@pulumi/aws 7.33.0-alpha.1781422613 → 7.33.0

package/types/output.d.ts

@@ -21,7 +21,7 @@ export interface GetAvailabilityZonesFilter {
 }
 export interface GetRegionsFilter {
     /**
-     * Name of the filter field. Valid values can be found in the [describe-regions AWS CLI Reference][1].
+     * Name of the filter field. Valid values can be found in the [describe-regions AWS CLI Reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-regions.html).
      */
     name: string;
     /**
@@ -132,7 +132,7 @@ export declare namespace account {
 export declare namespace acm {
     interface CertificateDomainValidationOption {
         /**
-         * Fully qualified domain name (FQDN) in the certificate.
+         * Domain to be validated
          */
         domainName: string;
         /**
@@ -15121,7 +15121,7 @@ export declare namespace bedrock {
     }
     interface AgentcoreAgentRuntimeProtocolConfiguration {
         /**
-         * Server protocol for the agent runtime. Valid values: `HTTP`, `MCP`, `A2A`.
+         * Server protocol for the agent runtime. Valid values: `HTTP`, `MCP`, `A2A`, `AGUI`.
          */
         serverProtocol?: string;
     }
@@ -15331,6 +15331,16 @@ export declare namespace bedrock {
          */
         arn: string;
     }
+    interface AgentcoreGatewayPolicyEngineConfiguration {
+        /**
+         * ARN of the policy engine. The policy engine contains Cedar policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.
+         */
+        arn: string;
+        /**
+         * Enforcement mode for the policy engine. Valid values: `LOG_ONLY`, `ENFORCE`. In `LOG_ONLY` mode, the policy engine evaluates actions and records traces but does not enforce decisions. In `ENFORCE` mode, the policy engine evaluates actions and enforces allow/deny decisions.
+         */
+        mode: string;
+    }
     interface AgentcoreGatewayProtocolConfiguration {
         /**
          * Model Context Protocol (MCP) configuration block. See `mcp` below.
@@ -15346,20 +15356,48 @@ export declare namespace bedrock {
          * Search type for MCP. Valid values: `SEMANTIC`.
          */
         searchType?: string;
+        /**
+         * Configuration block for session settings of the MCP gateway. See `sessionConfiguration` below.
+         */
+        sessionConfiguration?: outputs.bedrock.AgentcoreGatewayProtocolConfigurationMcpSessionConfiguration;
+        /**
+         * Configuration block for streaming settings of the MCP gateway. See `streamingConfiguration` below.
+         */
+        streamingConfiguration?: outputs.bedrock.AgentcoreGatewayProtocolConfigurationMcpStreamingConfiguration;
         /**
          * Set of supported MCP protocol versions.
          */
         supportedVersions?: string[];
     }
+    interface AgentcoreGatewayProtocolConfigurationMcpSessionConfiguration {
+        /**
+         * Integer value for session timeout in seconds. Must be between 900 and 28800.
+         */
+        sessionTimeoutInSeconds?: number;
+    }
+    interface AgentcoreGatewayProtocolConfigurationMcpStreamingConfiguration {
+        /**
+         * Boolean indicating whether response streaming is enabled for the gateway.
+         */
+        enableResponseStreaming?: boolean;
+    }
     interface AgentcoreGatewayTargetCredentialProviderConfiguration {
         /**
          * API key-based authentication configuration. See `apiKey` below.
          */
         apiKey?: outputs.bedrock.AgentcoreGatewayTargetCredentialProviderConfigurationApiKey;
         /**
-         * Use the gateway's IAM role for authentication. This is an empty configuration block.
+         * Caller IAM credentials-based authentication configuration. See `callerIamCredentials` below.
+         */
+        callerIamCredentials?: outputs.bedrock.AgentcoreGatewayTargetCredentialProviderConfigurationCallerIamCredentials;
+        /**
+         * Use the gateway's IAM role for authentication. See `gatewayIamRole` below.
          */
         gatewayIamRole?: outputs.bedrock.AgentcoreGatewayTargetCredentialProviderConfigurationGatewayIamRole;
+        /**
+         * JWT passthrough-based authentication configuration. This is an empty configuration block.
+         */
+        jwtPassthrough?: outputs.bedrock.AgentcoreGatewayTargetCredentialProviderConfigurationJwtPassthrough;
         /**
          * OAuth-based authentication configuration. See `oauth` below.
          */
@@ -15383,7 +15421,27 @@ export declare namespace bedrock {
          */
         providerArn: string;
     }
+    interface AgentcoreGatewayTargetCredentialProviderConfigurationCallerIamCredentials {
+        /**
+         * The AWS region for the credentials.
+         */
+        region?: string;
+        /**
+         * The service name for the credentials.
+         */
+        service: string;
+    }
     interface AgentcoreGatewayTargetCredentialProviderConfigurationGatewayIamRole {
+        /**
+         * AWS Region used for SigV4 signing of upstream requests. Defaults to the gateway's Region when omitted. Only meaningful when `service` is set.
+         */
+        region?: string;
+        /**
+         * The target AWS service name used for SigV4 signing of upstream requests. Required when calling SigV4-protected endpoints such as another Bedrock AgentCore Runtime (use `bedrock-agentcore`). Omit for non-SigV4 IAM-role-based authentication, in which case the block can be empty (`gatewayIamRole {}`).
+         */
+        service?: string;
+    }
+    interface AgentcoreGatewayTargetCredentialProviderConfigurationJwtPassthrough {
     }
     interface AgentcoreGatewayTargetCredentialProviderConfigurationOauth {
         /**
@@ -15425,12 +15483,78 @@ export declare namespace bedrock {
          */
         allowedResponseHeaders?: string[];
     }
+    interface AgentcoreGatewayTargetPrivateEndpoint {
+        /**
+         * AWS creates and manages the VPC Lattice resource gateway and resource configuration on your behalf using a service-linked role. See `managedVpcResource` below.
+         */
+        managedVpcResource?: outputs.bedrock.AgentcoreGatewayTargetPrivateEndpointManagedVpcResource;
+        /**
+         * Use an existing VPC Lattice resource configuration that you manage yourself. Useful for cross-account setups or advanced Lattice configurations. See `selfManagedLatticeResource` below.
+         */
+        selfManagedLatticeResource?: outputs.bedrock.AgentcoreGatewayTargetPrivateEndpointSelfManagedLatticeResource;
+    }
+    interface AgentcoreGatewayTargetPrivateEndpointManagedVpcResource {
+        /**
+         * IP address type for the resource configuration endpoint. Valid values: `IPV4`, `IPV6`.
+         */
+        endpointIpAddressType: string;
+        /**
+         * Intermediate domain (e.g. a VPCE or ALB DNS name) to use instead of the actual target domain. Useful when the MCP server uses a private TLS certificate — place an ALB with a public ACM cert in front and set this to the ALB DNS name.
+         */
+        routingDomain?: string;
+        /**
+         * Set of security group IDs (up to 5) to associate with the Lattice resource gateway. Defaults to the VPC default security group.
+         */
+        securityGroupIds?: string[];
+        /**
+         * Set of subnet IDs inside the VPC where Lattice ENIs are placed.
+         */
+        subnetIds: string[];
+        /**
+         * Map of tags to apply to the managed Lattice resource gateway.
+         */
+        tags?: {
+            [key: string]: string;
+        };
+        /**
+         * ID of the VPC that contains the private resource.
+         */
+        vpcIdentifier: string;
+    }
+    interface AgentcoreGatewayTargetPrivateEndpointSelfManagedLatticeResource {
+        /**
+         * ARN or ID of the VPC Lattice resource configuration.
+         */
+        resourceConfigurationIdentifier: string;
+    }
     interface AgentcoreGatewayTargetTargetConfiguration {
+        /**
+         * HTTP target configuration for routing requests directly to an AgentCore Runtime agent. See `http` below.
+         */
+        http?: outputs.bedrock.AgentcoreGatewayTargetTargetConfigurationHttp;
         /**
          * Model Context Protocol (MCP) configuration. See `mcp` below.
          */
         mcp?: outputs.bedrock.AgentcoreGatewayTargetTargetConfigurationMcp;
     }
+    interface AgentcoreGatewayTargetTargetConfigurationHttp {
+        /**
+         * AgentCore Runtime target configuration. See `agentcoreRuntime` below.
+         *
+         * > **Note:** HTTP targets can only be attached to gateways that do not have a `protocolType` set. They are not supported on MCP-protocol gateways.
+         */
+        agentcoreRuntime?: outputs.bedrock.AgentcoreGatewayTargetTargetConfigurationHttpAgentcoreRuntime;
+    }
+    interface AgentcoreGatewayTargetTargetConfigurationHttpAgentcoreRuntime {
+        /**
+         * ARN of the AgentCore Runtime agent that the gateway routes requests to.
+         */
+        arn: string;
+        /**
+         * Runtime qualifier identifying a specific endpoint version. Defaults to `DEFAULT` when not set.
+         */
+        qualifier?: string;
+    }
     interface AgentcoreGatewayTargetTargetConfigurationMcp {
         /**
          * API Gateway target configuration. See `apiGateway` below.
@@ -15928,6 +16052,10 @@ export declare namespace bedrock {
          * Endpoint for the MCP server target configuration.
          */
         endpoint: string;
+        /**
+         * Listing mode for the MCP server target. Valid values are `DEFAULT` and `DYNAMIC`. MCP resources for `DEFAULT` targets are cached at the control plane for faster access, while resources for `DYNAMIC` targets are retrieved dynamically when listing tools.
+         */
+        listingMode: string;
     }
     interface AgentcoreGatewayTargetTargetConfigurationMcpOpenApiSchema {
         inlinePayload?: outputs.bedrock.AgentcoreGatewayTargetTargetConfigurationMcpOpenApiSchemaInlinePayload;
@@ -16476,6 +16604,16 @@ export declare namespace bedrock {
          */
         summaryRatio: number;
     }
+    interface AgentcoreMemoryIndexedKey {
+        /**
+         * Metadata key name to index.
+         */
+        key: string;
+        /**
+         * Data type of the indexed key. Valid values are `STRING`, `STRINGLIST`, and `NUMBER`.
+         */
+        type: string;
+    }
     interface AgentcoreMemoryStrategyConfiguration {
         /**
          * Consolidation configuration for processing and organizing memory content. See `consolidation` below. Once added, this block cannot be removed without recreating the resource.
@@ -16524,6 +16662,38 @@ export declare namespace bedrock {
          */
         update?: string;
     }
+    interface AgentcoreMemoryStreamDeliveryResources {
+        /**
+         * List of stream delivery resource configurations. See `resource` below.
+         */
+        resource?: outputs.bedrock.AgentcoreMemoryStreamDeliveryResourcesResource;
+    }
+    interface AgentcoreMemoryStreamDeliveryResourcesResource {
+        /**
+         * Kinesis Data Stream configuration. See `kinesis` below.
+         */
+        kinesis?: outputs.bedrock.AgentcoreMemoryStreamDeliveryResourcesResourceKinesis;
+    }
+    interface AgentcoreMemoryStreamDeliveryResourcesResourceKinesis {
+        /**
+         * Content configurations for stream delivery. See `contentConfiguration` below.
+         */
+        contentConfiguration?: outputs.bedrock.AgentcoreMemoryStreamDeliveryResourcesResourceKinesisContentConfiguration;
+        /**
+         * ARN of the Kinesis Data Stream.
+         */
+        dataStreamArn: string;
+    }
+    interface AgentcoreMemoryStreamDeliveryResourcesResourceKinesisContentConfiguration {
+        /**
+         * Level of detail for streamed content. Valid values are `METADATA_ONLY` and `FULL_CONTENT`. Defaults to `METADATA_ONLY`.
+         */
+        level: string;
+        /**
+         * Type of content to stream. Valid value is `MEMORY_RECORDS`.
+         */
+        type: string;
+    }
     interface AgentcoreMemoryTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -16953,6 +17123,18 @@ export declare namespace bedrock {
          */
         update?: string;
     }
+    interface AgentcorePolicyDefinition {
+        /**
+         * Inline Cedar policy. See `cedar` Block for details.
+         */
+        cedar: outputs.bedrock.AgentcorePolicyDefinitionCedar;
+    }
+    interface AgentcorePolicyDefinitionCedar {
+        /**
+         * Cedar policy statement.
+         */
+        statement: string;
+    }
     interface AgentcorePolicyEngineTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -16967,6 +17149,20 @@ export declare namespace bedrock {
          */
         update?: string;
     }
+    interface AgentcorePolicyTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
     interface AgentcoreTokenVaultCmkKmsConfiguration {
         /**
          * Type of KMS key. Valid values: `CustomerManagedKey`, `ServiceManagedKey`.
@@ -20162,7 +20358,7 @@ export declare namespace cloudfront {
          */
         domainName: string;
         /**
-         * Unique identifier of a [CloudFront origin access control][8] for this origin.
+         * Unique identifier of a CloudFront origin access control for this origin.
          */
         originAccessControlId?: string;
         originId: string;
@@ -20268,7 +20464,7 @@ export declare namespace cloudfront {
     }
     interface DistributionRestrictionsGeoRestriction {
         /**
-         * [ISO 3166-1-alpha-2 codes][4] for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). If the type is specified as `none` an empty array can be used.
+         * [ISO 3166-1-alpha-2 codes](http://www.iso.org/iso/country_codes/iso_3166_code_lists/country_names_and_code_elements.htm) for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). If the type is specified as `none` an empty array can be used.
          */
         locations: string[];
         /**
@@ -22606,6 +22802,22 @@ export declare namespace cloudwatch {
          */
         value: string;
     }
+    interface LogS3TableIntegrationSourceDataSource {
+        /**
+         * Name of the data source. Use `"*"` to match all sources.
+         */
+        name: string;
+        /**
+         * Type of the data source. Use `"*"` to match all types.
+         */
+        type: string;
+    }
+    interface LogS3TableIntegrationSourceTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+    }
     interface LogTransformerTransformerConfig {
         /**
          * Adds new key-value pairs to the log event. See `addKeys` below for details.
@@ -26978,6 +27190,10 @@ export declare namespace config {
          * Use this to override the default service endpoint URL
          */
         inspectorv2?: string;
+        /**
+         * Use this to override the default service endpoint URL
+         */
+        interconnect?: string;
         /**
          * Use this to override the default service endpoint URL
          */
@@ -34788,6 +35004,30 @@ export declare namespace ec2 {
         name: string;
         values: string[];
     }
+    interface GetDedicatedHostAvailableCapacity {
+        /**
+         * The number of instances that can be launched onto the Dedicated Host for each instance size supported. See `availableInstanceCapacity` below.
+         */
+        availableInstanceCapacities: outputs.ec2.GetDedicatedHostAvailableCapacityAvailableInstanceCapacity[];
+        /**
+         * The number of vCPUs available for launching instances onto the Dedicated Host.
+         */
+        availableVcpus: number;
+    }
+    interface GetDedicatedHostAvailableCapacityAvailableInstanceCapacity {
+        /**
+         * The number of instances that can be launched onto the Dedicated Host based on the host's available capacity.
+         */
+        availableCapacity: number;
+        /**
+         * The instance type of the running instance.
+         */
+        instanceType: string;
+        /**
+         * The total number of instances that can be launched onto the Dedicated Host if there are no instances running on it.
+         */
+        totalCapacity: number;
+    }
     interface GetDedicatedHostFilter {
         /**
          * Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html).
@@ -34798,6 +35038,20 @@ export declare namespace ec2 {
          */
         values: string[];
     }
+    interface GetDedicatedHostInstance {
+        /**
+         * The ID of the instance running on the Dedicated Host.
+         */
+        instanceId: string;
+        /**
+         * The instance type of the running instance.
+         */
+        instanceType: string;
+        /**
+         * The ID of the AWS account that owns the instance.
+         */
+        ownerId: string;
+    }
     interface GetEipsFilter {
         /**
          * Name of the field to filter by, as defined by
@@ -34813,6 +35067,16 @@ export declare namespace ec2 {
         name: string;
         values: string[];
     }
+    interface GetHostsFilter {
+        /**
+         * Name of the filter.
+         */
+        name: string;
+        /**
+         * List of one or more values for the filter.
+         */
+        values: string[];
+    }
     interface GetInstanceCreditSpecification {
         cpuCredits: string;
     }
@@ -34881,7 +35145,7 @@ export declare namespace ec2 {
     interface GetInstanceFilter {
         /**
          * Name of the filter.
-         * For a full reference of filter names, see [describe-instances in the AWS CLI reference][1].
+         * For a full reference of filter names, see [describe-instances in the AWS CLI reference](http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html).
          */
         name: string;
         /**
@@ -35060,7 +35324,7 @@ export declare namespace ec2 {
     interface GetInstancesFilter {
         /**
          * Name of the filter.
-         * For a full reference of filter names, see [describe-instances in the AWS CLI reference][1].
+         * For a full reference of filter names, see [describe-instances in the AWS CLI reference](http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html).
          */
         name: string;
         /**
@@ -37426,19 +37690,58 @@ export declare namespace ec2 {
         status: string;
     }
     interface LaunchConfigurationEbsBlockDevice {
+        /**
+         * Whether the volume should be destroyed
+         * on instance termination (Default: `true`).
+         */
         deleteOnTermination?: boolean;
+        /**
+         * The name of the device to mount.
+         */
         deviceName: string;
+        /**
+         * Whether the volume should be encrypted or not. Defaults to `false`.
+         */
         encrypted: boolean;
+        /**
+         * The amount of provisioned
+         * [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html).
+         * This must be set with a `volumeType` of `"io1"`.
+         */
         iops: number;
+        /**
+         * Whether the device in the block device mapping of the AMI is suppressed.
+         */
         noDevice?: boolean;
+        /**
+         * The Snapshot ID to mount.
+         */
         snapshotId: string;
+        /**
+         * The throughput (MiBps) to provision for a `gp3` volume.
+         */
         throughput: number;
+        /**
+         * The size of the volume in gigabytes.
+         */
         volumeSize: number;
+        /**
+         * The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
+         */
         volumeType: string;
     }
     interface LaunchConfigurationEphemeralBlockDevice {
+        /**
+         * The name of the block device to mount on the instance.
+         */
         deviceName: string;
+        /**
+         * Whether the device in the block device mapping of the AMI is suppressed.
+         */
         noDevice?: boolean;
+        /**
+         * The [Instance Store Device Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames).
+         */
         virtualName?: string;
     }
     interface LaunchConfigurationMetadataOptions {
@@ -37456,11 +37759,29 @@ export declare namespace ec2 {
         httpTokens: string;
     }
     interface LaunchConfigurationRootBlockDevice {
+        /**
+         * Whether the volume should be destroyed on instance termination. Defaults to `true`.
+         */
         deleteOnTermination?: boolean;
+        /**
+         * Whether the volume should be encrypted or not. Defaults to `false`.
+         */
         encrypted: boolean;
+        /**
+         * The amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volumeType` of `io1`.
+         */
         iops: number;
+        /**
+         * The throughput (MiBps) to provision for a `gp3` volume.
+         */
         throughput: number;
+        /**
+         * The size of the volume in gigabytes.
+         */
         volumeSize: number;
+        /**
+         * The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
+         */
         volumeType: string;
     }
     interface LaunchTemplateBlockDeviceMapping {
@@ -38141,6 +38462,16 @@ export declare namespace ec2 {
             [key: string]: string;
         };
     }
+    interface LocalGatewayRouteTableTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+    }
     interface ManagedPrefixListEntry {
         /**
          * CIDR block of this entry.
@@ -41751,6 +42082,392 @@ export declare namespace ecs {
          */
         value: string;
     }
+    interface DaemonDeploymentConfiguration {
+        /**
+         * Alarm configuration for deployment monitoring. See Alarms below.
+         */
+        alarms?: outputs.ecs.DaemonDeploymentConfigurationAlarms;
+        /**
+         * Time in minutes to wait before considering a deployment successful. Valid values are between 0 and 1440. Defaults to `0`.
+         */
+        bakeTimeInMinutes: number;
+        /**
+         * Percentage of tasks to drain during deployment. Valid values are between 0.0 and 100.0.
+         */
+        drainPercent?: number;
+    }
+    interface DaemonDeploymentConfigurationAlarms {
+        /**
+         * List of CloudWatch alarm names to monitor during deployment.
+         */
+        alarmNames?: string[];
+        /**
+         * Whether to enable alarm monitoring for deployments. Defaults to `false`.
+         */
+        enable: boolean;
+    }
+    interface DaemonTaskDefinitionContainerDefinition {
+        /**
+         * Command that is passed to the container.
+         */
+        commands?: string[];
+        /**
+         * Number of CPU units reserved for the container.
+         */
+        cpu: number;
+        /**
+         * Dependencies defined for container startup and shutdown. Detailed below.
+         */
+        dependsOns?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionDependsOn[];
+        /**
+         * Entry point that is passed to the container.
+         */
+        entryPoints?: string[];
+        /**
+         * List of files containing the environment variables to pass to a container. Detailed below.
+         */
+        environmentFiles?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionEnvironmentFile[];
+        /**
+         * Environment variables to pass to a container. Detailed below.
+         */
+        environments?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionEnvironment[];
+        /**
+         * If the essential parameter of a container is marked as true, and that container fails or stops for any reason, all other containers that are part of the task are stopped.
+         */
+        essential: boolean;
+        /**
+         * FireLens configuration for the container. Detailed below.
+         */
+        firelensConfiguration?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionFirelensConfiguration;
+        /**
+         * Container health check command and associated configuration parameters for the container. Detailed below.
+         */
+        healthCheck?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionHealthCheck;
+        /**
+         * Image used to start a container.
+         */
+        image: string;
+        /**
+         * When this parameter is true, you can deploy containerized applications that require stdin or a tty to be allocated.
+         */
+        interactive?: boolean;
+        /**
+         * Linux-specific modifications that are applied to the container. Detailed below.
+         */
+        linuxParameters?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionLinuxParameters;
+        /**
+         * Log configuration specification for the container. Detailed below.
+         */
+        logConfiguration?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionLogConfiguration;
+        /**
+         * Amount (in MiB) of memory to present to the container.
+         */
+        memory?: number;
+        /**
+         * Soft limit (in MiB) of memory to reserve for the container.
+         */
+        memoryReservation?: number;
+        /**
+         * Mount points for data volumes in your container. Detailed below.
+         */
+        mountPoints?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionMountPoint[];
+        /**
+         * Name of a container.
+         */
+        name?: string;
+        /**
+         * When this parameter is true, the container is given elevated privileges on the host container instance.
+         */
+        privileged?: boolean;
+        /**
+         * When this parameter is true, a TTY is allocated.
+         */
+        pseudoTerminal?: boolean;
+        /**
+         * When this parameter is true, the container is given read-only access to its root file system.
+         */
+        readonlyRootFilesystem?: boolean;
+        /**
+         * Private repository authentication credentials to use. Detailed below.
+         */
+        repositoryCredentials?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionRepositoryCredentials;
+        /**
+         * Restart policy for a container. Detailed below.
+         */
+        restartPolicy?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionRestartPolicy;
+        /**
+         * Secrets to pass to the container. Detailed below.
+         */
+        secrets?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionSecret[];
+        /**
+         * Time duration (in seconds) to wait before giving up on resolving dependencies for a container.
+         */
+        startTimeout?: number;
+        /**
+         * Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own.
+         */
+        stopTimeout?: number;
+        /**
+         * List of namespaced kernel parameters to set in the container. Detailed below.
+         */
+        systemControls?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionSystemControl[];
+        /**
+         * List of ulimits to set in the container. Detailed below.
+         */
+        ulimits?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionUlimit[];
+        /**
+         * User to use inside the container.
+         */
+        user: string;
+        /**
+         * Working directory to run commands inside the container.
+         */
+        workingDirectory?: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionDependsOn {
+        /**
+         * Dependency condition of the container. Valid values: `START`, `COMPLETE`, `SUCCESS`, `HEALTHY`.
+         */
+        condition: string;
+        /**
+         * Name of a container.
+         */
+        containerName: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionEnvironment {
+        /**
+         * Name of the environment variable.
+         */
+        name?: string;
+        /**
+         * Value of the environment variable.
+         */
+        value?: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionEnvironmentFile {
+        /**
+         * File type to use. The only supported value is `s3`.
+         */
+        type: string;
+        /**
+         * ARN of the Amazon S3 object containing the environment variable file.
+         */
+        value: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionFirelensConfiguration {
+        /**
+         * Options to use when configuring the log router.
+         */
+        options?: {
+            [key: string]: string;
+        };
+        /**
+         * Log router to use. Valid values: `fluentd`, `fluentbit`.
+         */
+        type: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionHealthCheck {
+        /**
+         * String array representing the command that the container runs to determine if it is healthy.
+         */
+        commands: string[];
+        /**
+         * Time period in seconds between each health check execution. Valid range: 5–300.
+         */
+        interval?: number;
+        /**
+         * Number of times to retry a failed health check. Valid range: 1–10.
+         */
+        retries: number;
+        /**
+         * Grace period in seconds to provide containers time to bootstrap. Valid range: 0–300.
+         */
+        startPeriod?: number;
+        /**
+         * Time period in seconds to wait for a health check to succeed. Valid range: 2–60.
+         */
+        timeout: number;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionLinuxParameters {
+        /**
+         * Linux capabilities for the container. Detailed below.
+         */
+        capabilities?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionLinuxParametersCapabilities;
+        /**
+         * Any host devices to expose to the container. Detailed below.
+         */
+        devices?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionLinuxParametersDevice[];
+        /**
+         * Run an init process inside the container that forwards signals and reaps processes.
+         */
+        initProcessEnabled?: boolean;
+        /**
+         * Container path, mount options, and size of the tmpfs mount. Detailed below.
+         */
+        tmpfs?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionLinuxParametersTmpf[];
+    }
+    interface DaemonTaskDefinitionContainerDefinitionLinuxParametersCapabilities {
+        /**
+         * Linux capabilities for the container that have been added to the default configuration provided by Docker.
+         */
+        adds?: string[];
+        /**
+         * Linux capabilities for the container that have been removed from the default configuration provided by Docker.
+         */
+        drops?: string[];
+    }
+    interface DaemonTaskDefinitionContainerDefinitionLinuxParametersDevice {
+        /**
+         * Path inside the container at which to expose the host device.
+         */
+        containerPath?: string;
+        /**
+         * Path for the device on the host container instance.
+         */
+        hostPath: string;
+        /**
+         * Explicit permissions to provide to the container for the device. Valid values: `read`, `write`, `mknod`.
+         */
+        permissions?: string[];
+    }
+    interface DaemonTaskDefinitionContainerDefinitionLinuxParametersTmpf {
+        /**
+         * Absolute file path where the tmpfs volume is to be mounted.
+         */
+        containerPath: string;
+        /**
+         * List of tmpfs volume mount options.
+         */
+        mountOptions?: string[];
+        /**
+         * Maximum size (in MiB) of the tmpfs volume.
+         */
+        size: number;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionLogConfiguration {
+        /**
+         * Log driver to use for the container. Valid values: `json-file`, `syslog`, `journald`, `gelf`, `fluentd`, `awslogs`, `splunk`, `awsfirelens`.
+         */
+        logDriver: string;
+        /**
+         * Configuration options to send to the log driver.
+         */
+        options?: {
+            [key: string]: string;
+        };
+        /**
+         * Secrets to pass to the log configuration. Detailed below.
+         */
+        secretOptions?: outputs.ecs.DaemonTaskDefinitionContainerDefinitionLogConfigurationSecretOption[];
+    }
+    interface DaemonTaskDefinitionContainerDefinitionLogConfigurationSecretOption {
+        /**
+         * Name of the secret.
+         */
+        name: string;
+        /**
+         * Secret to expose to the log configuration.
+         */
+        valueFrom: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionMountPoint {
+        /**
+         * Path on the container to mount the host volume at.
+         */
+        containerPath?: string;
+        /**
+         * If this value is true, the container has read-only access to the volume.
+         */
+        readOnly?: boolean;
+        /**
+         * Name of the volume to mount.
+         */
+        sourceVolume?: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionRepositoryCredentials {
+        /**
+         * ARN of the secret containing the private repository credentials.
+         */
+        credentialsParameter: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionRestartPolicy {
+        /**
+         * Whether a restart policy is enabled for the container.
+         */
+        enabled: boolean;
+        /**
+         * List of exit codes that Amazon ECS will ignore and not attempt a restart on. Maximum of 50.
+         */
+        ignoredExitCodes?: number[];
+        /**
+         * Period of time (in seconds) that the container must run for before a restart can be attempted. Valid range: 60–1800.
+         */
+        restartAttemptPeriod?: number;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionSecret {
+        /**
+         * Name of the secret.
+         */
+        name: string;
+        /**
+         * Secret to expose to the container. The supported values are either the full ARN of the Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store.
+         */
+        valueFrom: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionSystemControl {
+        /**
+         * Namespaced kernel parameter to set a value for.
+         */
+        namespace?: string;
+        /**
+         * Value for the namespaced kernel parameter.
+         */
+        value?: string;
+    }
+    interface DaemonTaskDefinitionContainerDefinitionUlimit {
+        /**
+         * Hard limit for the ulimit type.
+         */
+        hardLimit: number;
+        /**
+         * Type of the ulimit.
+         */
+        name: string;
+        /**
+         * Soft limit for the ulimit type.
+         */
+        softLimit: number;
+    }
+    interface DaemonTaskDefinitionVolume {
+        /**
+         * Configuration for a host volume. Detailed below.
+         */
+        hosts?: outputs.ecs.DaemonTaskDefinitionVolumeHost[];
+        /**
+         * Name of the volume. This name is referenced in the `sourceVolume` parameter of container definition in the `mountPoints` section.
+         */
+        name: string;
+    }
+    interface DaemonTaskDefinitionVolumeHost {
+        /**
+         * Path on the host container instance that is presented to the container. If not set, ECS will create a non-persistent data volume that starts empty and is deleted after the task has finished.
+         */
+        sourcePath?: string;
+    }
+    interface DaemonTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        update?: string;
+    }
     interface ExpressGatewayServiceIngressPath {
         accessType: string;
         endpoint: string;
@@ -44310,31 +45027,56 @@ export declare namespace elasticbeanstalk {
     }
     interface ConfigurationTemplateSetting {
         /**
-         * A unique name for this Template.
+         * Name of the configuration option
          */
         name: string;
+        /**
+         * Unique namespace identifying the option's associated AWS resource
+         */
         namespace: string;
+        /**
+         * resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+         */
         resource?: string;
+        /**
+         * Value for the configuration option
+         */
         value: string;
     }
     interface EnvironmentAllSetting {
         /**
-         * A unique name for this Environment. This name is used
-         * in the application URL
+         * Name of the configuration option
          */
         name: string;
+        /**
+         * Unique namespace identifying the option's associated AWS resource
+         */
         namespace: string;
+        /**
+         * resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+         */
         resource?: string;
+        /**
+         * Value for the configuration option
+         */
         value: string;
     }
     interface EnvironmentSetting {
         /**
-         * A unique name for this Environment. This name is used
-         * in the application URL
+         * Name of the configuration option
          */
         name: string;
+        /**
+         * Unique namespace identifying the option's associated AWS resource
+         */
         namespace: string;
+        /**
+         * resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+         */
         resource?: string;
+        /**
+         * Value for the configuration option
+         */
         value: string;
     }
     interface GetApplicationAppversionLifecycle {
@@ -45155,6 +45897,8 @@ export declare namespace elb {
         target: string;
         /**
          * The length of time before the check times out.
+         *
+         * > **Note:** If the ARN of the `sslCertificateId` references a certificate signed by an ECDSA key, ELB only supports the P256 and P384 curves. Using a certificate signed by a different curve could produce `ERR_SSL_VERSION_OR_CIPHER_MISMATCH` in your browser.
          */
         timeout: number;
         /**
@@ -45799,7 +46543,7 @@ export declare namespace emr {
     }
     interface InstanceFleetLaunchSpecificationsOnDemandSpecification {
         /**
-         * Specifies one of the following strategies to launch Spot Instance fleets: `price-capacity-optimized`, `capacity-optimized`, `lowest-price`, or `diversified`. For more information on the provisioning strategies, see [Allocation strategies for Spot Instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-fleet-allocation-strategy.html).
+         * Specifies the strategy to use in launching On-Demand instance fleets. Currently, the only option is `lowest-price` (the default), which launches the lowest price first.
          */
         allocationStrategy: string;
     }
@@ -46856,11 +47600,11 @@ export declare namespace fis {
 export declare namespace fms {
     interface PolicyExcludeMap {
         /**
-         * A list of AWS Organization member Accounts that you want to include for this AWS FMS Policy.
+         * A list of AWS Organization member Accounts that you want to exclude from this AWS FMS Policy.
          */
         accounts?: string[];
         /**
-         * A list of IDs of the AWS Organizational Units that you want to include for this AWS FMS Policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
+         * A list of IDs of the AWS Organizational Units that you want to exclude from this AWS FMS Policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
          *
          * You can specify inclusions or exclusions, but not both. If you specify an `includeMap`, AWS Firewall Manager applies the policy to all accounts specified by the `includeMap`, and does not evaluate any `excludeMap` specifications. If you do not specify an `includeMap`, then Firewall Manager applies the policy to all accounts except for those specified by the `excludeMap`.
          */
@@ -46888,7 +47632,7 @@ export declare namespace fms {
          */
         policyOption?: outputs.fms.PolicySecurityServicePolicyDataPolicyOption;
         /**
-         * An integer value containing ICMP type.
+         * The service that the policy is using to protect the resources. For the current list of supported types, please refer to the [AWS Firewall Manager SecurityServicePolicyData API Type Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html#fms-Type-SecurityServicePolicyData-Type).
          */
         type: string;
     }
@@ -47029,14 +47773,11 @@ export declare namespace fms {
     }
     interface PolicySecurityServicePolicyDataPolicyOptionNetworkFirewallPolicy {
         /**
-         * Defines the deployment model to use for the third-party firewall policy. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
+         * Defines the deployment model to use for the firewall policy. To use a distributed model, remove the `policyOption` section. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
          */
         firewallDeploymentModel?: string;
     }
     interface PolicySecurityServicePolicyDataPolicyOptionThirdPartyFirewallPolicy {
-        /**
-         * Defines the deployment model to use for the third-party firewall policy. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
-         */
         firewallDeploymentModel?: string;
     }
     interface ResourceSetResourceSet {
@@ -55079,6 +55820,16 @@ export declare namespace keyspaces {
     }
 }
 export declare namespace kinesis {
+    interface AccountSettingsMinimumThroughputBillingCommitment {
+        earliestAllowedEndAt: string;
+        endedAt: string;
+        startedAt: string;
+        /**
+         * Desired status of the minimum throughput billing commitment. Valid values: `ENABLED`, `DISABLED`.
+         */
+        status: string;
+        statusActual: string;
+    }
     interface AnalyticsApplicationCloudwatchLoggingOptions {
         /**
          * The ARN of the Kinesis Analytics Application.
@@ -57245,6 +57996,16 @@ export declare namespace kinesis {
          */
         streamMode: string;
     }
+    interface GetStreamWarmThroughput {
+        /**
+         * Current warm throughput value on the stream.
+         */
+        currentMibPs: number;
+        /**
+         * Target warm throughput value on the stream.
+         */
+        targetMibPs: number;
+    }
     interface StreamStreamModeDetails {
         /**
          * Specifies the capacity mode of the stream. Must be either `PROVISIONED` or `ON_DEMAND`.
@@ -78796,6 +79557,26 @@ export declare namespace observabilityadmin {
          */
         update?: string;
     }
+    interface S3TableIntegrationEncryption {
+        /**
+         * ARN of the KMS key to use for encryption. Required when `sseAlgorithm` is `aws:kms`.
+         */
+        kmsKeyArn?: string;
+        /**
+         * Server-side encryption algorithm. Valid values: `AES256`, `aws:kms`.
+         */
+        sseAlgorithm: string;
+    }
+    interface S3TableIntegrationTimeouts {
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+         */
+        create?: string;
+        /**
+         * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+         */
+        delete?: string;
+    }
     interface TelemetryEnrichmentTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -78848,16 +79629,246 @@ export declare namespace observabilityadmin {
     }
     interface TelemetryRuleForOrganizationRule {
         /**
-         * AWS resource type to apply the rule to. Currently supported: `AWS::EC2::VPC` with `Logs`.
+         * Whether to replicate the rule to every Region in the partition where CloudWatch Observability Admin is available. Mutually exclusive with `regions`.
+         */
+        allRegions?: boolean;
+        /**
+         * Whether CloudWatch Observability Admin should detect and remediate configuration drift in managed telemetry resources. Currently supported for `AWS::EC2::VPC` resources (VPC flow logs).
+         */
+        allowFieldUpdates?: boolean;
+        /**
+         * Configuration block specifying where and how the telemetry data is delivered. See `destinationConfiguration` below.
+         */
+        destinationConfiguration?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfiguration;
+        /**
+         * Set of Regions to replicate the rule to. Mutually exclusive with `allRegions`. Order is not preserved.
+         */
+        regions: string[];
+        /**
+         * AWS resource type to apply the rule to (for example `AWS::EC2::VPC`, `AWS::EKS::Cluster`, `AWS::WAFv2::WebACL`).
          */
         resourceType?: string;
         /**
-         * Type of telemetry data. Valid values: `Logs`, `Metrics`, `Traces`.
-         *
-         * > **Note:** This resource is currently in early development. Additional resource types and configuration options will be added in future releases.
+         * Organizational scope to which the rule applies, specified using accounts or organizational units.
+         */
+        scope?: string;
+        /**
+         * Criteria for selecting which resources the rule applies to, such as resource tags.
+         */
+        selectionCriteria?: string;
+        /**
+         * List of telemetry source types to configure for the resource (for example `VPC_FLOW_LOGS`, `EKS_AUDIT_LOGS`). Must correlate with the chosen `resourceType`. If not provided, the API may default this value based on `resourceType` (for example `VPC_FLOW_LOGS` for `AWS::EC2::VPC`).
+         */
+        telemetrySourceTypes: string[];
+        /**
+         * Type of telemetry data to collect. Valid values: `Logs`, `Metrics`, `Traces`.
          */
         telemetryType: string;
     }
+    interface TelemetryRuleForOrganizationRuleDestinationConfiguration {
+        /**
+         * CloudTrail-specific parameters when CloudTrail is the source. See `cloudtrailParameters` below.
+         */
+        cloudtrailParameters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationCloudtrailParameters;
+        /**
+         * Pattern used to generate the destination path or name. May contain alphanumeric characters, the macros `<accountId>` and `<resourceId>`, and the symbols `_`, `/`, `-`.
+         */
+        destinationPattern?: string;
+        /**
+         * Destination type for the telemetry data (for example `cloud-watch-logs`).
+         */
+        destinationType?: string;
+        /**
+         * ELB load balancer logging parameters when the resource is an ELB. See `elbLoadBalancerLoggingParameters` below.
+         */
+        elbLoadBalancerLoggingParameters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationElbLoadBalancerLoggingParameters;
+        /**
+         * Amazon Bedrock AgentCore log delivery parameters. See `logDeliveryParameters` below.
+         */
+        logDeliveryParameters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationLogDeliveryParameters;
+        /**
+         * Amazon MSK cluster monitoring parameters. See `mskMonitoringParameters` below.
+         */
+        mskMonitoringParameters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationMskMonitoringParameters;
+        /**
+         * Number of days to retain the telemetry data in the destination.
+         */
+        retentionInDays?: number;
+        /**
+         * VPC Flow Logs-specific parameters when the resource is `AWS::EC2::VPC`. See `vpcFlowLogParameters` below.
+         */
+        vpcFlowLogParameters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationVpcFlowLogParameters;
+        /**
+         * WAF logging parameters when the resource is `AWS::WAFv2::WebACL`. See `wafLoggingParameters` below.
+         */
+        wafLoggingParameters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParameters;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationCloudtrailParameters {
+        /**
+         * List of advanced event selectors used to filter CloudTrail events. See `advancedEventSelectors` below.
+         */
+        advancedEventSelectors?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelector[];
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelector {
+        /**
+         * List of field selectors that compose the selector statement. See `fieldSelectors` below.
+         */
+        fieldSelectors?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelectorFieldSelector[];
+        /**
+         * Descriptive name for the advanced event selector.
+         */
+        name?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelectorFieldSelector {
+        /**
+         * Match if the field value ends with one of the specified values.
+         */
+        endsWiths?: string[];
+        /**
+         * Match if the field value equals one of the specified values.
+         */
+        equals?: string[];
+        /**
+         * Name of the field to use for selection.
+         */
+        field: string;
+        /**
+         * Match if the field value does not end with one of the specified values.
+         */
+        notEndsWiths?: string[];
+        /**
+         * Match if the field value does not equal any of the specified values.
+         */
+        notEquals?: string[];
+        /**
+         * Match if the field value does not start with any of the specified values.
+         */
+        notStartsWiths?: string[];
+        /**
+         * Match if the field value starts with one of the specified values.
+         */
+        startsWiths?: string[];
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationElbLoadBalancerLoggingParameters {
+        /**
+         * Delimiter character used to separate fields in ELB access log entries when using plain text format.
+         */
+        fieldDelimiter?: string;
+        /**
+         * Format for ELB access log entries. Valid values: `plain-text`, `json`.
+         */
+        outputFormat?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationLogDeliveryParameters {
+        /**
+         * List of log types that the source is sending.
+         */
+        logTypes?: string[];
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationMskMonitoringParameters {
+        /**
+         * Level of enhanced monitoring for the MSK cluster. Valid values: `DEFAULT`, `PER_BROKER`, `PER_TOPIC_PER_BROKER`, `PER_TOPIC_PER_PARTITION`.
+         */
+        enhancedMonitoring?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationVpcFlowLogParameters {
+        /**
+         * Format string for VPC Flow Log entries.
+         */
+        logFormat?: string;
+        /**
+         * Maximum interval (in seconds) between the capture of flow log records. Valid values: `60`, `600`.
+         */
+        maxAggregationInterval?: number;
+        /**
+         * Type of traffic to log. Valid values: `ACCEPT`, `REJECT`, `ALL`.
+         */
+        trafficType?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParameters {
+        /**
+         * Type of WAF logs to collect (currently `WAF_LOGS`).
+         */
+        logType?: string;
+        /**
+         * Filter configuration that determines which WAF log records to include or exclude. See `loggingFilter` below.
+         */
+        loggingFilter?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilter;
+        /**
+         * List of fields to redact from WAF logs. See `redactedFields` below.
+         */
+        redactedFields?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersRedactedField[];
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilter {
+        /**
+         * Default action for log records that do not match any filter. Valid values: `KEEP`, `DROP`.
+         */
+        defaultBehavior?: string;
+        /**
+         * List of filter configurations. See `filters` below.
+         */
+        filters?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilter[];
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilter {
+        /**
+         * Action to take for matching log records. Valid values: `KEEP`, `DROP`.
+         */
+        behavior?: string;
+        /**
+         * Conditions that determine if a log record matches this filter. See `conditions` below.
+         */
+        conditions?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterCondition[];
+        /**
+         * Whether the log record must meet all conditions or any condition. Valid values: `MEETS_ALL`, `MEETS_ANY`.
+         */
+        requirement?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterCondition {
+        /**
+         * Condition that matches based on the WAF action. See `actionCondition` below.
+         */
+        actionCondition?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionActionCondition;
+        /**
+         * Condition that matches based on WAF rule labels. See `labelNameCondition` below.
+         */
+        labelNameCondition?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionLabelNameCondition;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionActionCondition {
+        /**
+         * WAF action to match against. Valid values: `ALLOW`, `BLOCK`, `COUNT`, `CAPTCHA`, `CHALLENGE`, `EXCLUDED_AS_COUNT`.
+         */
+        action: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionLabelNameCondition {
+        /**
+         * Label name to match (alphanumeric, underscores, hyphens, and colons; up to 1024 characters).
+         */
+        labelName?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersRedactedField {
+        /**
+         * Redact the HTTP method from WAF logs. Set to an empty string to enable redaction.
+         */
+        method?: string;
+        /**
+         * Redact the entire query string from WAF logs. Set to an empty string to enable redaction.
+         */
+        queryString?: string;
+        /**
+         * Redact a specific header by name from WAF logs. See `singleHeader` below.
+         */
+        singleHeader?: outputs.observabilityadmin.TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersRedactedFieldSingleHeader;
+        /**
+         * Redact the URI path from WAF logs. Set to an empty string to enable redaction.
+         */
+        uriPath?: string;
+    }
+    interface TelemetryRuleForOrganizationRuleDestinationConfigurationWafLoggingParametersRedactedFieldSingleHeader {
+        /**
+         * Header name to redact (up to 64 characters).
+         */
+        name: string;
+    }
     interface TelemetryRuleForOrganizationTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -78874,16 +79885,246 @@ export declare namespace observabilityadmin {
     }
     interface TelemetryRuleRule {
         /**
-         * AWS resource type to apply the rule to. Currently supported: `AWS::EC2::VPC` with `Logs`.
-         *
-         * > **Note:** This resource is currently in early development. Additional resource types and configuration options will be added in future releases.
+         * Whether to replicate the rule to every Region in the partition where CloudWatch Observability Admin is available. Mutually exclusive with `regions`.
+         */
+        allRegions?: boolean;
+        /**
+         * Whether CloudWatch Observability Admin should detect and remediate configuration drift in managed telemetry resources. Currently supported for `AWS::EC2::VPC` resources (VPC flow logs).
+         */
+        allowFieldUpdates?: boolean;
+        /**
+         * Configuration block specifying where and how the telemetry data is delivered. See `destinationConfiguration` below.
+         */
+        destinationConfiguration?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfiguration;
+        /**
+         * Set of Regions to replicate the rule to. Mutually exclusive with `allRegions`. Order is not preserved.
+         */
+        regions: string[];
+        /**
+         * AWS resource type to apply the rule to (for example `AWS::EC2::VPC`, `AWS::EKS::Cluster`, `AWS::WAFv2::WebACL`).
          */
         resourceType?: string;
         /**
-         * Type of telemetry data. Valid values: `Logs`, `Metrics`, `Traces`.
+         * Organizational scope to which the rule applies, specified using accounts or organizational units.
+         */
+        scope?: string;
+        /**
+         * Criteria for selecting which resources the rule applies to, such as resource tags.
+         */
+        selectionCriteria?: string;
+        /**
+         * List of telemetry source types to configure for the resource (for example `VPC_FLOW_LOGS`, `EKS_AUDIT_LOGS`). Must correlate with the chosen `resourceType`. If not provided, the API may default this value based on `resourceType` (for example `VPC_FLOW_LOGS` for `AWS::EC2::VPC`).
+         */
+        telemetrySourceTypes: string[];
+        /**
+         * Type of telemetry data to collect. Valid values: `Logs`, `Metrics`, `Traces`.
          */
         telemetryType: string;
     }
+    interface TelemetryRuleRuleDestinationConfiguration {
+        /**
+         * CloudTrail-specific parameters when CloudTrail is the source. See `cloudtrailParameters` below.
+         */
+        cloudtrailParameters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationCloudtrailParameters;
+        /**
+         * Pattern used to generate the destination path or name. May contain alphanumeric characters, the macros `<accountId>` and `<resourceId>`, and the symbols `_`, `/`, `-`.
+         */
+        destinationPattern?: string;
+        /**
+         * Destination type for the telemetry data (for example `cloud-watch-logs`).
+         */
+        destinationType?: string;
+        /**
+         * ELB load balancer logging parameters when the resource is an ELB. See `elbLoadBalancerLoggingParameters` below.
+         */
+        elbLoadBalancerLoggingParameters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationElbLoadBalancerLoggingParameters;
+        /**
+         * Amazon Bedrock AgentCore log delivery parameters. See `logDeliveryParameters` below.
+         */
+        logDeliveryParameters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationLogDeliveryParameters;
+        /**
+         * Amazon MSK cluster monitoring parameters. See `mskMonitoringParameters` below.
+         */
+        mskMonitoringParameters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationMskMonitoringParameters;
+        /**
+         * Number of days to retain the telemetry data in the destination.
+         */
+        retentionInDays?: number;
+        /**
+         * VPC Flow Logs-specific parameters when the resource is `AWS::EC2::VPC`. See `vpcFlowLogParameters` below.
+         */
+        vpcFlowLogParameters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationVpcFlowLogParameters;
+        /**
+         * WAF logging parameters when the resource is `AWS::WAFv2::WebACL`. See `wafLoggingParameters` below.
+         */
+        wafLoggingParameters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParameters;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationCloudtrailParameters {
+        /**
+         * List of advanced event selectors used to filter CloudTrail events. See `advancedEventSelectors` below.
+         */
+        advancedEventSelectors?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelector[];
+    }
+    interface TelemetryRuleRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelector {
+        /**
+         * List of field selectors that compose the selector statement. See `fieldSelectors` below.
+         */
+        fieldSelectors?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelectorFieldSelector[];
+        /**
+         * Descriptive name for the advanced event selector.
+         */
+        name?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationCloudtrailParametersAdvancedEventSelectorFieldSelector {
+        /**
+         * Match if the field value ends with one of the specified values.
+         */
+        endsWiths?: string[];
+        /**
+         * Match if the field value equals one of the specified values.
+         */
+        equals?: string[];
+        /**
+         * Name of the field to use for selection.
+         */
+        field: string;
+        /**
+         * Match if the field value does not end with one of the specified values.
+         */
+        notEndsWiths?: string[];
+        /**
+         * Match if the field value does not equal any of the specified values.
+         */
+        notEquals?: string[];
+        /**
+         * Match if the field value does not start with any of the specified values.
+         */
+        notStartsWiths?: string[];
+        /**
+         * Match if the field value starts with one of the specified values.
+         */
+        startsWiths?: string[];
+    }
+    interface TelemetryRuleRuleDestinationConfigurationElbLoadBalancerLoggingParameters {
+        /**
+         * Delimiter character used to separate fields in ELB access log entries when using plain text format.
+         */
+        fieldDelimiter?: string;
+        /**
+         * Format for ELB access log entries. Valid values: `plain-text`, `json`.
+         */
+        outputFormat?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationLogDeliveryParameters {
+        /**
+         * List of log types that the source is sending.
+         */
+        logTypes?: string[];
+    }
+    interface TelemetryRuleRuleDestinationConfigurationMskMonitoringParameters {
+        /**
+         * Level of enhanced monitoring for the MSK cluster. Valid values: `DEFAULT`, `PER_BROKER`, `PER_TOPIC_PER_BROKER`, `PER_TOPIC_PER_PARTITION`.
+         */
+        enhancedMonitoring?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationVpcFlowLogParameters {
+        /**
+         * Format string for VPC Flow Log entries.
+         */
+        logFormat?: string;
+        /**
+         * Maximum interval (in seconds) between the capture of flow log records. Valid values: `60`, `600`.
+         */
+        maxAggregationInterval?: number;
+        /**
+         * Type of traffic to log. Valid values: `ACCEPT`, `REJECT`, `ALL`.
+         */
+        trafficType?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParameters {
+        /**
+         * Type of WAF logs to collect (currently `WAF_LOGS`).
+         */
+        logType?: string;
+        /**
+         * Filter configuration that determines which WAF log records to include or exclude. See `loggingFilter` below.
+         */
+        loggingFilter?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilter;
+        /**
+         * List of fields to redact from WAF logs. See `redactedFields` below.
+         */
+        redactedFields?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersRedactedField[];
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilter {
+        /**
+         * Default action for log records that do not match any filter. Valid values: `KEEP`, `DROP`.
+         */
+        defaultBehavior?: string;
+        /**
+         * List of filter configurations. See `filters` below.
+         */
+        filters?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilter[];
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilter {
+        /**
+         * Action to take for matching log records. Valid values: `KEEP`, `DROP`.
+         */
+        behavior?: string;
+        /**
+         * Conditions that determine if a log record matches this filter. See `conditions` below.
+         */
+        conditions?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterCondition[];
+        /**
+         * Whether the log record must meet all conditions or any condition. Valid values: `MEETS_ALL`, `MEETS_ANY`.
+         */
+        requirement?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterCondition {
+        /**
+         * Condition that matches based on the WAF action. See `actionCondition` below.
+         */
+        actionCondition?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionActionCondition;
+        /**
+         * Condition that matches based on WAF rule labels. See `labelNameCondition` below.
+         */
+        labelNameCondition?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionLabelNameCondition;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionActionCondition {
+        /**
+         * WAF action to match against. Valid values: `ALLOW`, `BLOCK`, `COUNT`, `CAPTCHA`, `CHALLENGE`, `EXCLUDED_AS_COUNT`.
+         */
+        action: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersLoggingFilterFilterConditionLabelNameCondition {
+        /**
+         * Label name to match (alphanumeric, underscores, hyphens, and colons; up to 1024 characters).
+         */
+        labelName?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersRedactedField {
+        /**
+         * Redact the HTTP method from WAF logs. Set to an empty string to enable redaction.
+         */
+        method?: string;
+        /**
+         * Redact the entire query string from WAF logs. Set to an empty string to enable redaction.
+         */
+        queryString?: string;
+        /**
+         * Redact a specific header by name from WAF logs. See `singleHeader` below.
+         */
+        singleHeader?: outputs.observabilityadmin.TelemetryRuleRuleDestinationConfigurationWafLoggingParametersRedactedFieldSingleHeader;
+        /**
+         * Redact the URI path from WAF logs. Set to an empty string to enable redaction.
+         */
+        uriPath?: string;
+    }
+    interface TelemetryRuleRuleDestinationConfigurationWafLoggingParametersRedactedFieldSingleHeader {
+        /**
+         * Header name to redact (up to 64 characters).
+         */
+        name: string;
+    }
     interface TelemetryRuleTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -79791,7 +81032,11 @@ export declare namespace opensearch {
          */
         enabled: boolean;
         /**
-         * PEM-encoded public key used to verify JWT signatures.
+         * URL endpoint that hosts the JSON Web Key Set (JWKS) containing public keys used to verify JWT signatures. This argument can be specified only with OpenSearch versions 3.3 and later. At least one of `jwksUrl` or `publicKey` must be specified when `enabled` is set to `true`.
+         */
+        jwksUrl?: string;
+        /**
+         * PEM-encoded public key used to verify JWT signatures. At least one of `jwksUrl` or `publicKey` must be specified when `enabled` is set to `true`. If both `jwksUrl` and `publicKey` are specified, `publicKey` is ignored.
          */
         publicKey: string;
         /**
@@ -80209,6 +81454,10 @@ export declare namespace opensearch {
          * Enabled disabled toggle for off-peak update window
          */
         enabled: boolean;
+        /**
+         * URL endpoint that hosts the JSON Web Key Set (JWKS) containing public keys used to verify JWT signatures.
+         */
+        jwksUrl: string;
         /**
          * PEM-encoded public key used to verify JWT signatures.
          */
@@ -81321,6 +82570,32 @@ export declare namespace pinpoint {
          */
         value?: string;
     }
+    interface Smsvoicev2EventDestinationCloudwatchLogsDestination {
+        /**
+         * ARN of the IAM role that End User Messaging SMS assumes to write to the log group.
+         */
+        iamRoleArn: string;
+        /**
+         * ARN of the Amazon CloudWatch log group that receives the events.
+         */
+        logGroupArn: string;
+    }
+    interface Smsvoicev2EventDestinationKinesisFirehoseDestination {
+        /**
+         * ARN of the Amazon Data Firehose delivery stream that receives the events.
+         */
+        deliveryStreamArn: string;
+        /**
+         * ARN of the IAM role that End User Messaging SMS assumes to write to the delivery stream.
+         */
+        iamRoleArn: string;
+    }
+    interface Smsvoicev2EventDestinationSnsDestination {
+        /**
+         * ARN of the Amazon SNS topic that receives the events.
+         */
+        topicArn: string;
+    }
     interface Smsvoicev2PhoneNumberTimeouts {
         /**
          * A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
@@ -100242,6 +101517,10 @@ export declare namespace ssm {
         syncFormat?: string;
     }
     interface ResourceDataSyncS3DestinationDestinationDataSharing {
+        /**
+         * Data sharing type.
+         * Only `Organization` is supported.
+         */
         destinationDataSharingType?: string;
     }
 }
@@ -103238,7 +104517,295 @@ export declare namespace waf {
         /**
          * Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
          */
-        action: outputs.waf.RuleGroupActivatedRuleAction;
+        action: outputs.waf.RuleGroupActivatedRuleAction;
+        /**
+         * Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
+         */
+        priority: number;
+        /**
+         * The ID of a rule
+         */
+        ruleId: string;
+        type?: string;
+    }
+    interface RuleGroupActivatedRuleAction {
+        type: string;
+    }
+    interface RulePredicate {
+        /**
+         * A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+         */
+        dataId: string;
+        /**
+         * Set this to `false` if you want to allow, block, or count requests
+         * based on the settings in the specified waf_byte_match_set, waf_ipset, aws_waf_size_constraint_set, aws.waf.SqlInjectionMatchSet or aws_waf_xss_match_set.
+         * For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
+         * If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses except `192.0.2.44`.
+         */
+        negated: boolean;
+        /**
+         * The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
+         */
+        type: string;
+    }
+    interface SizeConstraintSetSizeConstraint {
+        /**
+         * Type of comparison you want to perform, such as `EQ`, `NE`, `LT`, or `GT`. Please refer to the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraint.html) for a complete list of supported values.
+         */
+        comparisonOperator: string;
+        /**
+         * Parameter that specifies where in a web request to look for the size constraint.
+         */
+        fieldToMatch: outputs.waf.SizeConstraintSetSizeConstraintFieldToMatch;
+        /**
+         * Size in bytes that you want to compare against the size of the specified `fieldToMatch`. Valid values for `size` are between 0 and 21474836480 bytes (0 and 20 GB).
+         */
+        size: number;
+        /**
+         * Parameter is used to eliminate unusual formatting that attackers may use in web requests to bypass AWS WAF. When a transformation is specified, AWS WAF performs the transformation on the `fieldToMatch` before inspecting the request for a match. Some examples of supported transformations are `CMD_LINE`, `HTML_ENTITY_DECODE`, and `NONE`. You can find a complete list of supported values in the [AWS WAF API Reference](http://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraint.html#WAF-Type-SizeConstraint-TextTransformation).
+         * **Note:** If you choose `BODY` as the `type`, you must also choose `NONE` because CloudFront only forwards the first 8192 bytes for inspection.
+         */
+        textTransformation: string;
+    }
+    interface SizeConstraintSetSizeConstraintFieldToMatch {
+        /**
+         * When the `type` is `HEADER`, specify the name of the header that you want to search using the `data` field, for example, `User-Agent` or `Referer`. If the `type` is any other value, you can omit this field.
+         */
+        data?: string;
+        /**
+         * Part of the web request that you want AWS WAF to search for a specified string. For example, `HEADER`, `METHOD`, or `BODY`. See the [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) for all supported values.
+         */
+        type: string;
+    }
+    interface SqlInjectionMatchSetSqlInjectionMatchTuple {
+        /**
+         * Specifies where in a web request to look for snippets of malicious SQL code.
+         */
+        fieldToMatch: outputs.waf.SqlInjectionMatchSetSqlInjectionMatchTupleFieldToMatch;
+        /**
+         * Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+         * If you specify a transformation, AWS WAF performs the transformation on `fieldToMatch` before inspecting a request for a match.
+         * e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SqlInjectionMatchTuple.html#WAF-Type-SqlInjectionMatchTuple-TextTransformation)
+         * for all supported values.
+         */
+        textTransformation: string;
+    }
+    interface SqlInjectionMatchSetSqlInjectionMatchTupleFieldToMatch {
+        /**
+         * When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+         * If `type` is any other value, omit this field.
+         */
+        data?: string;
+        /**
+         * The part of the web request that you want AWS WAF to search for a specified string.
+         * e.g., `HEADER`, `METHOD` or `BODY`.
+         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+         * for all supported values.
+         */
+        type: string;
+    }
+    interface WebAclDefaultAction {
+        /**
+         * Specifies how you want AWS WAF to respond to requests that don't match the criteria in any of the `rules`.
+         * e.g., `ALLOW` or `BLOCK`
+         */
+        type: string;
+    }
+    interface WebAclLoggingConfiguration {
+        /**
+         * Amazon Resource Name (ARN) of Kinesis Firehose Delivery Stream
+         */
+        logDestination: string;
+        /**
+         * Configuration block containing parts of the request that you want redacted from the logs. Detailed below.
+         */
+        redactedFields?: outputs.waf.WebAclLoggingConfigurationRedactedFields;
+    }
+    interface WebAclLoggingConfigurationRedactedFields {
+        /**
+         * Set of configuration blocks for fields to redact. Detailed below.
+         */
+        fieldToMatches: outputs.waf.WebAclLoggingConfigurationRedactedFieldsFieldToMatch[];
+    }
+    interface WebAclLoggingConfigurationRedactedFieldsFieldToMatch {
+        /**
+         * When the value of `type` is `HEADER`, enter the name of the header that you want the WAF to search, for example, `User-Agent` or `Referer`. If the value of `type` is any other value, omit `data`.
+         */
+        data?: string;
+        /**
+         * The part of the web request that you want AWS WAF to search for a specified stringE.g., `HEADER` or `METHOD`
+         */
+        type: string;
+    }
+    interface WebAclRule {
+        /**
+         * The action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Not used if `type` is `GROUP`.
+         */
+        action?: outputs.waf.WebAclRuleAction;
+        /**
+         * Override the action that a group requests CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Only used if `type` is `GROUP`.
+         */
+        overrideAction?: outputs.waf.WebAclRuleOverrideAction;
+        /**
+         * Specifies the order in which the rules in a WebACL are evaluated.
+         * Rules with a lower value are evaluated before rules with a higher value.
+         */
+        priority: number;
+        /**
+         * ID of the associated WAF (Global) rule (e.g., `aws.waf.Rule`). WAF (Regional) rules cannot be used.
+         */
+        ruleId: string;
+        /**
+         * The rule type, either `REGULAR`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `RATE_BASED`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `GROUP`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `RATE_BASED`. If you add a GROUP rule, you need to set `type` as `GROUP`.
+         */
+        type?: string;
+    }
+    interface WebAclRuleAction {
+        /**
+         * valid values are: `BLOCK`, `ALLOW`, or `COUNT`
+         */
+        type: string;
+    }
+    interface WebAclRuleOverrideAction {
+        /**
+         * valid values are: `NONE` or `COUNT`
+         */
+        type: string;
+    }
+    interface XssMatchSetXssMatchTuple {
+        /**
+         * Specifies where in a web request to look for cross-site scripting attacks.
+         */
+        fieldToMatch: outputs.waf.XssMatchSetXssMatchTupleFieldToMatch;
+        /**
+         * Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+         * If you specify a transformation, AWS WAF performs the transformation on `targetString` before inspecting a request for a match.
+         * e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_XssMatchTuple.html#WAF-Type-XssMatchTuple-TextTransformation)
+         * for all supported values.
+         */
+        textTransformation: string;
+    }
+    interface XssMatchSetXssMatchTupleFieldToMatch {
+        /**
+         * When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+         * If `type` is any other value, omit this field.
+         */
+        data?: string;
+        /**
+         * The part of the web request that you want AWS WAF to search for a specified string.
+         * e.g., `HEADER`, `METHOD` or `BODY`.
+         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+         * for all supported values.
+         */
+        type: string;
+    }
+}
+export declare namespace wafregional {
+    interface ByteMatchSetByteMatchTuple {
+        /**
+         * Settings for the ByteMatchTuple. FieldToMatch documented below.
+         */
+        fieldToMatch: outputs.wafregional.ByteMatchSetByteMatchTupleFieldToMatch;
+        /**
+         * Within the portion of a web request that you want to search.
+         */
+        positionalConstraint: string;
+        /**
+         * The value that you want AWS WAF to search for. The maximum length of the value is 50 bytes.
+         */
+        targetString?: string;
+        /**
+         * The formatting way for web request.
+         *
+         * FieldToMatch(field_to_match) support following:
+         */
+        textTransformation: string;
+    }
+    interface ByteMatchSetByteMatchTupleFieldToMatch {
+        /**
+         * When the value of Type is HEADER, enter the name of the header that you want AWS WAF to search, for example, User-Agent or Referer. If the value of Type is any other value, omit Data.
+         */
+        data?: string;
+        /**
+         * The part of the web request that you want AWS WAF to search for a specified string.
+         */
+        type: string;
+    }
+    interface GeoMatchSetGeoMatchConstraint {
+        /**
+         * Type of geographical area you want AWS WAF to search for. Currently `Country` is the only valid value.
+         */
+        type: string;
+        /**
+         * Two-letter country code that you want AWS WAF to search for, e.g., `US`, `CA`, `RU`, `CN`. See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
+         */
+        value: string;
+    }
+    interface IpSetIpSetDescriptor {
+        /**
+         * The string like IPV4 or IPV6.
+         */
+        type: string;
+        /**
+         * The CIDR notation.
+         */
+        value: string;
+    }
+    interface RateBasedRulePredicate {
+        /**
+         * A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+         */
+        dataId: string;
+        /**
+         * Set this to `false` if you want to allow, block, or count requests
+         * based on the settings in the specified `ByteMatchSet`, `IPSet`, `SqlInjectionMatchSet`, `XssMatchSet`, or `SizeConstraintSet`.
+         * For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
+         * If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses _except_ `192.0.2.44`.
+         */
+        negated: boolean;
+        /**
+         * The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
+         */
+        type: string;
+    }
+    interface RegexMatchSetRegexMatchTuple {
+        /**
+         * The part of a web request that you want to search, such as a specified header or a query string.
+         */
+        fieldToMatch: outputs.wafregional.RegexMatchSetRegexMatchTupleFieldToMatch;
+        /**
+         * The ID of a Regex Pattern Set.
+         */
+        regexPatternSetId: string;
+        /**
+         * Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+         * e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+         * for all supported values.
+         */
+        textTransformation: string;
+    }
+    interface RegexMatchSetRegexMatchTupleFieldToMatch {
+        /**
+         * When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+         * If `type` is any other value, omit this field.
+         */
+        data?: string;
+        /**
+         * The part of the web request that you want AWS WAF to search for a specified string.
+         * e.g., `HEADER`, `METHOD` or `BODY`.
+         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+         * for all supported values.
+         */
+        type: string;
+    }
+    interface RuleGroupActivatedRule {
+        /**
+         * Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
+         */
+        action: outputs.wafregional.RuleGroupActivatedRuleAction;
         /**
          * Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
          */
@@ -103254,297 +104821,16 @@ export declare namespace waf {
     }
     interface RulePredicate {
         /**
-         * A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
-         */
-        dataId: string;
-        /**
-         * Set this to `false` if you want to allow, block, or count requests
-         * based on the settings in the specified waf_byte_match_set, waf_ipset, aws_waf_size_constraint_set, aws.waf.SqlInjectionMatchSet or aws_waf_xss_match_set.
-         * For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
-         * If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses except `192.0.2.44`.
-         */
-        negated: boolean;
-        /**
-         * The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
-         */
-        type: string;
-    }
-    interface SizeConstraintSetSizeConstraint {
-        /**
-         * Type of comparison you want to perform, such as `EQ`, `NE`, `LT`, or `GT`. Please refer to the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraint.html) for a complete list of supported values.
-         */
-        comparisonOperator: string;
-        /**
-         * Parameter that specifies where in a web request to look for the size constraint.
-         */
-        fieldToMatch: outputs.waf.SizeConstraintSetSizeConstraintFieldToMatch;
-        /**
-         * Size in bytes that you want to compare against the size of the specified `fieldToMatch`. Valid values for `size` are between 0 and 21474836480 bytes (0 and 20 GB).
-         */
-        size: number;
-        /**
-         * Parameter is used to eliminate unusual formatting that attackers may use in web requests to bypass AWS WAF. When a transformation is specified, AWS WAF performs the transformation on the `fieldToMatch` before inspecting the request for a match. Some examples of supported transformations are `CMD_LINE`, `HTML_ENTITY_DECODE`, and `NONE`. You can find a complete list of supported values in the [AWS WAF API Reference](http://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraint.html#WAF-Type-SizeConstraint-TextTransformation).
-         * **Note:** If you choose `BODY` as the `type`, you must also choose `NONE` because CloudFront only forwards the first 8192 bytes for inspection.
-         */
-        textTransformation: string;
-    }
-    interface SizeConstraintSetSizeConstraintFieldToMatch {
-        /**
-         * When the `type` is `HEADER`, specify the name of the header that you want to search using the `data` field, for example, `User-Agent` or `Referer`. If the `type` is any other value, you can omit this field.
-         */
-        data?: string;
-        /**
-         * Part of the web request that you want AWS WAF to search for a specified string. For example, `HEADER`, `METHOD`, or `BODY`. See the [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) for all supported values.
-         */
-        type: string;
-    }
-    interface SqlInjectionMatchSetSqlInjectionMatchTuple {
-        /**
-         * Specifies where in a web request to look for snippets of malicious SQL code.
-         */
-        fieldToMatch: outputs.waf.SqlInjectionMatchSetSqlInjectionMatchTupleFieldToMatch;
-        /**
-         * Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
-         * If you specify a transformation, AWS WAF performs the transformation on `fieldToMatch` before inspecting a request for a match.
-         * e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
-         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SqlInjectionMatchTuple.html#WAF-Type-SqlInjectionMatchTuple-TextTransformation)
-         * for all supported values.
-         */
-        textTransformation: string;
-    }
-    interface SqlInjectionMatchSetSqlInjectionMatchTupleFieldToMatch {
-        /**
-         * When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
-         * If `type` is any other value, omit this field.
-         */
-        data?: string;
-        /**
-         * The part of the web request that you want AWS WAF to search for a specified string.
-         * e.g., `HEADER`, `METHOD` or `BODY`.
-         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
-         * for all supported values.
-         */
-        type: string;
-    }
-    interface WebAclDefaultAction {
-        /**
-         * Specifies how you want AWS WAF to respond to requests that don't match the criteria in any of the `rules`.
-         * e.g., `ALLOW` or `BLOCK`
-         */
-        type: string;
-    }
-    interface WebAclLoggingConfiguration {
-        /**
-         * Amazon Resource Name (ARN) of Kinesis Firehose Delivery Stream
-         */
-        logDestination: string;
-        /**
-         * Configuration block containing parts of the request that you want redacted from the logs. Detailed below.
-         */
-        redactedFields?: outputs.waf.WebAclLoggingConfigurationRedactedFields;
-    }
-    interface WebAclLoggingConfigurationRedactedFields {
-        /**
-         * Set of configuration blocks for fields to redact. Detailed below.
-         */
-        fieldToMatches: outputs.waf.WebAclLoggingConfigurationRedactedFieldsFieldToMatch[];
-    }
-    interface WebAclLoggingConfigurationRedactedFieldsFieldToMatch {
-        /**
-         * When the value of `type` is `HEADER`, enter the name of the header that you want the WAF to search, for example, `User-Agent` or `Referer`. If the value of `type` is any other value, omit `data`.
-         */
-        data?: string;
-        /**
-         * The part of the web request that you want AWS WAF to search for a specified stringE.g., `HEADER` or `METHOD`
-         */
-        type: string;
-    }
-    interface WebAclRule {
-        /**
-         * The action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Not used if `type` is `GROUP`.
-         */
-        action?: outputs.waf.WebAclRuleAction;
-        /**
-         * Override the action that a group requests CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Only used if `type` is `GROUP`.
-         */
-        overrideAction?: outputs.waf.WebAclRuleOverrideAction;
-        /**
-         * Specifies the order in which the rules in a WebACL are evaluated.
-         * Rules with a lower value are evaluated before rules with a higher value.
-         */
-        priority: number;
-        /**
-         * ID of the associated WAF (Global) rule (e.g., `aws.waf.Rule`). WAF (Regional) rules cannot be used.
-         */
-        ruleId: string;
-        /**
-         * The rule type, either `REGULAR`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `RATE_BASED`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `GROUP`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `RATE_BASED`. If you add a GROUP rule, you need to set `type` as `GROUP`.
-         */
-        type?: string;
-    }
-    interface WebAclRuleAction {
-        /**
-         * valid values are: `BLOCK`, `ALLOW`, or `COUNT`
-         */
-        type: string;
-    }
-    interface WebAclRuleOverrideAction {
-        /**
-         * valid values are: `NONE` or `COUNT`
-         */
-        type: string;
-    }
-    interface XssMatchSetXssMatchTuple {
-        /**
-         * Specifies where in a web request to look for cross-site scripting attacks.
-         */
-        fieldToMatch: outputs.waf.XssMatchSetXssMatchTupleFieldToMatch;
-        /**
-         * Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
-         * If you specify a transformation, AWS WAF performs the transformation on `targetString` before inspecting a request for a match.
-         * e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
-         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_XssMatchTuple.html#WAF-Type-XssMatchTuple-TextTransformation)
-         * for all supported values.
-         */
-        textTransformation: string;
-    }
-    interface XssMatchSetXssMatchTupleFieldToMatch {
-        /**
-         * When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
-         * If `type` is any other value, omit this field.
-         */
-        data?: string;
-        /**
-         * The part of the web request that you want AWS WAF to search for a specified string.
-         * e.g., `HEADER`, `METHOD` or `BODY`.
-         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
-         * for all supported values.
-         */
-        type: string;
-    }
-}
-export declare namespace wafregional {
-    interface ByteMatchSetByteMatchTuple {
-        /**
-         * Settings for the ByteMatchTuple. FieldToMatch documented below.
-         */
-        fieldToMatch: outputs.wafregional.ByteMatchSetByteMatchTupleFieldToMatch;
-        /**
-         * Within the portion of a web request that you want to search.
-         */
-        positionalConstraint: string;
-        /**
-         * The value that you want AWS WAF to search for. The maximum length of the value is 50 bytes.
-         */
-        targetString?: string;
-        /**
-         * The formatting way for web request.
-         *
-         * FieldToMatch(field_to_match) support following:
-         */
-        textTransformation: string;
-    }
-    interface ByteMatchSetByteMatchTupleFieldToMatch {
-        /**
-         * When the value of Type is HEADER, enter the name of the header that you want AWS WAF to search, for example, User-Agent or Referer. If the value of Type is any other value, omit Data.
-         */
-        data?: string;
-        /**
-         * The part of the web request that you want AWS WAF to search for a specified string.
-         */
-        type: string;
-    }
-    interface GeoMatchSetGeoMatchConstraint {
-        /**
-         * The type of geographical area you want AWS WAF to search for. Currently Country is the only valid value.
-         */
-        type: string;
-        /**
-         * The country that you want AWS WAF to search for.
-         * This is the two-letter country code, e.g., `US`, `CA`, `RU`, `CN`, etc.
-         * See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
-         */
-        value: string;
-    }
-    interface IpSetIpSetDescriptor {
-        /**
-         * The string like IPV4 or IPV6.
-         */
-        type: string;
-        /**
-         * The CIDR notation.
-         */
-        value: string;
-    }
-    interface RateBasedRulePredicate {
-        /**
-         * A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+         * The unique identifier of a predicate, such as the ID of a `ByteMatchSet` or `IPSet`.
          */
         dataId: string;
         /**
-         * Set this to `false` if you want to allow, block, or count requests
-         * based on the settings in the specified `ByteMatchSet`, `IPSet`, `SqlInjectionMatchSet`, `XssMatchSet`, or `SizeConstraintSet`.
-         * For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
-         * If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses _except_ `192.0.2.44`.
+         * Whether to use the settings or the negated settings that you specified in the objects.
          */
         negated: boolean;
         /**
-         * The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
-         */
-        type: string;
-    }
-    interface RegexMatchSetRegexMatchTuple {
-        /**
-         * The part of a web request that you want to search, such as a specified header or a query string.
-         */
-        fieldToMatch: outputs.wafregional.RegexMatchSetRegexMatchTupleFieldToMatch;
-        /**
-         * The ID of a Regex Pattern Set.
-         */
-        regexPatternSetId: string;
-        /**
-         * Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
-         * e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
-         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
-         * for all supported values.
-         */
-        textTransformation: string;
-    }
-    interface RegexMatchSetRegexMatchTupleFieldToMatch {
-        /**
-         * When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
-         * If `type` is any other value, omit this field.
-         */
-        data?: string;
-        /**
-         * The part of the web request that you want AWS WAF to search for a specified string.
-         * e.g., `HEADER`, `METHOD` or `BODY`.
-         * See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
-         * for all supported values.
-         */
-        type: string;
-    }
-    interface RuleGroupActivatedRule {
-        /**
-         * Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
-         */
-        action: outputs.wafregional.RuleGroupActivatedRuleAction;
-        /**
-         * Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
+         * The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`
          */
-        priority: number;
-        /**
-         * The ID of a rule
-         */
-        ruleId: string;
-        type?: string;
-    }
-    interface RuleGroupActivatedRuleAction {
-        type: string;
-    }
-    interface RulePredicate {
-        dataId: string;
-        negated: boolean;
         type: string;
     }
     interface SizeConstraintSetSizeConstraint {
@@ -128284,9 +129570,6 @@ export declare namespace xray {
         probabilistic?: outputs.xray.IndexingRuleRuleProbabilistic;
     }
     interface IndexingRuleRuleProbabilistic {
-        /**
-         * Applied sampling percentage of traceIds.
-         */
         actualSamplingPercentage: number;
         /**
          * Configured sampling percentage of traceIds.