@pulumi/aws 7.13.0-alpha.1764608791 → 7.13.0

package/types/output.d.ts

@@ -336,6 +336,7 @@ export declare namespace alb {
         authenticateOidcs: outputs.alb.GetListenerDefaultActionAuthenticateOidc[];
         fixedResponses: outputs.alb.GetListenerDefaultActionFixedResponse[];
         forwards: outputs.alb.GetListenerDefaultActionForward[];
+        jwtValidations: outputs.alb.GetListenerDefaultActionJwtValidation[];
         order: number;
         redirects: outputs.alb.GetListenerDefaultActionRedirect[];
         targetGroupArn: string;
@@ -388,6 +389,16 @@ export declare namespace alb {
         arn: string;
         weight: number;
     }
+    interface GetListenerDefaultActionJwtValidation {
+        additionalClaims: outputs.alb.GetListenerDefaultActionJwtValidationAdditionalClaim[];
+        issuer: string;
+        jwksEndpoint: string;
+    }
+    interface GetListenerDefaultActionJwtValidationAdditionalClaim {
+        format: string;
+        name: string;
+        values: string[];
+    }
     interface GetListenerDefaultActionRedirect {
         host: string;
         path: string;
@@ -415,6 +426,11 @@ export declare namespace alb {
         enabled: boolean;
         prefix: string;
     }
+    interface GetLoadBalancerHealthCheckLog {
+        bucket: string;
+        enabled: boolean;
+        prefix: string;
+    }
     interface GetLoadBalancerIpamPool {
         ipv4IpamPoolId: string;
     }
@@ -459,6 +475,10 @@ export declare namespace alb {
          * Configuration block for creating an action that distributes requests among one or more target groups. Specify only if `type` is `forward`. See below.
          */
         forward?: outputs.alb.ListenerDefaultActionForward;
+        /**
+         * Configuration block for creating a JWT validation action. Required if `type` is `jwt-validation`.
+         */
+        jwtValidation?: outputs.alb.ListenerDefaultActionJwtValidation;
         /**
          * Order for the action. The action with the lowest value for order is performed first. Valid values are between `1` and `50000`. Defaults to the position in the list of actions.
          */
@@ -472,7 +492,7 @@ export declare namespace alb {
          */
         targetGroupArn?: string;
         /**
-         * Type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito` and `authenticate-oidc`.
+         * Type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito`, `authenticate-oidc` and `jwt-validation`.
          *
          * The following arguments are optional:
          */
@@ -618,6 +638,36 @@ export declare namespace alb {
          */
         weight?: number;
     }
+    interface ListenerDefaultActionJwtValidation {
+        /**
+         * Repeatable configuration block for additional claims to validate.
+         */
+        additionalClaims?: outputs.alb.ListenerDefaultActionJwtValidationAdditionalClaim[];
+        /**
+         * Issuer of the JWT.
+         */
+        issuer: string;
+        /**
+         * JSON Web Key Set (JWKS) endpoint. This endpoint contains JSON Web Keys (JWK) that are used to validate signatures from the provider. This must be a full URL, including the HTTPS protocol, the domain, and the path.
+         *
+         * The following arguments are optional:
+         */
+        jwksEndpoint: string;
+    }
+    interface ListenerDefaultActionJwtValidationAdditionalClaim {
+        /**
+         * Format of the claim value. Valid values are `single-string`, `string-array` and `space-separated-values`.
+         */
+        format: string;
+        /**
+         * Name of the claim to validate. `exp`, `iss`, `nbf`, or `iat` cannot be specified because they are validated by default.
+         */
+        name: string;
+        /**
+         * List of expected values of the claim.
+         */
+        values: string[];
+    }
     interface ListenerDefaultActionRedirect {
         /**
          * Hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
@@ -684,6 +734,10 @@ export declare namespace alb {
          * Cannot be specified with `targetGroupArn`.
          */
         forward?: outputs.alb.ListenerRuleActionForward;
+        /**
+         * Information for creating a JWT validation action. Required if `type` is `jwt-validation`.
+         */
+        jwtValidation?: outputs.alb.ListenerRuleActionJwtValidation;
         /**
          * Order for the action.
          * The action with the lowest value for order is performed first.
@@ -703,7 +757,7 @@ export declare namespace alb {
          */
         targetGroupArn?: string;
         /**
-         * The type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito` and `authenticate-oidc`.
+         * The type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito`, `authenticate-oidc` and `jwt-validation`.
          */
         type: string;
     }
@@ -835,6 +889,34 @@ export declare namespace alb {
          */
         weight?: number;
     }
+    interface ListenerRuleActionJwtValidation {
+        /**
+         * Repeatable configuration block for additional claims to validate.
+         */
+        additionalClaims?: outputs.alb.ListenerRuleActionJwtValidationAdditionalClaim[];
+        /**
+         * Issuer of the JWT.
+         */
+        issuer: string;
+        /**
+         * JSON Web Key Set (JWKS) endpoint. This endpoint contains JSON Web Keys (JWK) that are used to validate signatures from the provider. This must be a full URL, including the HTTPS protocol, the domain, and the path.
+         */
+        jwksEndpoint: string;
+    }
+    interface ListenerRuleActionJwtValidationAdditionalClaim {
+        /**
+         * Format of the claim value. Valid values are `single-string`, `string-array` and `space-separated-values`.
+         */
+        format: string;
+        /**
+         * Name of the claim to validate. `exp`, `iss`, `nbf`, or `iat` cannot be specified because they are validated by default.
+         */
+        name: string;
+        /**
+         * List of expected values of the claim.
+         */
+        values: string[];
+    }
     interface ListenerRuleActionRedirect {
         /**
          * The hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
@@ -1013,6 +1095,20 @@ export declare namespace alb {
          */
         prefix?: string;
     }
+    interface LoadBalancerHealthCheckLogs {
+        /**
+         * S3 bucket name to store the logs in.
+         */
+        bucket: string;
+        /**
+         * Boolean to enable / disable `healthCheckLogs`. Defaults to `false`, even when `bucket` is specified.
+         */
+        enabled?: boolean;
+        /**
+         * S3 bucket prefix. Logs are stored in the root if not configured.
+         */
+        prefix?: string;
+    }
     interface LoadBalancerIpamPools {
         /**
          * The ID of the IPv4 IPAM pool.
@@ -1178,7 +1274,7 @@ export declare namespace amp {
     }
     interface QueryLoggingConfigurationDestinationCloudwatchLogs {
         /**
-         * The ARN of the CloudWatch log group to which query logs will be sent.
+         * The ARN of the CloudWatch log group to which query logs will be sent. The ARN must end with `:*`
          */
         logGroupArn: string;
     }
@@ -1299,7 +1395,7 @@ export declare namespace amp {
     }
     interface WorkspaceLoggingConfiguration {
         /**
-         * The ARN of the CloudWatch log group to which the vended log data will be published. This log group must exist.
+         * The ARN of the CloudWatch log group to which the vended log data will be published. This log group must exist. The ARN must end with `:*`
          */
         logGroupArn: string;
     }
@@ -8112,6 +8208,10 @@ export declare namespace athena {
          * Configuration block to set up an IAM Identity Center enabled workgroup. See Identity Center Configuration below.
          */
         identityCenterConfiguration?: outputs.athena.WorkgroupConfigurationIdentityCenterConfiguration;
+        /**
+         * Configuration block for storing results in Athena owned storage. See Managed Query Results Configuration below.
+         */
+        managedQueryResultsConfiguration?: outputs.athena.WorkgroupConfigurationManagedQueryResultsConfiguration;
         /**
          * Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
          */
@@ -8145,6 +8245,22 @@ export declare namespace athena {
          */
         identityCenterInstanceArn?: string;
     }
+    interface WorkgroupConfigurationManagedQueryResultsConfiguration {
+        /**
+         * If set to `true`, allows you to store query results in Athena owned storage. If set to `false`, workgroup member stores query results in the location specified under `result_configuration.output_location`. The default is `false`. A workgroup cannot have the `result_configuration.output_location` set when this is `true`.
+         */
+        enabled?: boolean;
+        /**
+         * Configuration block for the encryption configuration. See Managed Query Results Encryption Configuration below.
+         */
+        encryptionConfiguration?: outputs.athena.WorkgroupConfigurationManagedQueryResultsConfigurationEncryptionConfiguration;
+    }
+    interface WorkgroupConfigurationManagedQueryResultsConfigurationEncryptionConfiguration {
+        /**
+         * KMS key ARN for encrypting managed query results.
+         */
+        kmsKey?: string;
+    }
     interface WorkgroupConfigurationResultConfiguration {
         /**
          * That an Amazon S3 canned ACL should be set to control ownership of stored query results. See ACL Configuration below.
@@ -9884,9 +10000,11 @@ export declare namespace backup {
             [key: string]: string;
         };
         ruleName: string;
+        scanActions: outputs.backup.GetPlanRuleScanAction[];
         schedule: string;
         scheduleExpressionTimezone: string;
         startWindow: number;
+        targetLogicallyAirGappedBackupVaultArn: string;
         targetVaultName: string;
     }
     interface GetPlanRuleCopyAction {
@@ -9903,6 +10021,15 @@ export declare namespace backup {
         deleteAfter: number;
         optInToArchiveForSupportedResources: boolean;
     }
+    interface GetPlanRuleScanAction {
+        malwareScanner: string;
+        scanMode: string;
+    }
+    interface GetPlanScanSetting {
+        malwareScanner: string;
+        resourceTypes: string[];
+        scannerRoleArn: string;
+    }
     interface GetReportPlanReportDeliveryChannel {
         /**
          * List of the format of your reports: CSV, JSON, or both.
@@ -9988,6 +10115,10 @@ export declare namespace backup {
          * An display name for a backup rule.
          */
         ruleName: string;
+        /**
+         * Block for scanning configuration for the backup rule and includes the malware scanner, and scan mode of either full or incremental.
+         */
+        scanActions?: outputs.backup.PlanRuleScanAction[];
         /**
          * A CRON expression specifying when AWS Backup initiates a backup job.
          */
@@ -10000,6 +10131,10 @@ export declare namespace backup {
          * The amount of time in minutes before beginning a backup.
          */
         startWindow?: number;
+        /**
+         * The ARN of a logically air-gapped vault. ARN must be in the same account and region. If provided, supported fully managed resources back up directly to logically air-gapped vault, while other supported resources create a temporary (billable) snapshot in backup vault, then copy it to logically air-gapped vault. Unsupported resources only back up to the specified backup vault.
+         */
+        targetLogicallyAirGappedBackupVaultArn?: string;
         /**
          * The name of a logical container where backups are stored.
          */
@@ -10043,6 +10178,30 @@ export declare namespace backup {
          */
         optInToArchiveForSupportedResources: boolean;
     }
+    interface PlanRuleScanAction {
+        /**
+         * Malware scanner to use for the scan action. Currently only `GUARDDUTY` is supported.
+         */
+        malwareScanner: string;
+        /**
+         * Scanning mode to use for the scan action. Valid values are `FULL_SCAN` and `INCREMENTAL_SCAN`.
+         */
+        scanMode: string;
+    }
+    interface PlanScanSetting {
+        /**
+         * Malware scanner to use for the scan setting. Currently only `GUARDDUTY` is supported.
+         */
+        malwareScanner: string;
+        /**
+         * List of resource types to apply the scan setting to. Valid values are `EBS`, `EC2`, `S3` and `ALL`.
+         */
+        resourceTypes: string[];
+        /**
+         * ARN of the IAM role that AWS Backup uses to scan resources. See [the AWS documentation](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection-backup-iam-permissions.html) for details.
+         */
+        scannerRoleArn: string;
+    }
     interface ReportPlanReportDeliveryChannel {
         /**
          * A list of the format of your reports: CSV, JSON, or both. If not specified, the default format is CSV.
@@ -12756,6 +12915,10 @@ export declare namespace bedrock {
         tableName: string;
     }
     interface AgentKnowledgeBaseStorageConfigurationRdsConfigurationFieldMapping {
+        /**
+         * Name for the universal metadata field where Amazon Bedrock will store any custom metadata from your data source.
+         */
+        customMetadataField?: string;
         /**
          * Name of the field in which Amazon Bedrock stores metadata about the vector store.
          */
@@ -13059,10 +13222,48 @@ export declare namespace bedrock {
     }
     interface AgentcoreAgentRuntimeAgentRuntimeArtifact {
         /**
-         * Container configuration block. See `containerConfiguration` below.
+         * Code configuration block for the agent runtime artifact, including the source code location and execution settings. Exactly one of `codeConfiguration` or `containerConfiguration` must be specified. See `codeConfiguration` below.
+         */
+        codeConfiguration?: outputs.bedrock.AgentcoreAgentRuntimeAgentRuntimeArtifactCodeConfiguration;
+        /**
+         * Container configuration block for the agent artifact. Exactly one of `codeConfiguration` or `containerConfiguration` must be specified. See `containerConfiguration` below.
          */
         containerConfiguration?: outputs.bedrock.AgentcoreAgentRuntimeAgentRuntimeArtifactContainerConfiguration;
     }
+    interface AgentcoreAgentRuntimeAgentRuntimeArtifactCodeConfiguration {
+        /**
+         * Configuration block for the source code location and configuration details. See `code` below.
+         */
+        code?: outputs.bedrock.AgentcoreAgentRuntimeAgentRuntimeArtifactCodeConfigurationCode;
+        /**
+         * Array specifying the entry point for code execution, indicating the function or method to invoke when the code runs. The array must contain 1 or 2 elements. Examples: `["main.py"]`, `["opentelemetry-instrument", "main.py"]`.
+         */
+        entryPoints: string[];
+        /**
+         * Runtime environment used to execute the code. Valid values: `PYTHON_3_10`, `PYTHON_3_11`, `PYTHON_3_12`, `PYTHON_3_13`.
+         */
+        runtime: string;
+    }
+    interface AgentcoreAgentRuntimeAgentRuntimeArtifactCodeConfigurationCode {
+        /**
+         * Configuration block for the Amazon S3 object that contains the source code for the agent runtime. See `s3` below.
+         */
+        s3?: outputs.bedrock.AgentcoreAgentRuntimeAgentRuntimeArtifactCodeConfigurationCodeS3;
+    }
+    interface AgentcoreAgentRuntimeAgentRuntimeArtifactCodeConfigurationCodeS3 {
+        /**
+         * Name of the Amazon S3 bucket.
+         */
+        bucket: string;
+        /**
+         * Key of the object containing the ZIP file of the source code for the agent runtime in the Amazon S3 bucket.
+         */
+        prefix: string;
+        /**
+         * Version ID of the Amazon S3 object. If not specified, the latest version of the object is used.
+         */
+        versionId?: string;
+    }
     interface AgentcoreAgentRuntimeAgentRuntimeArtifactContainerConfiguration {
         /**
          * URI of the container image in Amazon ECR.
@@ -13271,6 +13472,38 @@ export declare namespace bedrock {
          */
         discoveryUrl: string;
     }
+    interface AgentcoreGatewayInterceptorConfiguration {
+        /**
+         * Input configuration for the interceptor. See `inputConfiguration` below.
+         */
+        inputConfiguration?: outputs.bedrock.AgentcoreGatewayInterceptorConfigurationInputConfiguration;
+        /**
+         * Set of interception points. Valid values: `REQUEST`, `RESPONSE`.
+         */
+        interceptionPoints: string[];
+        /**
+         * Interceptor infrastructure configuration. See `interceptor` below.
+         */
+        interceptor?: outputs.bedrock.AgentcoreGatewayInterceptorConfigurationInterceptor;
+    }
+    interface AgentcoreGatewayInterceptorConfigurationInputConfiguration {
+        /**
+         * Whether to pass request headers to the interceptor.
+         */
+        passRequestHeaders: boolean;
+    }
+    interface AgentcoreGatewayInterceptorConfigurationInterceptor {
+        /**
+         * Lambda function configuration for the interceptor. See `lambda` below.
+         */
+        lambda?: outputs.bedrock.AgentcoreGatewayInterceptorConfigurationInterceptorLambda;
+    }
+    interface AgentcoreGatewayInterceptorConfigurationInterceptorLambda {
+        /**
+         * ARN of the Lambda function to invoke for the interceptor.
+         */
+        arn: string;
+    }
     interface AgentcoreGatewayProtocolConfiguration {
         /**
          * Model Context Protocol (MCP) configuration block. See `mcp` below.
@@ -14455,11 +14688,35 @@ export declare namespace bedrock {
     }
     interface GuardrailContentPolicyConfigFiltersConfig {
         /**
-         * Strength for filters.
+         * Action to take when harmful content is detected. Valid values: `BLOCK`, `NONE`.
+         */
+        inputAction?: string;
+        /**
+         * Toggles guardrail evaluation on input.
+         */
+        inputEnabled?: boolean;
+        /**
+         * List of selected input modalities. Valid values: `IMAGE`, `TEXT`.
+         */
+        inputModalities?: string[];
+        /**
+         * Strength for filters. Valid values: `NONE`, `LOW`, `MEDIUM`, `HIGH`.
          */
         inputStrength: string;
         /**
-         * Strength for filters.
+         * Action to take when harmful content is detected. Valid values: `BLOCK`, `NONE`.
+         */
+        outputAction?: string;
+        /**
+         * Toggles guardrail evaluation on output.
+         */
+        outputEnabled?: boolean;
+        /**
+         * List of selected output modalities. Valid values: `IMAGE`, `TEXT`.
+         */
+        outputModalities?: string[];
+        /**
+         * Strength for filters. Valid values: `NONE`, `LOW`, `MEDIUM`, `HIGH`.
          */
         outputStrength: string;
         /**
@@ -14832,6 +15089,61 @@ export declare namespace billing {
          */
         ownerAccountId: string;
     }
+    interface ViewDataFilterExpression {
+        /**
+         * Dimension to use for `expression`. Refer to #dimensions for more details.
+         */
+        dimensions?: outputs.billing.ViewDataFilterExpressionDimensions;
+        /**
+         * List of key value map specifying tags associated to the billing view being created.
+         */
+        tags?: outputs.billing.ViewDataFilterExpressionTag[];
+        /**
+         * Time range to use for `expression`. Refer to #time-range for more details.
+         */
+        timeRange?: outputs.billing.ViewDataFilterExpressionTimeRange;
+    }
+    interface ViewDataFilterExpressionDimensions {
+        /**
+         * Key of the dimension. Possible values are `LINKED_ACCOUNT`.
+         */
+        key: string;
+        /**
+         * List of metadata values that you can use to filter and group your results.
+         */
+        values: string[];
+    }
+    interface ViewDataFilterExpressionTag {
+        /**
+         * Key of the tag.
+         */
+        key: string;
+        /**
+         * List of values for the tag.
+         */
+        values: string[];
+    }
+    interface ViewDataFilterExpressionTimeRange {
+        /**
+         * Inclusive end date of the time range.
+         */
+        beginDateInclusive: string;
+        endDateInclusive: string;
+    }
+    interface ViewTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
 }
 export declare namespace budgets {
     interface BudgetActionActionThreshold {
@@ -18264,6 +18576,422 @@ export declare namespace cloudwatch {
          */
         value: string;
     }
+    interface LogTransformerTransformerConfig {
+        /**
+         * Adds new key-value pairs to the log event. See `addKeys` below for details.
+         */
+        addKeys?: outputs.cloudwatch.LogTransformerTransformerConfigAddKeys;
+        /**
+         * Copies values within a log event. See `copyValue` below for details.
+         */
+        copyValue?: outputs.cloudwatch.LogTransformerTransformerConfigCopyValue;
+        /**
+         * Parses comma-separated values (CSV) from the log events into columns. See `csv` below for details.
+         */
+        csvs?: outputs.cloudwatch.LogTransformerTransformerConfigCsv[];
+        /**
+         * Converts a datetime string into a format that you specify. See `dateTimeConverter` below for details.
+         */
+        dateTimeConverters?: outputs.cloudwatch.LogTransformerTransformerConfigDateTimeConverter[];
+        /**
+         * Deletes entry from a log event. See `deleteKeys` below for details.
+         */
+        deleteKeys?: outputs.cloudwatch.LogTransformerTransformerConfigDeleteKey[];
+        /**
+         * Parses and structures unstructured data by using pattern matching. See `grok` below for details.
+         */
+        grok?: outputs.cloudwatch.LogTransformerTransformerConfigGrok;
+        /**
+         * Converts list of objects that contain key fields into a map of target keys. See `listToMap` below for details.
+         */
+        listToMaps?: outputs.cloudwatch.LogTransformerTransformerConfigListToMap[];
+        /**
+         * Converts a string to lowercase. See `lowerCaseString` below for details.
+         */
+        lowerCaseStrings?: outputs.cloudwatch.LogTransformerTransformerConfigLowerCaseString[];
+        /**
+         * Moves a key from one field to another. See `moveKeys` below for details.
+         */
+        moveKeys?: outputs.cloudwatch.LogTransformerTransformerConfigMoveKey[];
+        /**
+         * Parses CloudFront vended logs, extracts fields, and converts them into JSON format. See `parseCloudfront` below for details.
+         */
+        parseCloudfront?: outputs.cloudwatch.LogTransformerTransformerConfigParseCloudfront;
+        /**
+         * Parses log events that are in JSON format. See `parseJson` below for details.
+         */
+        parseJsons?: outputs.cloudwatch.LogTransformerTransformerConfigParseJson[];
+        /**
+         * Parses a specified field in the original log event into key-value pairs. See `parseKeyValue` below for details.
+         */
+        parseKeyValues?: outputs.cloudwatch.LogTransformerTransformerConfigParseKeyValue[];
+        /**
+         * Parses RDS for PostgreSQL vended logs, extracts fields, and and convert them into a JSON format. See `parsePostgres` below for details.
+         */
+        parsePostgres?: outputs.cloudwatch.LogTransformerTransformerConfigParsePostgres;
+        /**
+         * Parses Route 53 vended logs, extracts fields, and converts them into JSON format. See `parseRoute53` below for details.
+         */
+        parseRoute53?: outputs.cloudwatch.LogTransformerTransformerConfigParseRoute53;
+        /**
+         * Parses logs events and converts them into Open Cybersecurity Schema Framework (OCSF) events. See `parseToOcsf` below for details.
+         */
+        parseToOcsf?: outputs.cloudwatch.LogTransformerTransformerConfigParseToOcsf;
+        /**
+         * Parses Amazon VPC vended logs, extracts fields, and converts them into JSON format. See `parseVpc` below for details.
+         */
+        parseVpc?: outputs.cloudwatch.LogTransformerTransformerConfigParseVpc;
+        /**
+         * Parses AWS WAF vended logs, extracts fields, and converts them into JSON format. See `parseWaf` below for details.
+         */
+        parseWaf?: outputs.cloudwatch.LogTransformerTransformerConfigParseWaf;
+        /**
+         * Renames keys in a log event. See `renameKeys` below for details.
+         */
+        renameKeys?: outputs.cloudwatch.LogTransformerTransformerConfigRenameKey[];
+        /**
+         * Splits a field into an array of strings using a delimiting character. See `splitString` below for details.
+         */
+        splitStrings?: outputs.cloudwatch.LogTransformerTransformerConfigSplitString[];
+        /**
+         * Matches a key’s value against a regular expression and replaces all matches with a replacement string. See `substituteString` below for details.
+         */
+        substituteStrings?: outputs.cloudwatch.LogTransformerTransformerConfigSubstituteString[];
+        /**
+         * Removes leading and trailing whitespace from a string. See `trimString` below for details.
+         */
+        trimStrings?: outputs.cloudwatch.LogTransformerTransformerConfigTrimString[];
+        /**
+         * Converts a value type associated with the specified key to the specified type. See `typeConverter` below for details.
+         */
+        typeConverters?: outputs.cloudwatch.LogTransformerTransformerConfigTypeConverter[];
+        /**
+         * Converts a string to uppercase. See `upperCaseString` below for details.
+         */
+        upperCaseStrings?: outputs.cloudwatch.LogTransformerTransformerConfigUpperCaseString[];
+    }
+    interface LogTransformerTransformerConfigAddKeys {
+        /**
+         * Objects containing the information about the keys to add to the log event. You must include at least one entry, and five at most. See `addKeys` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigAddKeysEntry[];
+    }
+    interface LogTransformerTransformerConfigAddKeysEntry {
+        /**
+         * Specifies the key with the value that will be converted to a different type.
+         */
+        key: string;
+        /**
+         * Specifies whether to overwrite the value if the destination key already exists. Defaults to `false`.
+         * * `renameTo` - (Required) Specifies the new name of the key.
+         */
+        overwriteIfExists: boolean;
+        /**
+         * Specifies the value of the new entry to be added to the log event.
+         */
+        value: string;
+    }
+    interface LogTransformerTransformerConfigCopyValue {
+        /**
+         * Objects containing the information about the values to copy to the log event. You must include at least one entry, and five at most. See `copyValue` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigCopyValueEntry[];
+    }
+    interface LogTransformerTransformerConfigCopyValueEntry {
+        /**
+         * Specifies whether to overwrite the value if the destination key already exists. Defaults to `false`.
+         * * `renameTo` - (Required) Specifies the new name of the key.
+         */
+        overwriteIfExists: boolean;
+        /**
+         * Specifies the key to modify.
+         */
+        source: string;
+        /**
+         * Specifies the key to move to.
+         */
+        target: string;
+    }
+    interface LogTransformerTransformerConfigCsv {
+        /**
+         * Specifies the names to use for the columns in the transformed log event. If not specified, default column names (`[column_1, column2 ...]`) are used.
+         */
+        columns: string[];
+        /**
+         * Specifies the character used to separate each column in the original comma-separated value log event. Defaults to the comma `,` character.
+         */
+        delimiter: string;
+        /**
+         * Specifies the character used as a text qualifier for a single column of data. Defaults to the double quotation mark `"` character.
+         */
+        quoteCharacter: string;
+        /**
+         * Specifies the path to the field in the log event that has the comma separated values to be parsed. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigDateTimeConverter {
+        /**
+         * Specifies the locale of the source field. Defaults to `locale.ROOT`.
+         */
+        locale: string;
+        /**
+         * Specifies the list of patterns to match against the `source` field.
+         */
+        matchPatterns: string[];
+        /**
+         * Specifies the key to apply the date conversion to.
+         */
+        source: string;
+        /**
+         * Specifies the time zone of the source field. Defaults to `UTC`.
+         */
+        sourceTimezone: string;
+        /**
+         * Specifies the JSON field to store the result in.
+         */
+        target: string;
+        /**
+         * Specifies the datetime format to use for the converted data in the target field. Defaults to `yyyy-MM-dd'T'HH:mm:ss.SSS'Z`.
+         */
+        targetFormat: string;
+        /**
+         * Specifies the time zone of the target field. Defaults to `UTC`.
+         */
+        targetTimezone: string;
+    }
+    interface LogTransformerTransformerConfigDeleteKey {
+        /**
+         * Specifies the keys to be deleted.
+         */
+        withKeys: string[];
+    }
+    interface LogTransformerTransformerConfigGrok {
+        /**
+         * Specifies the grok pattern to match against the log event.
+         */
+        match: string;
+        /**
+         * Specifies the path to the field in the log event that has the comma separated values to be parsed. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigListToMap {
+        /**
+         * Specifies whether the list will be flattened into single items. Defaults to `false`.
+         */
+        flatten: boolean;
+        /**
+         * Required if `flatten` is set to true. Specifies the element to keep. Allowed values are `first` and `last`.
+         */
+        flattenedElement: string;
+        /**
+         * Specifies the key of the field to be extracted as keys in the generated map.
+         */
+        key: string;
+        /**
+         * Specifies the key in the log event that has a list of objects that will be converted to a map.
+         */
+        source: string;
+        /**
+         * Specifies the key of the field that will hold the generated map.
+         */
+        target: string;
+        /**
+         * Specifies the values that will be extracted from the source objects and put into the values of the generated map. If omitted, original objects in the source list will be put into the values of the generated map.
+         */
+        valueKey: string;
+    }
+    interface LogTransformerTransformerConfigLowerCaseString {
+        /**
+         * Specifies the keys of the fields to convert to lowercase.
+         */
+        withKeys: string[];
+    }
+    interface LogTransformerTransformerConfigMoveKey {
+        /**
+         * Objects containing the information about the keys to move to the log event. You must include at least one entry, and five at most. See `moveKeys` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigMoveKeyEntry[];
+    }
+    interface LogTransformerTransformerConfigMoveKeyEntry {
+        /**
+         * Specifies whether to overwrite the value if the destination key already exists. Defaults to `false`.
+         * * `renameTo` - (Required) Specifies the new name of the key.
+         */
+        overwriteIfExists: boolean;
+        /**
+         * Specifies the key to modify.
+         */
+        source: string;
+        /**
+         * Specifies the key to move to.
+         */
+        target: string;
+    }
+    interface LogTransformerTransformerConfigParseCloudfront {
+        /**
+         * Specifies the source field to be parsed. The only allowed value is `@message`. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParseJson {
+        /**
+         * Specifies the location to put the parsed key value pair into. If omitted, it will be placed under the root node.
+         */
+        destination: string;
+        /**
+         * Specifies the path to the field in the log event that will be parsed. Defaults to `@message`.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParseKeyValue {
+        /**
+         * Specifies the destination field to put the extracted key-value pairs into.
+         */
+        destination: string;
+        /**
+         * Specifies the field delimiter string that is used between key-value pairs in the original log events. Defaults to the ampersand `&` character.
+         */
+        fieldDelimiter: string;
+        /**
+         * Specifies a prefix that will be added to all transformed keys.
+         */
+        keyPrefix: string;
+        /**
+         * Specifies the delimiter string to use between the key and value in each pair in the transformed log event. Defaults to the equal `=` character.
+         */
+        keyValueDelimiter: string;
+        /**
+         * Specifies a value to insert into the value field in the result if a key-value pair is not successfully split.
+         */
+        nonMatchValue: string;
+        /**
+         * Specifies whether to overwrite the value if the destination key already exists. Defaults to `false`.
+         */
+        overwriteIfExists: boolean;
+        /**
+         * Specifies the path to the field in the log event that will be parsed. Defaults to `@message`.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParsePostgres {
+        /**
+         * Specifies the source field to be parsed. The only allowed value is `@message`. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParseRoute53 {
+        /**
+         * Specifies the source field to be parsed. The only allowed value is `@message`. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParseToOcsf {
+        eventSource: string;
+        /**
+         * Specifies the version of the OCSF schema to use for the transformed log events. The only allowed value is `V1.1`.
+         */
+        ocsfVersion: string;
+        /**
+         * Specifies the source field to be parsed. The only allowed value is `@message`. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParseVpc {
+        /**
+         * Specifies the source field to be parsed. The only allowed value is `@message`. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigParseWaf {
+        /**
+         * Specifies the source field to be parsed. The only allowed value is `@message`. If omitted, the whole log message is processed.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigRenameKey {
+        /**
+         * Objects containing the information about the keys to rename. You must include at least one entry, and five at most. See `renameKeys` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigRenameKeyEntry[];
+    }
+    interface LogTransformerTransformerConfigRenameKeyEntry {
+        /**
+         * Specifies the key with the value that will be converted to a different type.
+         */
+        key: string;
+        /**
+         * Specifies whether to overwrite the value if the destination key already exists. Defaults to `false`.
+         * * `renameTo` - (Required) Specifies the new name of the key.
+         */
+        overwriteIfExists: boolean;
+        renameTo: string;
+    }
+    interface LogTransformerTransformerConfigSplitString {
+        /**
+         * Objects containing the information about the fields to split. You must include at least one entry, and ten at most. See `splitString` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigSplitStringEntry[];
+    }
+    interface LogTransformerTransformerConfigSplitStringEntry {
+        /**
+         * Specifies the separator characters to split the string entry on.
+         */
+        delimiter: string;
+        /**
+         * Specifies the key to modify.
+         */
+        source: string;
+    }
+    interface LogTransformerTransformerConfigSubstituteString {
+        /**
+         * Objects containing the information about the fields to substitute. You must include at least one entry, and ten at most. See `substituteString` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigSubstituteStringEntry[];
+    }
+    interface LogTransformerTransformerConfigSubstituteStringEntry {
+        /**
+         * Specifies the regular expression string to be replaced.
+         */
+        from: string;
+        /**
+         * Specifies the key to modify.
+         */
+        source: string;
+        /**
+         * Specifies the string to be substituted for each match of `from`.
+         */
+        to: string;
+    }
+    interface LogTransformerTransformerConfigTrimString {
+        /**
+         * Specifies the keys of the fields to trim.
+         */
+        withKeys: string[];
+    }
+    interface LogTransformerTransformerConfigTypeConverter {
+        /**
+         * Objects containing the information about the fields to change the type of. You must include at least one entry, and five at most. See `typeConverter` `entry` below for details.
+         */
+        entries: outputs.cloudwatch.LogTransformerTransformerConfigTypeConverterEntry[];
+    }
+    interface LogTransformerTransformerConfigTypeConverterEntry {
+        /**
+         * Specifies the key with the value that will be converted to a different type.
+         */
+        key: string;
+        /**
+         * Specifies the type to convert the field value to. Allowed values are: `integer`, `double`, `string` and `boolean`.
+         */
+        type: string;
+    }
+    interface LogTransformerTransformerConfigUpperCaseString {
+        /**
+         * Specifies the keys of the fields to convert to uppercase.
+         */
+        withKeys: string[];
+    }
     interface MetricAlarmMetricQuery {
         /**
          * The ID of the account where the metrics are located, if this is a cross-account alarm.
@@ -20294,7 +21022,7 @@ export declare namespace codestarconnections {
 export declare namespace codestarnotifications {
     interface NotificationRuleTarget {
         /**
-         * The ARN of notification rule target. For example, a SNS Topic ARN.
+         * The ARN of the Amazon Q Developer in chat applications topic or Amazon Q Developer in chat applications client.
          */
         address: string;
         /**
@@ -20302,7 +21030,7 @@ export declare namespace codestarnotifications {
          */
         status: string;
         /**
-         * The type of the notification target. Default value is `SNS`.
+         * The type of the notification target. Valid values are `SNS`, `AWSChatbotSlack`, and `AWSChatbotMicrosoftTeams`. Default value is `SNS`.
          */
         type?: string;
     }
@@ -21666,6 +22394,10 @@ export declare namespace config {
          * Use this to override the default service endpoint URL
          */
         arcregionswitch?: string;
+        /**
+         * Use this to override the default service endpoint URL
+         */
+        arczonalshift?: string;
         /**
          * Use this to override the default service endpoint URL
          */
@@ -22290,10 +23022,6 @@ export declare namespace config {
          * Use this to override the default service endpoint URL
          */
         logs?: string;
-        /**
-         * Use this to override the default service endpoint URL
-         */
-        lookoutmetrics?: string;
         /**
          * Use this to override the default service endpoint URL
          */
@@ -22354,6 +23082,10 @@ export declare namespace config {
          * Use this to override the default service endpoint URL
          */
         mwaa?: string;
+        /**
+         * Use this to override the default service endpoint URL
+         */
+        mwaaserverless?: string;
         /**
          * Use this to override the default service endpoint URL
          */
@@ -22490,6 +23222,14 @@ export declare namespace config {
          * Use this to override the default service endpoint URL
          */
         rds?: string;
+        /**
+         * Use this to override the default service endpoint URL
+         */
+        rdsdata?: string;
+        /**
+         * Use this to override the default service endpoint URL
+         */
+        rdsdataservice?: string;
         /**
          * Use this to override the default service endpoint URL
          */
@@ -28341,6 +29081,12 @@ export declare namespace dynamodb {
          */
         writeUnitsPerSecond: number;
     }
+    interface TableGlobalTableWitness {
+        /**
+         * Name of the AWS Region that serves as a witness for the MRSC global table.
+         */
+        regionName: string;
+    }
     interface TableImportTable {
         /**
          * Type of compression to be used on the input coming from the imported table.
@@ -29059,6 +29805,134 @@ export declare namespace ec2 {
          */
         update?: string;
     }
+    interface EncryptionControlResourceExclusions {
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Egress-Only Internet Gateways.
+         */
+        egressOnlyInternetGateway: outputs.ec2.EncryptionControlResourceExclusionsEgressOnlyInternetGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Elastic File System (EFS).
+         */
+        elasticFileSystem: outputs.ec2.EncryptionControlResourceExclusionsElasticFileSystem;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Internet Gateways.
+         */
+        internetGateway: outputs.ec2.EncryptionControlResourceExclusionsInternetGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Lambda Functions.
+         */
+        lambda: outputs.ec2.EncryptionControlResourceExclusionsLambda;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for NAT Gateways.
+         */
+        natGateway: outputs.ec2.EncryptionControlResourceExclusionsNatGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Virtual Private Gateways.
+         */
+        virtualPrivateGateway: outputs.ec2.EncryptionControlResourceExclusionsVirtualPrivateGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for VPC Lattice.
+         */
+        vpcLattice: outputs.ec2.EncryptionControlResourceExclusionsVpcLattice;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for peered VPCs.
+         */
+        vpcPeering: outputs.ec2.EncryptionControlResourceExclusionsVpcPeering;
+    }
+    interface EncryptionControlResourceExclusionsEgressOnlyInternetGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsElasticFileSystem {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsInternetGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsLambda {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsNatGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsVirtualPrivateGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsVpcLattice {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlResourceExclusionsVpcPeering {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface EncryptionControlTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
     interface FleetFleetInstanceSet {
         /**
          * The IDs of the instances.
@@ -30210,6 +31084,20 @@ export declare namespace ec2 {
          */
         values: string[];
     }
+    interface GetNatGatewayAvailabilityZoneAddress {
+        /**
+         * List of allocation IDs of the Elastic IP addresses (EIPs) to be used for handling outbound NAT traffic in this specific Availability Zone.
+         */
+        allocationIds: string[];
+        /**
+         * Availability Zone where this specific NAT gateway configuration is active.
+         */
+        availabilityZone: string;
+        /**
+         * Availability Zone ID where this specific NAT gateway configuration is active
+         */
+        availabilityZoneId: string;
+    }
     interface GetNatGatewayFilter {
         /**
          * Name of the field to filter by, as defined by
@@ -30222,6 +31110,36 @@ export declare namespace ec2 {
          */
         values: string[];
     }
+    interface GetNatGatewayRegionalNatGatewayAddress {
+        /**
+         * Allocation ID of the Elastic IP address.
+         */
+        allocationId: string;
+        /**
+         * Association ID of the Elastic IP address.
+         */
+        associationId: string;
+        /**
+         * Availability Zone where this specific NAT gateway configuration is active.
+         */
+        availabilityZone: string;
+        /**
+         * Availability Zone ID where this specific NAT gateway configuration is active
+         */
+        availabilityZoneId: string;
+        /**
+         * ID of the network interface.
+         */
+        networkInterfaceId: string;
+        /**
+         * Public IP address.
+         */
+        publicIp: string;
+        /**
+         * Status of the NAT gateway address.
+         */
+        status: string;
+    }
     interface GetNatGatewaysFilter {
         /**
          * Name of the field to filter by, as defined by
@@ -32666,6 +33584,20 @@ export declare namespace ec2 {
          */
         description?: string;
     }
+    interface NatGatewayAvailabilityZoneAddress {
+        /**
+         * List of allocation IDs of the Elastic IP addresses (EIPs) to be used for handling outbound NAT traffic in this specific Availability Zone.
+         */
+        allocationIds?: string[];
+        /**
+         * Availability Zone (e.g. `us-west-2a`) where this specific NAT gateway configuration will be active. Exactly one of `availabilityZone` or `availabilityZoneId` must be specified.
+         */
+        availabilityZone?: string;
+        /**
+         * Availability Zone ID (e.g. `usw2-az2`) where this specific NAT gateway configuration will be active. Exactly one of `availabilityZone` or `availabilityZoneId` must be specified.
+         */
+        availabilityZoneId: string;
+    }
     interface NatGatewayEipAssociationTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -32676,6 +33608,36 @@ export declare namespace ec2 {
          */
         delete?: string;
     }
+    interface NatGatewayRegionalNatGatewayAddress {
+        /**
+         * The Allocation ID of the Elastic IP address for the NAT Gateway. Required when `connectivityType` is set to `public` and `availabilityMode` is set to `zonal`. When `availabilityMode` is set to `regional`, this must not be set; instead, use the `availabilityZoneAddress` block to specify EIPs for each AZ.
+         */
+        allocationId: string;
+        /**
+         * Association ID of the Elastic IP address.
+         */
+        associationId: string;
+        /**
+         * Availability Zone where this specific NAT gateway configuration is active.
+         */
+        availabilityZone: string;
+        /**
+         * Availability Zone ID where this specific NAT gateway configuration is active
+         */
+        availabilityZoneId: string;
+        /**
+         * ID of the network interface.
+         */
+        networkInterfaceId: string;
+        /**
+         * Public IP address.
+         */
+        publicIp: string;
+        /**
+         * Status of the NAT gateway address.
+         */
+        status: string;
+    }
     interface NetworkAclEgress {
         /**
          * The action to take.
@@ -34458,6 +35420,134 @@ export declare namespace ec2 {
          */
         update?: string;
     }
+    interface VpcEncryptionControlResourceExclusions {
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Egress-Only Internet Gateways.
+         */
+        egressOnlyInternetGateway: outputs.ec2.VpcEncryptionControlResourceExclusionsEgressOnlyInternetGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Elastic File System (EFS).
+         */
+        elasticFileSystem: outputs.ec2.VpcEncryptionControlResourceExclusionsElasticFileSystem;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Internet Gateways.
+         */
+        internetGateway: outputs.ec2.VpcEncryptionControlResourceExclusionsInternetGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Lambda Functions.
+         */
+        lambda: outputs.ec2.VpcEncryptionControlResourceExclusionsLambda;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for NAT Gateways.
+         */
+        natGateway: outputs.ec2.VpcEncryptionControlResourceExclusionsNatGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for Virtual Private Gateways.
+         */
+        virtualPrivateGateway: outputs.ec2.VpcEncryptionControlResourceExclusionsVirtualPrivateGateway;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for VPC Lattice.
+         */
+        vpcLattice: outputs.ec2.VpcEncryptionControlResourceExclusionsVpcLattice;
+        /**
+         * `state` and `stateMessage` describing encryption enforcement state for peered VPCs.
+         */
+        vpcPeering: outputs.ec2.VpcEncryptionControlResourceExclusionsVpcPeering;
+    }
+    interface VpcEncryptionControlResourceExclusionsEgressOnlyInternetGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsElasticFileSystem {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsInternetGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsLambda {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsNatGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsVirtualPrivateGateway {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsVpcLattice {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlResourceExclusionsVpcPeering {
+        /**
+         * The current state of the VPC Encryption Control.
+         */
+        state: string;
+        /**
+         * A message providing additional information about the state of the VPC Encryption Control.
+         */
+        stateMessage: string;
+    }
+    interface VpcEncryptionControlTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
     interface VpcEndpointDnsEntry {
         /**
          * The DNS name.
@@ -34581,6 +35671,18 @@ export declare namespace ec2 {
         cloudwatchLogOptions: outputs.ec2.VpnConnectionTunnel1LogOptionsCloudwatchLogOptions;
     }
     interface VpnConnectionTunnel1LogOptionsCloudwatchLogOptions {
+        /**
+         * Enable or disable BGP logging feature. The default is `false`.
+         */
+        bgpLogEnabled?: boolean;
+        /**
+         * The Amazon Resource Name (ARN) of the CloudWatch log group to send BGP logs to.
+         */
+        bgpLogGroupArn?: string;
+        /**
+         * Set BGP log format. Default format is json. Possible values are: `json` and `text`. The default is `json`.
+         */
+        bgpLogOutputFormat?: string;
         /**
          * Enable or disable VPN tunnel logging feature. The default is `false`.
          */
@@ -34601,6 +35703,18 @@ export declare namespace ec2 {
         cloudwatchLogOptions: outputs.ec2.VpnConnectionTunnel2LogOptionsCloudwatchLogOptions;
     }
     interface VpnConnectionTunnel2LogOptionsCloudwatchLogOptions {
+        /**
+         * Enable or disable BGP logging feature. The default is `false`.
+         */
+        bgpLogEnabled?: boolean;
+        /**
+         * The Amazon Resource Name (ARN) of the CloudWatch log group to send BGP logs to.
+         */
+        bgpLogGroupArn?: string;
+        /**
+         * Set BGP log format. Default format is json. Possible values are: `json` and `text`. The default is `json`.
+         */
+        bgpLogOutputFormat?: string;
         /**
          * Enable or disable VPN tunnel logging feature. The default is `false`.
          */
@@ -35314,6 +36428,10 @@ export declare namespace ecs {
         targetCapacity: number;
     }
     interface CapacityProviderManagedInstancesProvider {
+        /**
+         * Defines how Amazon ECS Managed Instances optimizes the infrastructure in your capacity provider. Configure it to turn on or off the infrastructure optimization in your capacity provider, and to control the idle EC2 instances optimization delay.
+         */
+        infrastructureOptimization?: outputs.ecs.CapacityProviderManagedInstancesProviderInfrastructureOptimization;
         /**
          * The Amazon Resource Name (ARN) of the infrastructure role that Amazon ECS uses to manage instances on your behalf. This role must have permissions to launch, terminate, and manage Amazon EC2 instances, as well as access to other AWS services required for Amazon ECS Managed Instances functionality. For more information, see [Amazon ECS infrastructure IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html) in the Amazon ECS Developer Guide.
          */
@@ -35327,6 +36445,14 @@ export declare namespace ecs {
          */
         propagateTags?: string;
     }
+    interface CapacityProviderManagedInstancesProviderInfrastructureOptimization {
+        /**
+         * This parameter defines the number of seconds Amazon ECS Managed Instances waits before optimizing EC2 instances that have become idle or underutilized. A longer delay increases the likelihood of placing new tasks on idle instances, reducing startup time. A shorter delay helps reduce infrastructure costs by optimizing idle instances more quickly. Valid values are:
+         * * Not set (null) - Uses the default optimization behavior.
+         * * `-1` - Disables automatic infrastructure optimization.
+         */
+        scaleInAfter?: number;
+    }
     interface CapacityProviderManagedInstancesProviderInstanceLaunchTemplate {
         /**
          * The Amazon Resource Name (ARN) of the instance profile that Amazon ECS applies to Amazon ECS Managed Instances. This instance profile must include the necessary permissions for your tasks to access AWS services and resources. For more information, see [Amazon ECS instance profile for Managed Instances](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html) in the Amazon ECS Developer Guide.
@@ -35585,6 +36711,103 @@ export declare namespace ecs {
          */
         value: string;
     }
+    interface ExpressGatewayServiceIngressPath {
+        accessType: string;
+        endpoint: string;
+    }
+    interface ExpressGatewayServiceNetworkConfiguration {
+        /**
+         * Security groups associated with the task. If not specified, the default security group for the VPC is used.
+         */
+        securityGroups: string[];
+        /**
+         * Subnets associated with the task. At least 2 subnets must be specified when using network configuration. If not specified, default subnets will be used.
+         */
+        subnets: string[];
+    }
+    interface ExpressGatewayServicePrimaryContainer {
+        awsLogsConfigurations: outputs.ecs.ExpressGatewayServicePrimaryContainerAwsLogsConfiguration[];
+        /**
+         * Command to run in the container. Overrides the default command from the Docker image.
+         */
+        commands?: string[];
+        /**
+         * Port on which the container listens for connections.
+         */
+        containerPort: number;
+        environments?: outputs.ecs.ExpressGatewayServicePrimaryContainerEnvironment[];
+        /**
+         * Docker image to use for the container.
+         */
+        image: string;
+        repositoryCredentials?: outputs.ecs.ExpressGatewayServicePrimaryContainerRepositoryCredentials;
+        secrets?: outputs.ecs.ExpressGatewayServicePrimaryContainerSecret[];
+    }
+    interface ExpressGatewayServicePrimaryContainerAwsLogsConfiguration {
+        /**
+         * CloudWatch log group name.
+         */
+        logGroup: string;
+        /**
+         * Prefix for log stream names. If not specified, a default prefix will be used.
+         */
+        logStreamPrefix: string;
+    }
+    interface ExpressGatewayServicePrimaryContainerEnvironment {
+        /**
+         * Name of the environment variable.
+         */
+        name: string;
+        /**
+         * Value of the environment variable.
+         */
+        value: string;
+    }
+    interface ExpressGatewayServicePrimaryContainerRepositoryCredentials {
+        /**
+         * ARN of the AWS Systems Manager parameter containing the repository credentials.
+         */
+        credentialsParameter: string;
+    }
+    interface ExpressGatewayServicePrimaryContainerSecret {
+        name: string;
+        /**
+         * ARN of the AWS Secrets Manager secret or AWS Systems Manager parameter containing the secret value.
+         */
+        valueFrom: string;
+    }
+    interface ExpressGatewayServiceScalingTarget {
+        /**
+         * Metric to use for auto-scaling. Valid values are `CPU` and `MEMORY`.
+         */
+        autoScalingMetric: string;
+        /**
+         * Target value for the auto-scaling metric (as a percentage). Defaults to `60`.
+         */
+        autoScalingTargetValue: number;
+        /**
+         * Maximum number of tasks to run.
+         */
+        maxTaskCount: number;
+        /**
+         * Minimum number of tasks to run.
+         */
+        minTaskCount: number;
+    }
+    interface ExpressGatewayServiceTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
     interface GetClusterServiceConnectDefault {
         namespace: string;
     }
@@ -36985,6 +38208,85 @@ export declare namespace eks {
          */
         serviceAccount: string;
     }
+    interface CapabilityConfiguration {
+        /**
+         * ArgoCD configuration. See `argoCd` below.
+         */
+        argoCd?: outputs.eks.CapabilityConfigurationArgoCd;
+    }
+    interface CapabilityConfigurationArgoCd {
+        /**
+         * AWS IAM Identity Center configuration. See `awsIdc` below.
+         */
+        awsIdc?: outputs.eks.CapabilityConfigurationArgoCdAwsIdc;
+        /**
+         * Kubernetes namespace for ArgoCD.
+         */
+        namespace: string;
+        /**
+         * Network access configuration. See `networkAccess` below.
+         */
+        networkAccess?: outputs.eks.CapabilityConfigurationArgoCdNetworkAccess;
+        /**
+         * RBAC role mappings. See `rbacRoleMapping` below.
+         */
+        rbacRoleMappings?: outputs.eks.CapabilityConfigurationArgoCdRbacRoleMapping[];
+        /**
+         * URL of the Argo CD server.
+         */
+        serverUrl: string;
+    }
+    interface CapabilityConfigurationArgoCdAwsIdc {
+        /**
+         * ARN of the IAM Identity Center instance.
+         */
+        idcInstanceArn: string;
+        idcManagedApplicationArn: string;
+        /**
+         * Region of the IAM Identity Center instance.
+         */
+        idcRegion: string;
+    }
+    interface CapabilityConfigurationArgoCdNetworkAccess {
+        /**
+         * VPC Endpoint IDs.
+         */
+        vpceIds?: string[];
+    }
+    interface CapabilityConfigurationArgoCdRbacRoleMapping {
+        /**
+         * List of identities. See `identity` below.
+         */
+        identities?: outputs.eks.CapabilityConfigurationArgoCdRbacRoleMappingIdentity[];
+        /**
+         * ArgoCD role. Valid values: `ADMIN`, `EDITOR`, `VIEWER`.
+         */
+        role: string;
+    }
+    interface CapabilityConfigurationArgoCdRbacRoleMappingIdentity {
+        /**
+         * Identity ID.
+         */
+        id: string;
+        /**
+         * Identity type. Valid values: `SSO_USER`, `SSO_GROUP`.
+         */
+        type: string;
+    }
+    interface CapabilityTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
     interface ClusterAccessConfig {
         /**
          * The authentication mode for the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
@@ -37015,6 +38317,12 @@ export declare namespace eks {
          */
         nodeRoleArn?: string;
     }
+    interface ClusterControlPlaneScalingConfig {
+        /**
+         * The control plane scaling tier. Valid values are `standard`, `tier-xl`, `tier-2xl`, or `tier-4xl`. Defaults to `standard`. For more information about each tier, see [EKS Provisioned Control Plane](https://docs.aws.amazon.com/eks/latest/userguide/eks-provisioned-control-plane-getting-started.html).
+         */
+        tier: string;
+    }
     interface ClusterEncryptionConfig {
         /**
          * Configuration block with provider for encryption. Detailed below.
@@ -37232,6 +38540,12 @@ export declare namespace eks {
          */
         nodeRoleArn: string;
     }
+    interface GetClusterControlPlaneScalingConfig {
+        /**
+         * The control plane scaling tier. Valid values are `standard`, `tier-xl`, `tier-2xl`, or `tier-4xl`.
+         */
+        tier: string;
+    }
     interface GetClusterIdentity {
         /**
          * Nested attribute containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster.
@@ -40343,7 +41657,7 @@ export declare namespace fis {
     }
     interface ExperimentTemplateActionTarget {
         /**
-         * Target type. Valid values are `AutoScalingGroups` (EC2 Auto Scaling groups), `Buckets` (S3 Buckets), `Cluster` (EKS Cluster), `Clusters` (ECS Clusters), `DBInstances` (RDS DB Instances), `Instances` (EC2 Instances), `ManagedResources` (EKS clusters, Application and Network Load Balancers, and EC2 Auto Scaling groups that are enabled for ARC zonal shift), `Nodegroups` (EKS Node groups), `Pods` (EKS Pods), `ReplicationGroups`(ElastiCache Redis Replication Groups), `Roles` (IAM Roles), `SpotInstances` (EC2 Spot Instances), `Subnets` (VPC Subnets), `Tables` (DynamoDB encrypted global tables), `Tasks` (ECS Tasks), `TransitGateways` (Transit gateways), `Volumes` (EBS Volumes). See the [documentation](https://docs.aws.amazon.com/fis/latest/userguide/action-sequence.html#action-targets) for more details.
+         * Target type. Valid values are `AutoScalingGroups` (EC2 Auto Scaling groups), `Buckets` (S3 Buckets), `Cluster` (EKS Cluster), `Clusters` (ECS Clusters), `DBInstances` (RDS DB Instances), `Functions` (Lambda Functions), `Instances` (EC2 Instances), `ManagedResources` (EKS clusters, Application and Network Load Balancers, and EC2 Auto Scaling groups that are enabled for ARC zonal shift), `Nodegroups` (EKS Node groups), `Pods` (EKS Pods), `ReplicationGroups`(ElastiCache Redis Replication Groups), `Roles` (IAM Roles), `SpotInstances` (EC2 Spot Instances), `Subnets` (VPC Subnets), `Tables` (DynamoDB encrypted global tables), `Tasks` (ECS Tasks), `TransitGateways` (Transit gateways), `Volumes` (EBS Volumes). See the [documentation](https://docs.aws.amazon.com/fis/latest/userguide/action-sequence.html#action-targets) for more details.
          */
         key: string;
         /**
@@ -40423,7 +41737,7 @@ export declare namespace fis {
     }
     interface ExperimentTemplateLogConfigurationCloudwatchLogsConfiguration {
         /**
-         * The Amazon Resource Name (ARN) of the destination Amazon CloudWatch Logs log group.
+         * The Amazon Resource Name (ARN) of the destination Amazon CloudWatch Logs log group. The ARN must end with `:*`
          */
         logGroupArn: string;
     }
@@ -41251,6 +42565,16 @@ export declare namespace fsx {
          */
         mode?: string;
     }
+    interface OpenZfsFileSystemReadCacheConfiguration {
+        /**
+         * Size of the file system's SSD read cache, in gibibytes (GiB). Required when `sizingMode` is set to `USER_PROVISIONED`. Must not be set when any other `sizingMode` is used.
+         */
+        size: number;
+        /**
+         * Specifies how the provisioned SSD read cache is sized. Valid values are `NO_CACHE`, `USER_PROVISIONED`, and `PROPORTIONAL_TO_THROUGHPUT_CAPACITY`. See the [AWS API documentation](https://docs.aws.amazon.com/fsx/latest/APIReference/API_OpenZFSReadCacheConfiguration.html) for more information.
+         */
+        sizingMode?: string;
+    }
     interface OpenZfsFileSystemRootVolumeConfiguration {
         /**
          * A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
@@ -51573,6 +52897,71 @@ export declare namespace lambda {
             [key: string]: number;
         };
     }
+    interface CapacityProviderCapacityProviderScalingConfig {
+        maxVcpuCount: number;
+        /**
+         * The scaling mode for the Capacity Provider. Valid values are `AUTO` and `MANUAL`. Defaults to `AUTO`.
+         */
+        scalingMode: string;
+        /**
+         * List of scaling policies. See Scaling Policies below.
+         */
+        scalingPolicies: outputs.lambda.CapacityProviderCapacityProviderScalingConfigScalingPolicy[];
+    }
+    interface CapacityProviderCapacityProviderScalingConfigScalingPolicy {
+        /**
+         * The predefined metric type for the scaling policy. Valid values are `LAMBDA_PROVISIONED_CONCURRENCY_UTILIZATION`.
+         */
+        predefinedMetricType: string;
+        /**
+         * The target value for the scaling policy.
+         */
+        targetValue: number;
+    }
+    interface CapacityProviderInstanceRequirement {
+        /**
+         * List of allowed instance types.
+         */
+        allowedInstanceTypes: string[];
+        /**
+         * List of CPU architectures. Valid values are `X86_64` and `ARM64`.
+         */
+        architectures: string[];
+        /**
+         * List of excluded instance types.
+         */
+        excludedInstanceTypes: string[];
+    }
+    interface CapacityProviderPermissionsConfig {
+        /**
+         * The ARN of the IAM role that allows Lambda to manage the Capacity Provider.
+         */
+        capacityProviderOperatorRoleArn: string;
+    }
+    interface CapacityProviderTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
+    interface CapacityProviderVpcConfig {
+        /**
+         * List of security group IDs for the VPC.
+         */
+        securityGroupIds: string[];
+        /**
+         * List of subnet IDs for the VPC.
+         */
+        subnetIds: string[];
+    }
     interface CodeSigningConfigAllowedPublishers {
         /**
          * Set of ARNs for each of the signing profiles. A signing profile defines a trusted user who can sign a code package. Maximum of 20 signing profiles.
@@ -51751,12 +53140,42 @@ export declare namespace lambda {
          */
         uri: string;
     }
+    interface FunctionCapacityProviderConfig {
+        /**
+         * Configuration block for Lambda Managed Instances Capacity Provider. See below.
+         */
+        lambdaManagedInstancesCapacityProviderConfig: outputs.lambda.FunctionCapacityProviderConfigLambdaManagedInstancesCapacityProviderConfig;
+    }
+    interface FunctionCapacityProviderConfigLambdaManagedInstancesCapacityProviderConfig {
+        /**
+         * ARN of the Capacity Provider.
+         */
+        capacityProviderArn: string;
+        /**
+         * Memory GiB per vCPU for the execution environment.
+         */
+        executionEnvironmentMemoryGibPerVcpu: number;
+        /**
+         * Maximum concurrency per execution environment.
+         */
+        perExecutionEnvironmentMaxConcurrency: number;
+    }
     interface FunctionDeadLetterConfig {
         /**
          * ARN of an SNS topic or SQS queue to notify when an invocation fails.
          */
         targetArn: string;
     }
+    interface FunctionDurableConfig {
+        /**
+         * Maximum execution time in seconds for the durable function. Valid value between 1 and 31622400 (366 days).
+         */
+        executionTimeout: number;
+        /**
+         * Number of days to retain the function's execution state. Valid value between 1 and 90. If not specified, the function's execution state is not retained. Defaults to 14.
+         */
+        retentionPeriod?: number;
+    }
     interface FunctionEnvironment {
         /**
          * Map of environment variables available to your Lambda function during execution.
@@ -51845,6 +53264,12 @@ export declare namespace lambda {
          */
         optimizationStatus: string;
     }
+    interface FunctionTenancyConfig {
+        /**
+         * Tenant Isolation Mode. Valid values: `PER_TENANT`.
+         */
+        tenantIsolationMode: string;
+    }
     interface FunctionTracingConfig {
         /**
          * X-Ray tracing mode. Valid values: `Active`, `PassThrough`.
@@ -51907,12 +53332,42 @@ export declare namespace lambda {
          */
         untrustedArtifactOnDeployment: string;
     }
+    interface GetFunctionCapacityProviderConfig {
+        /**
+         * Configuration block for Lambda Managed Instances Capacity Provider.
+         */
+        lambdaManagedInstancesCapacityProviderConfigs: outputs.lambda.GetFunctionCapacityProviderConfigLambdaManagedInstancesCapacityProviderConfig[];
+    }
+    interface GetFunctionCapacityProviderConfigLambdaManagedInstancesCapacityProviderConfig {
+        /**
+         * ARN of the Capacity Provider.
+         */
+        capacityProviderArn: string;
+        /**
+         * Memory GiB per vCPU for the execution environment.
+         */
+        executionEnvironmentMemoryGibPerVcpu: number;
+        /**
+         * Maximum concurrency per execution environment.
+         */
+        perExecutionEnvironmentMaxConcurrency: number;
+    }
     interface GetFunctionDeadLetterConfig {
         /**
          * ARN of an SNS topic or SQS queue to notify when an invocation fails.
          */
         targetArn: string;
     }
+    interface GetFunctionDurableConfig {
+        /**
+         * Maximum execution time in seconds for the durable function.
+         */
+        executionTimeout: number;
+        /**
+         * Number of days to retain the function's execution state.
+         */
+        retentionPeriod: number;
+    }
     interface GetFunctionEnvironment {
         /**
          * Map of environment variables that are accessible from the function code during execution.
@@ -51955,6 +53410,12 @@ export declare namespace lambda {
          */
         systemLogLevel: string;
     }
+    interface GetFunctionTenancyConfig {
+        /**
+         * (Required) Tenant Isolation Mode. Valid values: `PER_TENANT`.
+         */
+        tenantIsolationMode: string;
+    }
     interface GetFunctionTracingConfig {
         /**
          * Tracing mode. Valid values: `Active`, `PassThrough`.
@@ -52009,6 +53470,7 @@ export declare namespace lb {
         authenticateOidcs: outputs.lb.GetListenerDefaultActionAuthenticateOidc[];
         fixedResponses: outputs.lb.GetListenerDefaultActionFixedResponse[];
         forwards: outputs.lb.GetListenerDefaultActionForward[];
+        jwtValidations: outputs.lb.GetListenerDefaultActionJwtValidation[];
         order: number;
         redirects: outputs.lb.GetListenerDefaultActionRedirect[];
         targetGroupArn: string;
@@ -52061,6 +53523,16 @@ export declare namespace lb {
         arn: string;
         weight: number;
     }
+    interface GetListenerDefaultActionJwtValidation {
+        additionalClaims: outputs.lb.GetListenerDefaultActionJwtValidationAdditionalClaim[];
+        issuer: string;
+        jwksEndpoint: string;
+    }
+    interface GetListenerDefaultActionJwtValidationAdditionalClaim {
+        format: string;
+        name: string;
+        values: string[];
+    }
     interface GetListenerDefaultActionRedirect {
         host: string;
         path: string;
@@ -52099,6 +53571,11 @@ export declare namespace lb {
          * Detailed below.
          */
         forwards?: outputs.lb.GetListenerRuleActionForward[];
+        /**
+         * An action to validate using JWT.
+         * Detailed below.
+         */
+        jwtValidations?: outputs.lb.GetListenerRuleActionJwtValidation[];
         /**
          * The evaluation order of the action.
          */
@@ -52167,7 +53644,7 @@ export declare namespace lb {
          */
         clientId: string;
         /**
-         * OIDC issuer identifier of the IdP.
+         * Issuer of the JWT.
          */
         issuer: string;
         /**
@@ -52242,6 +53719,34 @@ export declare namespace lb {
          */
         weight: number;
     }
+    interface GetListenerRuleActionJwtValidation {
+        /**
+         * Additional claims to validate.
+         */
+        additionalClaims?: outputs.lb.GetListenerRuleActionJwtValidationAdditionalClaim[];
+        /**
+         * Issuer of the JWT.
+         */
+        issuer: string;
+        /**
+         * JSON Web Key Set (JWKS) endpoint.
+         */
+        jwksEndpoint: string;
+    }
+    interface GetListenerRuleActionJwtValidationAdditionalClaim {
+        /**
+         * Format of the claim value.
+         */
+        format: string;
+        /**
+         * Name of the claim to validate.
+         */
+        name: string;
+        /**
+         * Set of `key`-`value` pairs indicating the query string parameters to match.
+         */
+        values: string[];
+    }
     interface GetListenerRuleActionRedirect {
         /**
          * The hostname.
@@ -52416,6 +53921,11 @@ export declare namespace lb {
         enabled: boolean;
         prefix: string;
     }
+    interface GetLoadBalancerHealthCheckLog {
+        bucket: string;
+        enabled: boolean;
+        prefix: string;
+    }
     interface GetLoadBalancerIpamPool {
         ipv4IpamPoolId: string;
     }
@@ -52460,6 +53970,10 @@ export declare namespace lb {
          * Configuration block for creating an action that distributes requests among one or more target groups. Specify only if `type` is `forward`. See below.
          */
         forward?: outputs.lb.ListenerDefaultActionForward;
+        /**
+         * Configuration block for creating a JWT validation action. Required if `type` is `jwt-validation`.
+         */
+        jwtValidation?: outputs.lb.ListenerDefaultActionJwtValidation;
         /**
          * Order for the action. The action with the lowest value for order is performed first. Valid values are between `1` and `50000`. Defaults to the position in the list of actions.
          */
@@ -52473,7 +53987,7 @@ export declare namespace lb {
          */
         targetGroupArn?: string;
         /**
-         * Type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito` and `authenticate-oidc`.
+         * Type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito`, `authenticate-oidc` and `jwt-validation`.
          *
          * The following arguments are optional:
          */
@@ -52619,6 +54133,36 @@ export declare namespace lb {
          */
         weight?: number;
     }
+    interface ListenerDefaultActionJwtValidation {
+        /**
+         * Repeatable configuration block for additional claims to validate.
+         */
+        additionalClaims?: outputs.lb.ListenerDefaultActionJwtValidationAdditionalClaim[];
+        /**
+         * Issuer of the JWT.
+         */
+        issuer: string;
+        /**
+         * JSON Web Key Set (JWKS) endpoint. This endpoint contains JSON Web Keys (JWK) that are used to validate signatures from the provider. This must be a full URL, including the HTTPS protocol, the domain, and the path.
+         *
+         * The following arguments are optional:
+         */
+        jwksEndpoint: string;
+    }
+    interface ListenerDefaultActionJwtValidationAdditionalClaim {
+        /**
+         * Format of the claim value. Valid values are `single-string`, `string-array` and `space-separated-values`.
+         */
+        format: string;
+        /**
+         * Name of the claim to validate. `exp`, `iss`, `nbf`, or `iat` cannot be specified because they are validated by default.
+         */
+        name: string;
+        /**
+         * List of expected values of the claim.
+         */
+        values: string[];
+    }
     interface ListenerDefaultActionRedirect {
         /**
          * Hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
@@ -52685,6 +54229,10 @@ export declare namespace lb {
          * Cannot be specified with `targetGroupArn`.
          */
         forward?: outputs.lb.ListenerRuleActionForward;
+        /**
+         * Information for creating a JWT validation action. Required if `type` is `jwt-validation`.
+         */
+        jwtValidation?: outputs.lb.ListenerRuleActionJwtValidation;
         /**
          * Order for the action.
          * The action with the lowest value for order is performed first.
@@ -52704,7 +54252,7 @@ export declare namespace lb {
          */
         targetGroupArn?: string;
         /**
-         * The type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito` and `authenticate-oidc`.
+         * The type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito`, `authenticate-oidc` and `jwt-validation`.
          */
         type: string;
     }
@@ -52836,6 +54384,34 @@ export declare namespace lb {
          */
         weight?: number;
     }
+    interface ListenerRuleActionJwtValidation {
+        /**
+         * Repeatable configuration block for additional claims to validate.
+         */
+        additionalClaims?: outputs.lb.ListenerRuleActionJwtValidationAdditionalClaim[];
+        /**
+         * Issuer of the JWT.
+         */
+        issuer: string;
+        /**
+         * JSON Web Key Set (JWKS) endpoint. This endpoint contains JSON Web Keys (JWK) that are used to validate signatures from the provider. This must be a full URL, including the HTTPS protocol, the domain, and the path.
+         */
+        jwksEndpoint: string;
+    }
+    interface ListenerRuleActionJwtValidationAdditionalClaim {
+        /**
+         * Format of the claim value. Valid values are `single-string`, `string-array` and `space-separated-values`.
+         */
+        format: string;
+        /**
+         * Name of the claim to validate. `exp`, `iss`, `nbf`, or `iat` cannot be specified because they are validated by default.
+         */
+        name: string;
+        /**
+         * List of expected values of the claim.
+         */
+        values: string[];
+    }
     interface ListenerRuleActionRedirect {
         /**
          * The hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
@@ -53014,6 +54590,20 @@ export declare namespace lb {
          */
         prefix?: string;
     }
+    interface LoadBalancerHealthCheckLogs {
+        /**
+         * S3 bucket name to store the logs in.
+         */
+        bucket: string;
+        /**
+         * Boolean to enable / disable `healthCheckLogs`. Defaults to `false`, even when `bucket` is specified.
+         */
+        enabled?: boolean;
+        /**
+         * S3 bucket prefix. Logs are stored in the root if not configured.
+         */
+        prefix?: string;
+    }
     interface LoadBalancerIpamPools {
         /**
          * The ID of the IPv4 IPAM pool.
@@ -68964,6 +70554,14 @@ export declare namespace msk {
          */
         enabledInBroker: boolean;
     }
+    interface ClusterRebalancing {
+        /**
+         * The status of intelligent rebalancing. Valid values: `ACTIVE`, `PAUSED`. Default is `ACTIVE` for new Express-based clusters.
+         *
+         * > **NOTE:** Intelligent rebalancing is only available for MSK Provisioned clusters with Express brokers. When enabled, you cannot use third-party rebalancing tools such as Cruise Control. See [AWS MSK Intelligent Rebalancing](https://docs.aws.amazon.com/msk/latest/developerguide/intelligent-rebalancing.html) for more information.
+         */
+        status: string;
+    }
     interface GetBrokerNodesNodeInfoList {
         /**
          * Attached elastic network interface of the broker
@@ -70458,7 +72056,7 @@ export declare namespace networkflowmonitor {
          */
         identifier: string;
         /**
-         * The type of the resource. Valid values are `AWS::EC2::VPC`, `AWS::EC2::Subnet`, `AWS::EC2::AvailabilityZone`, `AWS::EC2::Region`.
+         * The type of the resource. Valid values are `AWS::EC2::VPC`, `AWS::EC2::Subnet`, `AWS::EC2::AvailabilityZone`, `AWS::EC2::Region`, and `AWS::EKS::Cluster`.
          */
         type: string;
     }
@@ -70468,7 +72066,7 @@ export declare namespace networkflowmonitor {
          */
         identifier: string;
         /**
-         * The type of the resource. Valid values are `AWS::EC2::VPC`, `AWS::EC2::Subnet`, `AWS::EC2::AvailabilityZone`, `AWS::EC2::Region`.
+         * The type of the resource. Valid values are `AWS::EC2::VPC`, `AWS::EC2::Subnet`, `AWS::EC2::AvailabilityZone`, `AWS::EC2::Region`, and `AWS::EKS::Cluster`.
          */
         type: string;
     }
@@ -71214,13 +72812,13 @@ export declare namespace odb {
         isHealthMonitoringEnabled: boolean;
         isIncidentLogsEnabled: boolean;
     }
-    interface CloudVmClusterIormConfigCach {
-        dbPlans: outputs.odb.CloudVmClusterIormConfigCachDbPlan[];
+    interface CloudVmClusterIormConfigCache {
+        dbPlans: outputs.odb.CloudVmClusterIormConfigCacheDbPlan[];
         lifecycleDetails: string;
         lifecycleState: string;
         objective: string;
     }
-    interface CloudVmClusterIormConfigCachDbPlan {
+    interface CloudVmClusterIormConfigCacheDbPlan {
         dbName: string;
         flashCacheLimit: string;
         share: number;
@@ -71338,13 +72936,13 @@ export declare namespace odb {
         isHealthMonitoringEnabled: boolean;
         isIncidentLogsEnabled: boolean;
     }
-    interface GetCloudVmClusterIormConfigCach {
-        dbPlans: outputs.odb.GetCloudVmClusterIormConfigCachDbPlan[];
+    interface GetCloudVmClusterIormConfigCache {
+        dbPlans: outputs.odb.GetCloudVmClusterIormConfigCacheDbPlan[];
         lifecycleDetails: string;
         lifecycleState: string;
         objective: string;
     }
-    interface GetCloudVmClusterIormConfigCachDbPlan {
+    interface GetCloudVmClusterIormConfigCacheDbPlan {
         dbName: string;
         flashCacheLimit: string;
         share: number;
@@ -71511,6 +73109,9 @@ export declare namespace odb {
          * The ID of the Exadata infrastructure that hosts the database server.
          */
         exadataInfrastructureId: string;
+        /**
+         * The unique identifier of the database server.
+         */
         id: string;
         /**
          * The total number of CPU cores available on the database server.
@@ -78708,6 +80309,14 @@ export declare namespace s3 {
          */
         prefix?: string;
     }
+    interface BucketAbacAbacStatus {
+        /**
+         * ABAC status of the general purpose bucket.
+         * Valid values are `Enabled` and `Disabled`.
+         * By default, ABAC is disabled for all Amazon S3 general purpose buckets.
+         */
+        status: string;
+    }
     interface BucketAclAccessControlPolicy {
         /**
          * Set of `grant` configuration blocks. See below.
@@ -80039,6 +81648,10 @@ export declare namespace s3 {
          * Single object for setting server-side encryption by default. See below.
          */
         applyServerSideEncryptionByDefault?: outputs.s3.BucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault;
+        /**
+         * List of server-side encryption types to block for object uploads. Valid values are `SSE-C` (blocks uploads using server-side encryption with customer-provided keys) and `NONE` (unblocks all encryption types). Starting in March 2026, Amazon S3 will automatically block SSE-C uploads for all new buckets.
+         */
+        blockedEncryptionTypes?: string[];
         /**
          * Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
          */
@@ -80059,6 +81672,10 @@ export declare namespace s3 {
          * Single object for setting server-side encryption by default. See below.
          */
         applyServerSideEncryptionByDefault?: outputs.s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefault;
+        /**
+         * List of server-side encryption types to block for object uploads. Valid values are `SSE-C` (blocks uploads using server-side encryption with customer-provided keys) and `NONE` (unblocks all encryption types). Starting in March 2026, Amazon S3 will automatically block SSE-C uploads for all new buckets.
+         */
+        blockedEncryptionTypes?: string[];
         /**
          * Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
          */
@@ -80735,6 +82352,16 @@ export declare namespace s3 {
             [key: string]: string;
         };
     }
+    interface VectorsVectorBucketEncryptionConfiguration {
+        /**
+         * AWS KMS CMK ARN to use for the default encryption of the vector bucket. Allowed if and only if `sseType` is set to `aws:kms`.
+         */
+        kmsKeyArn: string;
+        /**
+         * Server-side encryption type to use for the default encryption of the vector bucket. Valid values: `AES256`, `aws:kms`.
+         */
+        sseType: string;
+    }
 }
 export declare namespace s3control {
     interface AccessGrantAccessGrantsLocationConfiguration {
@@ -81220,6 +82847,18 @@ export declare namespace s3tables {
          */
         unreferencedDays: number;
     }
+    interface TableBucketReplicationRule {
+        /**
+         * Replication destination. See Destination below for more details.
+         */
+        destinations?: outputs.s3tables.TableBucketReplicationRuleDestination[];
+    }
+    interface TableBucketReplicationRuleDestination {
+        /**
+         * ARN of destination table bucket to replicate source tables to.
+         */
+        destinationTableBucketArn: string;
+    }
     interface TableEncryptionConfiguration {
         /**
          * The ARN of a KMS Key to be used with `aws:kms` `sseAlgorithm`
@@ -81320,6 +82959,18 @@ export declare namespace s3tables {
          */
         type: string;
     }
+    interface TableReplicationRule {
+        /**
+         * Replication destination. See Destination below for more details.
+         */
+        destinations?: outputs.s3tables.TableReplicationRuleDestination[];
+    }
+    interface TableReplicationRuleDestination {
+        /**
+         * ARN of destination table bucket to replicate source tables to.
+         */
+        destinationTableBucketArn: string;
+    }
 }
 export declare namespace sagemaker {
     interface AppImageConfigCodeEditorAppImageConfig {
@@ -83282,18 +84933,21 @@ export declare namespace sagemaker {
     }
     interface ModelContainer {
         /**
-         * The DNS host name for the container.
+         * Additional data sources that are available to the model in addition to those specified in `modelDataSource`. See Additional Model Data Source.
+         */
+        additionalModelDataSources: outputs.sagemaker.ModelContainerAdditionalModelDataSource[];
+        /**
+         * DNS host name for the container.
          */
         containerHostname?: string;
         /**
          * Environment variables for the Docker container.
-         * A list of key value pairs.
          */
         environment?: {
             [key: string]: string;
         };
         /**
-         * The registry path where the inference code image is stored in Amazon ECR.
+         * Registry path where the inference code image is stored in Amazon ECR.
          */
         image?: string;
         /**
@@ -83301,23 +84955,24 @@ export declare namespace sagemaker {
          */
         imageConfig?: outputs.sagemaker.ModelContainerImageConfig;
         /**
-         * The inference specification name in the model package version.
+         * Inference specification name in the model package version.
          */
         inferenceSpecificationName?: string;
         /**
-         * The container hosts value `SingleModel/MultiModel`. The default value is `SingleModel`.
+         * Container hosts value. Allowed values are: `SingleModel` and `MultiModel`. The default value is `SingleModel`.
          */
         mode?: string;
         /**
-         * The location of model data to deploy. Use this for uncompressed model deployment. For information about how to deploy an uncompressed model, see [Deploying uncompressed models](https://docs.aws.amazon.com/sagemaker/latest/dg/large-model-inference-uncompressed.html) in the _AWS SageMaker AI Developer Guide_.
+         * Location of model data to deploy. Use this for uncompressed model deployment. For information about how to deploy an uncompressed model, see [Deploying uncompressed models](https://docs.aws.amazon.com/sagemaker/latest/dg/large-model-inference-uncompressed.html) in the _AWS SageMaker AI Developer Guide_.
          */
         modelDataSource: outputs.sagemaker.ModelContainerModelDataSource;
         /**
-         * The URL for the S3 location where model artifacts are stored.
+         * URL for the S3 location where model artifacts are stored.
          */
         modelDataUrl?: string;
         /**
-         * The Amazon Resource Name (ARN) of the model package to use to create the model.
+         * Amazon Resource Name (ARN) of the model package to use to create the model.
+         * A list of key value pairs.
          */
         modelPackageName?: string;
         /**
@@ -83325,6 +84980,40 @@ export declare namespace sagemaker {
          */
         multiModelConfig?: outputs.sagemaker.ModelContainerMultiModelConfig;
     }
+    interface ModelContainerAdditionalModelDataSource {
+        /**
+         * Custom name for the additional model data source object. It will be stored in `/opt/ml/additional-model-data-sources/<channel_name>/`.
+         */
+        channelName: string;
+        /**
+         * S3 location of model data to deploy. See S3 Data Source.
+         */
+        s3DataSources: outputs.sagemaker.ModelContainerAdditionalModelDataSourceS3DataSource[];
+    }
+    interface ModelContainerAdditionalModelDataSourceS3DataSource {
+        /**
+         * How the model data is prepared. Allowed values are: `None` and `Gzip`.
+         */
+        compressionType: string;
+        /**
+         * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the [`modelAccessConfig` configuration block]. See Model Access Config.
+         */
+        modelAccessConfig?: outputs.sagemaker.ModelContainerAdditionalModelDataSourceS3DataSourceModelAccessConfig;
+        /**
+         * Type of model data to deploy. Allowed values are: `S3Object` and `S3Prefix`.
+         */
+        s3DataType: string;
+        /**
+         * The S3 path of model data to deploy.
+         */
+        s3Uri: string;
+    }
+    interface ModelContainerAdditionalModelDataSourceS3DataSourceModelAccessConfig {
+        /**
+         * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
+         */
+        acceptEula: boolean;
+    }
     interface ModelContainerImageConfig {
         /**
          * Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). Allowed values are: `Platform` and `Vpc`.
@@ -83337,13 +85026,13 @@ export declare namespace sagemaker {
     }
     interface ModelContainerImageConfigRepositoryAuthConfig {
         /**
-         * The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the _AWS Lambda Developer Guide_.
+         * Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the _AWS Lambda Developer Guide_.
          */
         repositoryCredentialsProviderArn: string;
     }
     interface ModelContainerModelDataSource {
         /**
-         * The S3 location of model data to deploy.
+         * S3 location of model data to deploy. See S3 Data Source.
          */
         s3DataSources: outputs.sagemaker.ModelContainerModelDataSourceS3DataSource[];
     }
@@ -83353,11 +85042,11 @@ export declare namespace sagemaker {
          */
         compressionType: string;
         /**
-         * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the [`modelAccessConfig` configuration block]. see Model Access Config.
+         * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the [`modelAccessConfig` configuration block]. See Model Access Config.
          */
         modelAccessConfig?: outputs.sagemaker.ModelContainerModelDataSourceS3DataSourceModelAccessConfig;
         /**
-         * The type of model data to deploy. Allowed values are: `S3Object` and `S3Prefix`.
+         * Type of model data to deploy. Allowed values are: `S3Object` and `S3Prefix`.
          */
         s3DataType: string;
         /**
@@ -83367,7 +85056,7 @@ export declare namespace sagemaker {
     }
     interface ModelContainerModelDataSourceS3DataSourceModelAccessConfig {
         /**
-         * Specifies agreement to the model end-user license agreement (EULA). The AcceptEula value must be explicitly defined as `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
+         * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
          */
         acceptEula: boolean;
     }
@@ -83379,24 +85068,27 @@ export declare namespace sagemaker {
     }
     interface ModelInferenceExecutionConfig {
         /**
-         * The container hosts value `SingleModel/MultiModel`. The default value is `SingleModel`.
+         * How containers in a multi-container are run. Allowed values are: `Serial` and `Direct`.
          */
         mode: string;
     }
     interface ModelPrimaryContainer {
         /**
-         * The DNS host name for the container.
+         * Additional data sources that are available to the model in addition to those specified in `modelDataSource`. See Additional Model Data Source.
+         */
+        additionalModelDataSources: outputs.sagemaker.ModelPrimaryContainerAdditionalModelDataSource[];
+        /**
+         * DNS host name for the container.
          */
         containerHostname?: string;
         /**
          * Environment variables for the Docker container.
-         * A list of key value pairs.
          */
         environment?: {
             [key: string]: string;
         };
         /**
-         * The registry path where the inference code image is stored in Amazon ECR.
+         * Registry path where the inference code image is stored in Amazon ECR.
          */
         image?: string;
         /**
@@ -83404,23 +85096,21 @@ export declare namespace sagemaker {
          */
         imageConfig?: outputs.sagemaker.ModelPrimaryContainerImageConfig;
         /**
-         * The inference specification name in the model package version.
+         * Inference specification name in the model package version.
          */
         inferenceSpecificationName?: string;
-        /**
-         * The container hosts value `SingleModel/MultiModel`. The default value is `SingleModel`.
-         */
         mode?: string;
         /**
-         * The location of model data to deploy. Use this for uncompressed model deployment. For information about how to deploy an uncompressed model, see [Deploying uncompressed models](https://docs.aws.amazon.com/sagemaker/latest/dg/large-model-inference-uncompressed.html) in the _AWS SageMaker AI Developer Guide_.
+         * Location of model data to deploy. Use this for uncompressed model deployment. For information about how to deploy an uncompressed model, see [Deploying uncompressed models](https://docs.aws.amazon.com/sagemaker/latest/dg/large-model-inference-uncompressed.html) in the _AWS SageMaker AI Developer Guide_.
          */
         modelDataSource: outputs.sagemaker.ModelPrimaryContainerModelDataSource;
         /**
-         * The URL for the S3 location where model artifacts are stored.
+         * URL for the S3 location where model artifacts are stored.
          */
         modelDataUrl?: string;
         /**
-         * The Amazon Resource Name (ARN) of the model package to use to create the model.
+         * Amazon Resource Name (ARN) of the model package to use to create the model.
+         * A list of key value pairs.
          */
         modelPackageName?: string;
         /**
@@ -83428,6 +85118,40 @@ export declare namespace sagemaker {
          */
         multiModelConfig?: outputs.sagemaker.ModelPrimaryContainerMultiModelConfig;
     }
+    interface ModelPrimaryContainerAdditionalModelDataSource {
+        /**
+         * Custom name for the additional model data source object. It will be stored in `/opt/ml/additional-model-data-sources/<channel_name>/`.
+         */
+        channelName: string;
+        /**
+         * S3 location of model data to deploy. See S3 Data Source.
+         */
+        s3DataSources: outputs.sagemaker.ModelPrimaryContainerAdditionalModelDataSourceS3DataSource[];
+    }
+    interface ModelPrimaryContainerAdditionalModelDataSourceS3DataSource {
+        /**
+         * How the model data is prepared. Allowed values are: `None` and `Gzip`.
+         */
+        compressionType: string;
+        /**
+         * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the [`modelAccessConfig` configuration block]. See Model Access Config.
+         */
+        modelAccessConfig?: outputs.sagemaker.ModelPrimaryContainerAdditionalModelDataSourceS3DataSourceModelAccessConfig;
+        /**
+         * Type of model data to deploy. Allowed values are: `S3Object` and `S3Prefix`.
+         */
+        s3DataType: string;
+        /**
+         * The S3 path of model data to deploy.
+         */
+        s3Uri: string;
+    }
+    interface ModelPrimaryContainerAdditionalModelDataSourceS3DataSourceModelAccessConfig {
+        /**
+         * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
+         */
+        acceptEula: boolean;
+    }
     interface ModelPrimaryContainerImageConfig {
         /**
          * Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). Allowed values are: `Platform` and `Vpc`.
@@ -83440,13 +85164,13 @@ export declare namespace sagemaker {
     }
     interface ModelPrimaryContainerImageConfigRepositoryAuthConfig {
         /**
-         * The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the _AWS Lambda Developer Guide_.
+         * Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the _AWS Lambda Developer Guide_.
          */
         repositoryCredentialsProviderArn: string;
     }
     interface ModelPrimaryContainerModelDataSource {
         /**
-         * The S3 location of model data to deploy.
+         * S3 location of model data to deploy. See S3 Data Source.
          */
         s3DataSources: outputs.sagemaker.ModelPrimaryContainerModelDataSourceS3DataSource[];
     }
@@ -83456,11 +85180,11 @@ export declare namespace sagemaker {
          */
         compressionType: string;
         /**
-         * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the [`modelAccessConfig` configuration block]. see Model Access Config.
+         * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the [`modelAccessConfig` configuration block]. See Model Access Config.
          */
         modelAccessConfig?: outputs.sagemaker.ModelPrimaryContainerModelDataSourceS3DataSourceModelAccessConfig;
         /**
-         * The type of model data to deploy. Allowed values are: `S3Object` and `S3Prefix`.
+         * Type of model data to deploy. Allowed values are: `S3Object` and `S3Prefix`.
          */
         s3DataType: string;
         /**
@@ -83470,7 +85194,7 @@ export declare namespace sagemaker {
     }
     interface ModelPrimaryContainerModelDataSourceS3DataSourceModelAccessConfig {
         /**
-         * Specifies agreement to the model end-user license agreement (EULA). The AcceptEula value must be explicitly defined as `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
+         * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
          */
         acceptEula: boolean;
     }
@@ -83481,7 +85205,13 @@ export declare namespace sagemaker {
         modelCacheSetting?: string;
     }
     interface ModelVpcConfig {
+        /**
+         * List of security group IDs you want to be applied to your training job or model. Specify the security groups for the VPC that is specified in the Subnets field.
+         */
         securityGroupIds: string[];
+        /**
+         * List of subnet IDs in the VPC to which you want to connect your training job or model.
+         */
         subnets: string[];
     }
     interface MonitoringScheduleMonitoringScheduleConfig {
@@ -89889,6 +91619,22 @@ export declare namespace transfer {
          */
         signingAlgorithm: string;
     }
+    interface ConnectorEgressConfig {
+        /**
+         * VPC Lattice configuration for routing connector traffic through customer VPCs. Fields documented below.
+         */
+        vpcLattice?: outputs.transfer.ConnectorEgressConfigVpcLattice;
+    }
+    interface ConnectorEgressConfigVpcLattice {
+        /**
+         * Port number for connecting to the SFTP server through VPC Lattice. Defaults to 22 if not specified. Must match the port on which the target SFTP server is listening. Valid values are between 1 and 65535.
+         */
+        portNumber?: number;
+        /**
+         * ARN of the VPC Lattice Resource Configuration that defines the target SFTP server location. Must point to a valid Resource Configuration in a VPC with appropriate network connectivity to the SFTP server.
+         */
+        resourceConfigurationArn: string;
+    }
     interface ConnectorSftpConfig {
         /**
          * A list of public portion of the host key, or keys, that are used to authenticate the user to the external server to which you are connecting.(https://docs.aws.amazon.com/transfer/latest/userguide/API_SftpConnectorConfig.html)
@@ -89934,6 +91680,22 @@ export declare namespace transfer {
         partnerProfileId: string;
         singingAlgorithm: string;
     }
+    interface GetConnectorEgressConfig {
+        /**
+         * VPC Lattice configuration. Contains the following attributes:
+         */
+        vpcLattices: outputs.transfer.GetConnectorEgressConfigVpcLattice[];
+    }
+    interface GetConnectorEgressConfigVpcLattice {
+        /**
+         * Port number for connecting to the SFTP server through VPC Lattice.
+         */
+        portNumber: number;
+        /**
+         * ARN of the VPC Lattice Resource Configuration.
+         */
+        resourceConfigurationArn: string;
+    }
     interface GetConnectorSftpConfig {
         /**
          * List of the public portions of the host keys that are used to identify the servers the connector is connected to.