,30 @@ export declare namespace apprunner {
     }
     interface ServiceNetworkConfiguration {
         /**
-         * Network configuration settings for outbound message traffic.
+         * Network configuration settings for outbound message traffic. See Egress Configuration below for more details.
          */
-        egressConfiguration?: outputs.apprunner.ServiceNetworkConfigurationEgressConfiguration;
+        egressConfiguration: outputs.apprunner.ServiceNetworkConfigurationEgressConfiguration;
+        /**
+         * Network configuration settings for inbound network traffic. See Ingress Configuration below for more details.
+         */
+        ingressConfiguration: outputs.apprunner.ServiceNetworkConfigurationIngressConfiguration;
     }
     interface ServiceNetworkConfigurationEgressConfiguration {
         /**
-         * Type of egress configuration.Set to DEFAULT for access to resources hosted on public networks.Set to VPC to associate your service to a custom VPC specified by VpcConnectorArn.
+         * The type of egress configuration. Valid values are: `DEFAULT` and `VPC`.
          */
         egressType: string;
         /**
-         * ARN of the App Runner VPC connector that you want to associate with your App Runner service. Only valid when EgressType = VPC.
+         * The Amazon Resource Name (ARN) of the App Runner VPC connector that you want to associate with your App Runner service. Only valid when `EgressType = VPC`.
          */
         vpcConnectorArn?: string;
     }
+    interface ServiceNetworkConfigurationIngressConfiguration {
+        /**
+         * Specifies whether your App Runner service is publicly accessible. To make the service publicly accessible set it to True. To make the service privately accessible, from only within an Amazon VPC set it to False.
+         */
+        isPubliclyAccessible?: boolean;
+    }
     interface ServiceObservabilityConfiguration {
         /**
          * ARN of the observability configuration that is associated with the service.
@@ -5814,7 +5844,7 @@ export declare namespace apprunner {
          */
         port?: string;
         /**
-         * Runtime environment type for building and running an App Runner service. Represents a programming language runtime. Valid values: `PYTHON_3`, `NODEJS_12`.
+         * Runtime environment type for building and running an App Runner service. Represents a programming language runtime. Valid values: `PYTHON_3`, `NODEJS_12`, `NODEJS_14`, `NODEJS_16`, `CORRETTO_8`, `CORRETTO_11`, `GO_1`, `DOTNET_6`, `PHP_81`, `RUBY_31`.
          */
         runtime: string;
         /**
@@ -5869,6 +5899,16 @@ export declare namespace apprunner {
          */
         startCommand?: string;
     }
+    interface VpcIngressConnectionIngressVpcConfiguration {
+        /**
+         * The ID of the VPC endpoint that your App Runner service connects to.
+         */
+        vpcEndpointId?: string;
+        /**
+         * The ID of the VPC that is used for the VPC endpoint.
+         */
+        vpcId?: string;
+    }
 }
 export declare namespace appstream {
     interface DirectoryConfigServiceAccountCredentials {
@@ -7641,9 +7681,9 @@ export declare namespace batch {
          */
         minVcpus?: number;
         /**
-         * A list of EC2 security group that are associated with instances launched in the compute environment.
+         * A list of EC2 security group that are associated with instances launched in the compute environment. This parameter is required for Fargate compute environments.
          */
-        securityGroupIds: string[];
+        securityGroupIds?: string[];
         /**
          * The Amazon Resource Name (ARN) of the Amazon EC2 Spot Fleet IAM role applied to a SPOT compute environment. This parameter is required for SPOT compute environments. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
          */
@@ -7687,6 +7727,16 @@ export declare namespace batch {
          */
         version?: string;
     }
+    interface ComputeEnvironmentEksConfiguration {
+        /**
+         * The Amazon Resource Name (ARN) of the Amazon EKS cluster.
+         */
+        eksClusterArn: string;
+        /**
+         * The namespace of the Amazon EKS cluster. AWS Batch manages pods in this namespace.
+         */
+        kubernetesNamespace: string;
+    }
     interface GetJobQueueComputeEnvironmentOrder {
         computeEnvironment: string;
         order: number;
@@ -7845,6 +7895,15 @@ export declare namespace budgets {
          */
         subscriptionType: string;
     }
+    interface BudgetAutoAdjustData {
+        autoAdjustType: string;
+        historicalOptions?: outputs.budgets.BudgetAutoAdjustDataHistoricalOptions;
+        lastAutoAdjustTime: string;
+    }
+    interface BudgetAutoAdjustDataHistoricalOptions {
+        budgetAdjustmentPeriod: number;
+        lookbackAvailablePeriods: number;
+    }
     interface BudgetCostFilter {
         /**
          * The name of a budget. Unique within accounts.
@@ -7924,6 +7983,20 @@ export declare namespace budgets {
          */
         thresholdType: string;
     }
+    interface BudgetPlannedLimit {
+        /**
+         * (Required) The amount of cost or usage being measured for a budget.
+         */
+        amount: string;
+        /**
+         * (Required) The start time of the budget limit. Format: `2017-01-01_12:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+         */
+        startTime: string;
+        /**
+         * (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+         */
+        unit: string;
+    }
 }
 export declare namespace cfg {
     interface ConfigurationAggregatorAccountAggregationSource {
@@ -12363,6 +12436,88 @@ export declare namespace connect {
          */
         minutes: number;
     }
+    interface GetInstanceStorageConfigStorageConfig {
+        /**
+         * A block that specifies the configuration of the Kinesis Firehose delivery stream. Documented below.
+         */
+        kinesisFirehoseConfigs: outputs.connect.GetInstanceStorageConfigStorageConfigKinesisFirehoseConfig[];
+        /**
+         * A block that specifies the configuration of the Kinesis data stream. Documented below.
+         */
+        kinesisStreamConfigs: outputs.connect.GetInstanceStorageConfigStorageConfigKinesisStreamConfig[];
+        /**
+         * A block that specifies the configuration of the Kinesis video stream. Documented below.
+         */
+        kinesisVideoStreamConfigs: outputs.connect.GetInstanceStorageConfigStorageConfigKinesisVideoStreamConfig[];
+        /**
+         * A block that specifies the configuration of S3 Bucket. Documented below.
+         */
+        s3Configs: outputs.connect.GetInstanceStorageConfigStorageConfigS3Config[];
+        /**
+         * A valid storage type. Valid Values: `S3` | `KINESIS_VIDEO_STREAM` | `KINESIS_STREAM` | `KINESIS_FIREHOSE`.
+         */
+        storageType: string;
+    }
+    interface GetInstanceStorageConfigStorageConfigKinesisFirehoseConfig {
+        /**
+         * The Amazon Resource Name (ARN) of the delivery stream.
+         */
+        firehoseArn: string;
+    }
+    interface GetInstanceStorageConfigStorageConfigKinesisStreamConfig {
+        /**
+         * The Amazon Resource Name (ARN) of the data stream.
+         */
+        streamArn: string;
+    }
+    interface GetInstanceStorageConfigStorageConfigKinesisVideoStreamConfig {
+        /**
+         * The encryption configuration. Documented below.
+         */
+        encryptionConfigs: outputs.connect.GetInstanceStorageConfigStorageConfigKinesisVideoStreamConfigEncryptionConfig[];
+        /**
+         * The prefix of the video stream. Minimum length of `1`. Maximum length of `128`. When read from the state, the value returned is `<prefix>-connect-<connect_instance_alias>-contact-` since the API appends additional details to the `prefix`.
+         */
+        prefix: string;
+        /**
+         * The number of hours to retain the data in a data store associated with the stream. Minimum value of `0`. Maximum value of `87600`. A value of `0` indicates that the stream does not persist data.
+         */
+        retentionPeriodHours: number;
+    }
+    interface GetInstanceStorageConfigStorageConfigKinesisVideoStreamConfigEncryptionConfig {
+        /**
+         * The type of encryption. Valid Values: `KMS`.
+         */
+        encryptionType: string;
+        /**
+         * The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
+         */
+        keyId: string;
+    }
+    interface GetInstanceStorageConfigStorageConfigS3Config {
+        /**
+         * The S3 bucket name.
+         */
+        bucketName: string;
+        /**
+         * The S3 bucket prefix.
+         */
+        bucketPrefix: string;
+        /**
+         * The encryption configuration. Documented below.
+         */
+        encryptionConfigs: outputs.connect.GetInstanceStorageConfigStorageConfigS3ConfigEncryptionConfig[];
+    }
+    interface GetInstanceStorageConfigStorageConfigS3ConfigEncryptionConfig {
+        /**
+         * The type of encryption. Valid Values: `KMS`.
+         */
+        encryptionType: string;
+        /**
+         * The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
+         */
+        keyId: string;
+    }
     interface GetQueueOutboundCallerConfig {
         /**
          * Specifies the caller ID name.
@@ -12757,6 +12912,16 @@ export declare namespace connect {
          */
         keyId: string;
     }
+    interface PhoneNumberStatus {
+        /**
+         * The status message.
+         */
+        message: string;
+        /**
+         * The status of the phone number. Valid Values: `CLAIMED` | `IN_PROGRESS` | `FAILED`.
+         */
+        status: string;
+    }
     interface QueueOutboundCallerConfig {
         /**
          * Specifies the caller ID name.
@@ -14179,6 +14344,10 @@ export declare namespace datasync {
          * Whether the DataSync Task should preserve the metadata of block and character devices in the source files system, and recreate the files with that device name and metadata on the destination. The DataSync Task can’t sync the actual contents of such devices, because many of the devices are non-terminal and don’t return an end of file (EOF) marker. Valid values: `NONE`, `PRESERVE`. Default: `NONE` (ignore special devices).
          */
         preserveDevices?: string;
+        /**
+         * Determines which components of the SMB security descriptor are copied from source to destination objects. This value is only used for transfers between SMB and Amazon FSx for Windows File Server locations, or between two Amazon FSx for Windows File Server locations. Valid values: `NONE`, `OWNER_DACL`, `OWNER_DACL_SACL`.
+         */
+        securityDescriptorCopyFlags: string;
         /**
          * Determines whether tasks should be queued before executing the tasks. Valid values: `ENABLED`, `DISABLED`. Default `ENABLED`.
          */
@@ -14260,6 +14429,31 @@ export declare namespace devicefarm {
         vpcId: string;
     }
 }
+export declare namespace directconnect {
+    interface GetRouterConfigurationRouter {
+        /**
+         * Router platform
+         */
+        platform: string;
+        /**
+         * ID of the Router Type. For example: `CiscoSystemsInc-2900SeriesRouters-IOS124`
+         */
+        routerTypeIdentifier: string;
+        /**
+         * Router operating system
+         */
+        software: string;
+        /**
+         * Router vendor
+         */
+        vendor: string;
+        /**
+         * Router XSLT Template Name
+         */
+        xsltTemplateName: string;
+        xsltTemplateNameForMacSec: string;
+    }
+}
 export declare namespace directoryservice {
     interface DirectoryConnectSettings {
         availabilityZones: string[];
@@ -21783,6 +21977,16 @@ export declare namespace elasticache {
         logFormat: string;
         logType: string;
     }
+    interface GlobalReplicationGroupGlobalNodeGroup {
+        /**
+         * The ID of the global node group.
+         */
+        globalNodeGroupId: string;
+        /**
+         * The keyspace for this node group.
+         */
+        slots: string;
+    }
     interface ParameterGroupParameter {
         /**
          * The name of the ElastiCache parameter.
@@ -22623,10 +22827,20 @@ export declare namespace elasticloadbalancingv2 {
          */
         enabled?: boolean;
         /**
-         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, and `sourceIp` for NLBs.
+         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, `sourceIp` for NLBs, and `sourceIpDestIp`, `sourceIpDestIpProto` for GWLBs.
          */
         type: string;
     }
+    interface TargetGroupTargetFailover {
+        /**
+         * Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onUnhealthy`. Default: `noRebalance`.
+         */
+        onDeregistration: string;
+        /**
+         * Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onDeregistration`. Default: `noRebalance`.
+         */
+        onUnhealthy: string;
+    }
 }
 export declare namespace elasticsearch {
     interface DomainAdvancedSecurityOptions {
@@ -24349,6 +24563,76 @@ export declare namespace fsx {
          */
         events: string[];
     }
+    interface FileCacheDataRepositoryAssociation {
+        associationId: string;
+        /**
+         * The path to the S3 or NFS data repository that links to the cache.
+         */
+        dataRepositoryPath: string;
+        /**
+         * A list of NFS Exports that will be linked with this data repository association. The Export paths are in the format /exportpath1. To use this parameter, you must configure DataRepositoryPath as the domain name of the NFS file system. The NFS file system domain name in effect is the root of the subdirectories. Note that DataRepositorySubdirectories is not supported for S3 data repositories. Max of 500.
+         */
+        dataRepositorySubdirectories?: string[];
+        /**
+         * The system-generated, unique ID of the cache.
+         */
+        fileCacheId: string;
+        /**
+         * A path on the cache that points to a high-level directory (such as /ns1/) or subdirectory (such as /ns1/subdir/) that will be mapped 1-1 with DataRepositoryPath. The leading forward slash in the name is required. Two data repository associations cannot have overlapping cache paths. For example, if a data repository is associated with cache path /ns1/, then you cannot link another data repository with cache path /ns1/ns2. This path specifies where in your cache files will be exported from. This cache directory can be linked to only one data repository, and no data repository other can be linked to the directory. Note: The cache path can only be set to root (/) on an NFS DRA when DataRepositorySubdirectories is specified. If you specify root (/) as the cache path, you can create only one DRA on the cache. The cache path cannot be set to root (/) for an S3 DRA.
+         */
+        fileCachePath: string;
+        fileSystemId: string;
+        fileSystemPath: string;
+        importedFileChunkSize: number;
+        /**
+         * - (Optional) See the `nfs` configuration block.
+         */
+        nfs?: outputs.fsx.FileCacheDataRepositoryAssociationNf[];
+        resourceArn: string;
+        tags: {
+            [key: string]: string;
+        };
+    }
+    interface FileCacheDataRepositoryAssociationNf {
+        /**
+         * - A list of up to 2 IP addresses of DNS servers used to resolve the NFS file system domain name. The provided IP addresses can either be the IP addresses of a DNS forwarder or resolver that the customer manages and runs inside the customer VPC, or the IP addresses of the on-premises DNS servers.
+         */
+        dnsIps?: string[];
+        /**
+         * - The version of the NFS (Network File System) protocol of the NFS data repository. The only supported value is NFS3, which indicates that the data repository must support the NFSv3 protocol. The only supported value is `NFS3`.
+         */
+        version: string;
+    }
+    interface FileCacheLustreConfiguration {
+        /**
+         * Specifies the cache deployment type. The only supported value is `CACHE_1`.
+         */
+        deploymentType: string;
+        logConfigurations: outputs.fsx.FileCacheLustreConfigurationLogConfiguration[];
+        /**
+         * The configuration for a Lustre MDT (Metadata Target) storage volume. See the `metadataConfiguration` block.
+         */
+        metadataConfigurations: outputs.fsx.FileCacheLustreConfigurationMetadataConfiguration[];
+        mountName: string;
+        /**
+         * Provisions the amount of read and write throughput for each 1 tebibyte (TiB) of cache storage capacity, in MB/s/TiB. The only supported value is `1000`.
+         */
+        perUnitStorageThroughput: number;
+        /**
+         * A recurring weekly time, in the format `D:HH:MM`. `D` is the day of the week, for which `1` represents Monday and `7` represents Sunday. `HH` is the zero-padded hour of the day (0-23), and `MM` is the zero-padded minute of the hour. For example, 1:05:00 specifies maintenance at 5 AM Monday. See the [ISO week date](https://en.wikipedia.org/wiki/ISO_week_date) for more information.
+         */
+        weeklyMaintenanceStartTime?: string;
+    }
+    interface FileCacheLustreConfigurationLogConfiguration {
+        destination: string;
+        level: string;
+    }
+    interface FileCacheLustreConfigurationMetadataConfiguration {
+        /**
+         * The storage capacity of the Lustre MDT (Metadata Target) storage volume in gibibytes (GiB). The only supported value is `2400` GiB.
+         */
+        storageCapacity: number;
+    }
     interface GetOpenZfsSnapshotFilter {
         /**
          * Name of the snapshot.
@@ -31787,10 +32071,20 @@ export declare namespace lb {
          */
         enabled?: boolean;
         /**
-         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, and `sourceIp` for NLBs.
+         * The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, `sourceIp` for NLBs, and `sourceIpDestIp`, `sourceIpDestIpProto` for GWLBs.
          */
         type: string;
     }
+    interface TargetGroupTargetFailover {
+        /**
+         * Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onUnhealthy`. Default: `noRebalance`.
+         */
+        onDeregistration: string;
+        /**
+         * Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onDeregistration`. Default: `noRebalance`.
+         */
+        onUnhealthy: string;
+    }
 }
 export declare namespace lex {
     interface BotAbortStatement {
@@ -32307,6 +32601,15 @@ export declare namespace lightsail {
          */
         toPort: number;
     }
+    interface LbCertificateDomainValidationRecord {
+        /**
+         * The domain name (e.g., example.com) for your SSL/TLS certificate.
+         */
+        domainName: string;
+        resourceRecordName: string;
+        resourceRecordType: string;
+        resourceRecordValue: string;
+    }
 }
 export declare namespace location {
     interface GetMapConfiguration {
@@ -34467,7 +34770,7 @@ export declare namespace networkmanager {
         /**
          * ASN of the Core Network Edge in an AWS Region. By default, the ASN will be a single integer automatically assigned from `asnRanges`
          */
-        asn?: number;
+        asn?: string;
         /**
          * The local CIDR blocks for this Core Network Edge for AWS Transit Gateway Connect attachments. By default, this CIDR block will be one or more optional IPv4 and IPv6 CIDR prefixes auto-assigned from `insideCidrBlocks`.
          */
@@ -39819,6 +40122,10 @@ export declare namespace sagemaker {
         s3OutputLocation: string;
     }
     interface DomainDefaultUserSettings {
+        /**
+         * The Canvas app settings. See Canvas App Settings below.
+         */
+        canvasAppSettings?: outputs.sagemaker.DomainDefaultUserSettingsCanvasAppSettings;
         /**
          * The execution role ARN for the user.
          */
@@ -39831,6 +40138,10 @@ export declare namespace sagemaker {
          * The kernel gateway app settings. See Kernel Gateway App Settings below.
          */
         kernelGatewayAppSettings?: outputs.sagemaker.DomainDefaultUserSettingsKernelGatewayAppSettings;
+        /**
+         * The RSession app settings. See RSession App Settings below.
+         */
+        rSessionAppSettings?: outputs.sagemaker.DomainDefaultUserSettingsRSessionAppSettings;
         /**
          * A list of security group IDs that will be attached to the user.
          */
@@ -39844,6 +40155,22 @@ export declare namespace sagemaker {
          */
         tensorBoardAppSettings?: outputs.sagemaker.DomainDefaultUserSettingsTensorBoardAppSettings;
     }
+    interface DomainDefaultUserSettingsCanvasAppSettings {
+        /**
+         * Time series forecast settings for the Canvas app. see Time Series Forecasting Settings below.
+         */
+        timeSeriesForecastingSettings?: outputs.sagemaker.DomainDefaultUserSettingsCanvasAppSettingsTimeSeriesForecastingSettings;
+    }
+    interface DomainDefaultUserSettingsCanvasAppSettingsTimeSeriesForecastingSettings {
+        /**
+         * The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
+         */
+        amazonForecastRoleArn?: string;
+        /**
+         * Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `ENABLED` and `DISABLED`.
+         */
+        status?: string;
+    }
     interface DomainDefaultUserSettingsJupyterServerAppSettings {
         /**
          * The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see Default Resource Spec below.
@@ -39918,6 +40245,48 @@ export declare namespace sagemaker {
          */
         sagemakerImageVersionArn?: string;
     }
+    interface DomainDefaultUserSettingsRSessionAppSettings {
+        /**
+         * A list of custom SageMaker images that are configured to run as a KernelGateway app. see Custom Image below.
+         */
+        customImages?: outputs.sagemaker.DomainDefaultUserSettingsRSessionAppSettingsCustomImage[];
+        /**
+         * The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see Default Resource Spec below.
+         */
+        defaultResourceSpec?: outputs.sagemaker.DomainDefaultUserSettingsRSessionAppSettingsDefaultResourceSpec;
+    }
+    interface DomainDefaultUserSettingsRSessionAppSettingsCustomImage {
+        /**
+         * The name of the App Image Config.
+         */
+        appImageConfigName: string;
+        /**
+         * The name of the Custom Image.
+         */
+        imageName: string;
+        /**
+         * The version number of the Custom Image.
+         */
+        imageVersionNumber?: number;
+    }
+    interface DomainDefaultUserSettingsRSessionAppSettingsDefaultResourceSpec {
+        /**
+         * The instance type that the image version runs on.. For valid values see [SageMaker Instance Types](https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks-available-instance-types.html).
+         */
+        instanceType?: string;
+        /**
+         * The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+         */
+        lifecycleConfigArn?: string;
+        /**
+         * The ARN of the SageMaker image that the image version belongs to.
+         */
+        sagemakerImageArn?: string;
+        /**
+         * The ARN of the image version created on the instance.
+         */
+        sagemakerImageVersionArn?: string;
+    }
     interface DomainDefaultUserSettingsSharingSettings {
         /**
          * Whether to include the notebook cell output when sharing the notebook. The default is `Disabled`. Valid values are `Allowed` and `Disabled`.
@@ -39956,6 +40325,16 @@ export declare namespace sagemaker {
          */
         sagemakerImageVersionArn?: string;
     }
+    interface DomainDomainSettings {
+        /**
+         * The configuration for attaching a SageMaker user profile name to the execution role as a sts:SourceIdentity key [AWS Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html). Valid values are `USER_PROFILE_NAME` and `DISABLED`.
+         */
+        executionRoleIdentityConfig?: string;
+        /**
+         * The security groups for the Amazon Virtual Private Cloud that the Domain uses for communication between Domain-level apps and user apps.
+         */
+        securityGroupIds?: string[];
+    }
     interface DomainRetentionPolicy {
         /**
          * The retention policy for data stored on an Amazon Elastic File System (EFS) volume. Valid values are `Retain` or `Delete`.  Default value is `Retain`.
@@ -40457,6 +40836,10 @@ export declare namespace sagemaker {
         value?: string;
     }
     interface UserProfileUserSettings {
+        /**
+         * The Canvas app settings. See Canvas App Settings below.
+         */
+        canvasAppSettings?: outputs.sagemaker.UserProfileUserSettingsCanvasAppSettings;
         /**
          * The execution role ARN for the user.
          */
@@ -40469,6 +40852,10 @@ export declare namespace sagemaker {
          * The kernel gateway app settings. See Kernel Gateway App Settings below.
          */
         kernelGatewayAppSettings?: outputs.sagemaker.UserProfileUserSettingsKernelGatewayAppSettings;
+        /**
+         * The RSession app settings. See RSession App Settings below.
+         */
+        rSessionAppSettings?: outputs.sagemaker.UserProfileUserSettingsRSessionAppSettings;
         /**
          * The security groups.
          */
@@ -40482,6 +40869,22 @@ export declare namespace sagemaker {
          */
         tensorBoardAppSettings?: outputs.sagemaker.UserProfileUserSettingsTensorBoardAppSettings;
     }
+    interface UserProfileUserSettingsCanvasAppSettings {
+        /**
+         * Time series forecast settings for the Canvas app. see Time Series Forecasting Settings below.
+         */
+        timeSeriesForecastingSettings?: outputs.sagemaker.UserProfileUserSettingsCanvasAppSettingsTimeSeriesForecastingSettings;
+    }
+    interface UserProfileUserSettingsCanvasAppSettingsTimeSeriesForecastingSettings {
+        /**
+         * The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
+         */
+        amazonForecastRoleArn?: string;
+        /**
+         * Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `ENABLED` and `DISABLED`.
+         */
+        status?: string;
+    }
     interface UserProfileUserSettingsJupyterServerAppSettings {
         /**
          * The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see Default Resource Spec below.
@@ -40556,6 +40959,48 @@ export declare namespace sagemaker {
          */
         sagemakerImageVersionArn?: string;
     }
+    interface UserProfileUserSettingsRSessionAppSettings {
+        /**
+         * A list of custom SageMaker images that are configured to run as a KernelGateway app. see Custom Image below.
+         */
+        customImages?: outputs.sagemaker.UserProfileUserSettingsRSessionAppSettingsCustomImage[];
+        /**
+         * The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see Default Resource Spec below.
+         */
+        defaultResourceSpec?: outputs.sagemaker.UserProfileUserSettingsRSessionAppSettingsDefaultResourceSpec;
+    }
+    interface UserProfileUserSettingsRSessionAppSettingsCustomImage {
+        /**
+         * The name of the App Image Config.
+         */
+        appImageConfigName: string;
+        /**
+         * The name of the Custom Image.
+         */
+        imageName: string;
+        /**
+         * The version number of the Custom Image.
+         */
+        imageVersionNumber?: number;
+    }
+    interface UserProfileUserSettingsRSessionAppSettingsDefaultResourceSpec {
+        /**
+         * The instance type.
+         */
+        instanceType?: string;
+        /**
+         * The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+         */
+        lifecycleConfigArn?: string;
+        /**
+         * The Amazon Resource Name (ARN) of the SageMaker image created on the instance.
+         */
+        sagemakerImageArn?: string;
+        /**
+         * The ARN of the image version created on the instance.
+         */
+        sagemakerImageVersionArn?: string;
+    }
     interface UserProfileUserSettingsSharingSettings {
         /**
          * Whether to include the notebook cell output when sharing the notebook. The default is `Disabled`. Valid values are `Allowed` and `Disabled`.
@@ -40644,6 +41089,21 @@ export declare namespace sagemaker {
          */
         cidrs: string[];
     }
+    interface WorkforceWorkforceVpcConfig {
+        /**
+         * The VPC security group IDs. The security groups must be for the same VPC as specified in the subnet.
+         */
+        securityGroupIds?: string[];
+        /**
+         * The ID of the subnets in the VPC that you want to connect.
+         */
+        subnets?: string[];
+        vpcEndpointId: string;
+        /**
+         * The ID of the VPC that the workforce uses for communication.
+         */
+        vpcId?: string;
+    }
     interface WorkteamMemberDefinition {
         /**
          * The Amazon Cognito user group that is part of the work team. See Cognito Member Definition details below.
@@ -42607,6 +43067,40 @@ export declare namespace sesv2 {
          */
         customRedirectDomain: string;
     }
+    interface EmailIdentityDkimSigningAttributes {
+        /**
+         * [Easy DKIM] The key length of the DKIM key pair in use.
+         */
+        currentSigningKeyLength: string;
+        /**
+         * [Bring Your Own DKIM] A private key that's used to generate a DKIM signature. The private key must use 1024 or 2048-bit RSA encryption, and must be encoded using base64 encoding.
+         */
+        domainSigningPrivateKey?: string;
+        /**
+         * [Bring Your Own DKIM] A string that's used to identify a public key in the DNS configuration for a domain.
+         */
+        domainSigningSelector?: string;
+        /**
+         * [Easy DKIM] The last time a key pair was generated for this identity.
+         */
+        lastKeyGenerationTimestamp: string;
+        /**
+         * [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day. Valid values: `RSA_1024_BIT`, `RSA_2048_BIT`.
+         */
+        nextSigningKeyLength: string;
+        /**
+         * A string that indicates how DKIM was configured for the identity. `AWS_SES` indicates that DKIM was configured for the identity by using Easy DKIM. `EXTERNAL` indicates that DKIM was configured for the identity by using Bring Your Own DKIM (BYODKIM).
+         */
+        signingAttributesOrigin: string;
+        /**
+         * Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
+         */
+        status: string;
+        /**
+         * If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
+         */
+        tokens: string[];
+    }
     interface GetDedicatedIpPoolDedicatedIp {
         /**
          * IPv4 address.
@@ -43023,23 +43517,35 @@ export declare namespace ssm {
     }
     interface PatchBaselineApprovalRule {
         /**
-         * The number of days after the release date of each patch matched by the rule the patch is marked as approved in the patch baseline. Valid Range: 0 to 100. Conflicts with `approveUntilDate`
+         * The number of days after the release date of each patch matched by the rule the patch is marked as approved in the patch baseline.
+         * Valid Range: 0 to 100.
+         * Conflicts with `approveUntilDate`.
          */
         approveAfterDays?: number;
         /**
-         * The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Date is formatted as `YYYY-MM-DD`. Conflicts with `approveAfterDays`
+         * The cutoff date for auto approval of released patches.
+         * Any patches released on or before this date are installed automatically.
+         * Date is formatted as `YYYY-MM-DD`.
+         * Conflicts with `approveAfterDays`
          */
         approveUntilDate?: string;
         /**
-         * Defines the compliance level for patches approved by this rule. Valid compliance levels include the following: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL`, `UNSPECIFIED`. The default value is `UNSPECIFIED`.
+         * The compliance level for patches approved by this rule.
+         * Valid values are `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL`, and `UNSPECIFIED`.
+         * The default value is `UNSPECIFIED`.
          */
         complianceLevel?: string;
         /**
-         * Boolean enabling the application of non-security updates. The default value is 'false'. Valid for Linux instances only.
+         * Boolean enabling the application of non-security updates.
+         * The default value is `false`.
+         * Valid for Linux instances only.
          */
         enableNonSecurity?: boolean;
         /**
-         * The patch filter group that defines the criteria for the rule. Up to 5 patch filters can be specified per approval rule using Key/Value pairs. Valid combinations of these Keys and the `operatingSystem` value can be found in the [SSM DescribePatchProperties API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html). Valid Values are exact values for the patch property given as the key, or a wildcard `*`, which matches all values.
+         * The patch filter group that defines the criteria for the rule.
+         * Up to 5 patch filters can be specified per approval rule using Key/Value pairs.
+         * Valid combinations of these Keys and the `operatingSystem` value can be found in the [SSM DescribePatchProperties API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html).
+         * Valid Values are exact values for the patch property given as the key, or a wildcard `*`, which matches all values.
          */
         patchFilters: outputs.ssm.PatchBaselineApprovalRulePatchFilter[];
     }
@@ -43053,7 +43559,8 @@ export declare namespace ssm {
     }
     interface PatchBaselineSource {
         /**
-         * The value of the yum repo configuration. For information about other options available for your yum repository configuration, see the [`dnf.conf` documentation](https://man7.org/linux/man-pages/man5/dnf.conf.5.html)
+         * The value of the yum repo configuration.
+         * For information about other options available for your yum repository configuration, see the [`dnf.conf` documentation](https://man7.org/linux/man-pages/man5/dnf.conf.5.html)
          */
         configuration: string;
         /**
@@ -43061,7 +43568,8 @@ export declare namespace ssm {
          */
         name: string;
         /**
-         * The specific operating system versions a patch repository applies to, such as `"Ubuntu16.04"`, `"AmazonLinux2016.09"`, `"RedhatEnterpriseLinux7.2"` or `"Suse12.7"`. For lists of supported product values, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html).
+         * The specific operating system versions a patch repository applies to, such as `"Ubuntu16.04"`, `"AmazonLinux2016.09"`, `"RedhatEnterpriseLinux7.2"` or `"Suse12.7"`.
+         * For lists of supported product values, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html).
          */
         products: string[];
     }