@pulumi/aws 7.52.1 → 7.53.0-alpha.1793427939

package/types/input.d.ts

@@ -286,6 +286,10 @@ export interface ProviderEndpoint {
      * Use this to override the default service endpoint URL
      */
     bedrockagentcore?: pulumi.Input<string | undefined>;
+    /**
+     * Use this to override the default service endpoint URL
+     */
+    bedrockdataautomation?: pulumi.Input<string | undefined>;
     /**
      * Use this to override the default service endpoint URL
      */
@@ -1258,6 +1262,10 @@ export interface ProviderEndpoint {
      * Use this to override the default service endpoint URL
      */
     securityhub?: pulumi.Input<string | undefined>;
+    /**
+     * Use this to override the default service endpoint URL
+     */
+    securityir?: pulumi.Input<string | undefined>;
     /**
      * Use this to override the default service endpoint URL
      */
@@ -11807,6 +11815,10 @@ export declare namespace backup {
         recoveryPointTags?: pulumi.Input<{
             [key: string]: pulumi.Input<string>;
         } | undefined>;
+        /**
+         * Uniquely identifies a rule that is used to schedule the backup of a selection of resources.
+         */
+        ruleId?: pulumi.Input<string | undefined>;
         /**
          * Display name for a backup rule.
          */
@@ -12640,6 +12652,10 @@ export declare namespace bcmdata {
          * Name of the Amazon S3 bucket used as the destination of a data export file.
          */
         s3Bucket: pulumi.Input<string>;
+        /**
+         * AWS account ID of the bucket owner. Set this for cross-account S3 delivery.
+         */
+        s3BucketOwner?: pulumi.Input<string | undefined>;
         /**
          * Output configuration for the data export. See the `s3OutputConfigurations` block below.
          */
@@ -25543,6 +25559,9 @@ export declare namespace cloudwatch {
         source?: pulumi.Input<string | undefined>;
     }
     interface LogTransformerTransformerConfigParseToOcsf {
+        /**
+         * Specifies the service or process that produces the log events. Allowed values are: `CloudTrail`, `Route53Resolver`, `VPCFlow`, `EKSAudit`, and `AWSWAF`.
+         */
         eventSource: pulumi.Input<string>;
         /**
          * Specifies the version of the OCSF schema to use for the transformed log events. The only allowed value is `V1.1`.
@@ -25939,6 +25958,18 @@ export declare namespace cloudwatchomni {
          */
         identityCenterInstanceArn: pulumi.Input<string>;
     }
+    interface OrganizationDomainIdentityProviderConfiguration {
+        /**
+         * IAM Identity Center configuration. See below.
+         */
+        identityCenterConfiguration: pulumi.Input<inputs.cloudwatchomni.OrganizationDomainIdentityProviderConfigurationIdentityCenterConfiguration>;
+    }
+    interface OrganizationDomainIdentityProviderConfigurationIdentityCenterConfiguration {
+        /**
+         * ARN of the IAM Identity Center instance.
+         */
+        identityCenterInstanceArn: pulumi.Input<string>;
+    }
     interface SpaceEncryptionConfiguration {
         /**
          * Encryption strategy. Valid values are `AWS_OWNED` and `CUSTOMER_MANAGED`.
@@ -32057,6 +32088,58 @@ export declare namespace devicefarm {
         vpcId: pulumi.Input<string>;
     }
 }
+export declare namespace devopsagent {
+    interface AssetContent {
+        /**
+         * Single file to add or replace. See `file` Block below.
+         */
+        file?: pulumi.Input<inputs.devopsagent.AssetContentFile | undefined>;
+        /**
+         * Source URL to import. See `sourceUrl` Block below.
+         */
+        sourceUrl?: pulumi.Input<inputs.devopsagent.AssetContentSourceUrl | undefined>;
+        /**
+         * ZIP archive containing asset files. See `zip` Block below.
+         */
+        zip?: pulumi.Input<inputs.devopsagent.AssetContentZip | undefined>;
+    }
+    interface AssetContentFile {
+        /**
+         * File content. See `body` Block below.
+         */
+        body: pulumi.Input<inputs.devopsagent.AssetContentFileBody>;
+        /**
+         * JSON metadata for the file.
+         */
+        metadata?: pulumi.Input<string | undefined>;
+        /**
+         * Path of the file within the asset.
+         */
+        path: pulumi.Input<string>;
+    }
+    interface AssetContentFileBody {
+        /**
+         * Base64-encoded binary file content.
+         */
+        bytes?: pulumi.Input<string | undefined>;
+        /**
+         * Text file content.
+         */
+        text?: pulumi.Input<string | undefined>;
+    }
+    interface AssetContentSourceUrl {
+        /**
+         * Source URL from which to import asset content.
+         */
+        url: pulumi.Input<string>;
+    }
+    interface AssetContentZip {
+        /**
+         * Base64-encoded ZIP archive. Use `filebase64()` to load a local ZIP file.
+         */
+        zipFile: pulumi.Input<string>;
+    }
+}
 export declare namespace devopsguru {
     interface EventSourcesConfigEventSource {
         /**
@@ -56908,8 +56991,14 @@ export declare namespace lambda {
          * Maximum execution time in seconds for the durable function. Valid value between 1 and 31622400 (366 days).
          */
         executionTimeout: pulumi.Input<number>;
+        /**
+         * ARN of the KMS customer managed key used to encrypt the durable function's execution state (input, output, and error payloads). If not specified, the execution state is encrypted with an AWS managed key. Changing this value applies the new key to executions that start after the change; executions already in progress continue to use the key they started with. Note that the top-level `kmsKeyArn` argument is not used for durable function state encryption.
+         */
+        kmsKeyArn?: pulumi.Input<string | undefined>;
         /**
          * Number of days to retain the function's execution state. Valid value between 1 and 90. If not specified, the function's execution state is not retained. Defaults to 14.
+         *
+         * > **NOTE:** When `kmsKeyArn` is set, the KMS key policy must grant the Lambda service (`lambda.amazonaws.com`) permission to use the key (`kms:Decrypt`, `kms:GenerateDataKey`, and `kms:DescribeKey`); otherwise function creation fails with a KMS `AccessDeniedException`. The key must be a symmetric encryption key in the same region as the function. The key can be changed in place after creation: the new key applies only to executions that start after the change, while executions already in progress continue to use the key they started with.
          */
         retentionPeriod?: pulumi.Input<number | undefined>;
     }
@@ -72346,6 +72435,10 @@ export declare namespace medialive {
          * Output groups for the channel. See `outputGroups` Block for details.
          */
         outputGroups: pulumi.Input<pulumi.Input<inputs.medialive.ChannelEncoderSettingsOutputGroup>[]>;
+        /**
+         * Thumbnail configuration settings. See `thumbnailConfiguration` Block for details.
+         */
+        thumbnailConfiguration?: pulumi.Input<inputs.medialive.ChannelEncoderSettingsThumbnailConfiguration | undefined>;
         /**
          * Settings used to acquire and adjust timecode information from inputs. See `timecodeConfig` Block for details.
          */
@@ -74525,6 +74618,12 @@ export declare namespace medialive {
          */
         rowLength?: pulumi.Input<number | undefined>;
     }
+    interface ChannelEncoderSettingsThumbnailConfiguration {
+        /**
+         * Enables the thumbnail feature, which generates thumbnails of the incoming video in each pipeline in the channel. Valid values are `AUTO` and `DISABLED`.
+         */
+        state: pulumi.Input<string>;
+    }
     interface ChannelEncoderSettingsTimecodeConfig {
         /**
          * Source for the timecode associated with the event outputs.
@@ -77154,6 +77253,10 @@ export declare namespace networkfirewall {
          * . Contains variables that you can use to override default Suricata settings in your firewall policy. See Rule Variables for details.
          */
         policyVariables?: pulumi.Input<inputs.networkfirewall.FirewallPolicyFirewallPolicyPolicyVariables | undefined>;
+        /**
+         * Resolved IP validation settings, which check that a connection's destination IP address was returned by the Route 53 Resolver in a VPC associated with a DNS Firewall rule group. See Route 53 Resolved IP Validation below for details.
+         */
+        route53ResolvedIpValidation?: pulumi.Input<inputs.networkfirewall.FirewallPolicyFirewallPolicyRoute53ResolvedIpValidation | undefined>;
         /**
          * Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `statefulEngineOptions` block with a `ruleOrder` value of `STRICT_ORDER`. Value values: `aws:drop_strict`, `aws:drop_established`, `aws:drop_established_app_layer`, `aws:alert_strict`, ` aws:alert_established,  `aws:alert_established_app_layer`. For more information, see [Strict evaluation order](https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html#suricata-strict-rule-evaluation-order.html) in the AWS Network Firewall Developer Guide.
          */
@@ -77208,6 +77311,32 @@ export declare namespace networkfirewall {
          */
         definitions: pulumi.Input<pulumi.Input<string>[]>;
     }
+    interface FirewallPolicyFirewallPolicyRoute53ResolvedIpValidation {
+        /**
+         * Action to take on connections that fail validation. Allowed values are: `ALERT`, `DROP`, and `REJECT`. `ALERT` requires firewall logging. `REJECT` sends a TCP reset; Network Firewall drops non-TCP traffic.
+         */
+        action: pulumi.Input<string>;
+        /**
+         * Set of destination IPv4 or IPv6 CIDR blocks that are exempt from the policy-level check. Use `/32` or `/128` for a single address. Valid number of entries is between `1` and `100`. Doesn't affect rules that use the `AWS_ROUTE_53_RESOLVED_DOMAIN` target type.
+         */
+        bypassDestinationValidationIpRanges?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+        /**
+         * Action to take when the recorded DNS resolution has expired from the resolved IP cache but traffic continues. Allowed values are: `CONTINUE`, `DROP`, and `REJECT`. `CONTINUE` treats the expired resolution as valid.
+         */
+        dnsExpiryExceptionPolicy: pulumi.Input<string>;
+        /**
+         * ID of the Route 53 Resolver DNS Firewall rule group, such as `aws_route53_resolver_firewall_rule_group.example.id`. DNS responses from the Route 53 Resolver in VPCs associated with this rule group are used for validation. Changing this value swaps the managed association asynchronously; the provider waits for the policy to return to `ACTIVE`.
+         */
+        dnsFirewallRuleGroupId: pulumi.Input<string>;
+        /**
+         * Set of client source IPv4 or IPv6 CIDR blocks whose connections are subject to the policy-level validation check. Use `/32` or `/128` for a single address. Valid number of entries is between `1` and `100`. If omitted, validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Doesn't affect stateful rules that use the `AWS_ROUTE_53_RESOLVED_DOMAIN` target type or `awsRoute53ResolvedDomain` rule keyword; those rules still evaluate traffic regardless of these source ranges.
+         *
+         * > **Note:** An empty list can't be set for `sourceIpRanges` or `bypassDestinationValidationIpRanges`. The AWS API treats an empty `sourceIpRanges` list as "validate no source addresses", which this resource doesn't support. Omit the argument instead.
+         *
+         * > **Note:** Removing the `route53ResolvedIpValidation` block turns off resolved IP validation and removes the managed DNS Firewall rule group association.
+         */
+        sourceIpRanges?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    }
     interface FirewallPolicyFirewallPolicyStatefulEngineOptions {
         /**
          * Amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.
@@ -77447,7 +77576,7 @@ export declare namespace networkfirewall {
          */
         generatedRulesType: pulumi.Input<string>;
         /**
-         * Set of types of domain specifications that are provided in the `targets` argument. Valid values: `HTTP_HOST`, `TLS_SNI`.
+         * Set of types of domain specifications that are provided in the `targets` argument. Valid values: `AWS_ROUTE_53_RESOLVED_DOMAIN`, `HTTP_HOST`, `TLS_SNI`. `AWS_ROUTE_53_RESOLVED_DOMAIN` takes effect only when the firewall policy that uses the rule group configures `route53ResolvedIpValidation`. For more information, see [Route 53 resolved IP validation rules](https://docs.aws.amazon.com/network-firewall/latest/developerguide/route53-resolved-ip-validation-rules.html) in the AWS Network Firewall Developer Guide.
          */
         targetTypes: pulumi.Input<pulumi.Input<string>[]>;
         /**
@@ -93592,6 +93721,10 @@ export declare namespace sagemaker {
          * How the model data is prepared. Allowed values are: `None` and `Gzip`.
          */
         compressionType: pulumi.Input<string>;
+        /**
+         * Configuration for deploying a model from a SageMaker JumpStart private hub. See Hub Access Config.
+         */
+        hubAccessConfig?: pulumi.Input<inputs.sagemaker.ModelContainerAdditionalModelDataSourceS3DataSourceHubAccessConfig | undefined>;
         /**
          * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the `modelAccessConfig` configuration block. See Model Access Config.
          */
@@ -93605,6 +93738,12 @@ export declare namespace sagemaker {
          */
         s3Uri: pulumi.Input<string>;
     }
+    interface ModelContainerAdditionalModelDataSourceS3DataSourceHubAccessConfig {
+        /**
+         * Versioned ARN of the private hub content to deploy, such as the `versionedHubContentArn` of an `aws.sagemaker.HubContentReference`. `s3Uri` must match the hub content's hosting artifact URI.
+         */
+        hubContentArn: pulumi.Input<string>;
+    }
     interface ModelContainerAdditionalModelDataSourceS3DataSourceModelAccessConfig {
         /**
          * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
@@ -93638,6 +93777,10 @@ export declare namespace sagemaker {
          * How the model data is prepared. Allowed values are: `None` and `Gzip`.
          */
         compressionType: pulumi.Input<string>;
+        /**
+         * Configuration for deploying a model from a SageMaker JumpStart private hub. See Hub Access Config.
+         */
+        hubAccessConfig?: pulumi.Input<inputs.sagemaker.ModelContainerModelDataSourceS3DataSourceHubAccessConfig | undefined>;
         /**
          * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the `modelAccessConfig` configuration block. See Model Access Config.
          */
@@ -93651,6 +93794,12 @@ export declare namespace sagemaker {
          */
         s3Uri: pulumi.Input<string>;
     }
+    interface ModelContainerModelDataSourceS3DataSourceHubAccessConfig {
+        /**
+         * Versioned ARN of the private hub content to deploy, such as the `versionedHubContentArn` of an `aws.sagemaker.HubContentReference`. `s3Uri` must match the hub content's hosting artifact URI.
+         */
+        hubContentArn: pulumi.Input<string>;
+    }
     interface ModelContainerModelDataSourceS3DataSourceModelAccessConfig {
         /**
          * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
@@ -93730,6 +93879,10 @@ export declare namespace sagemaker {
          * How the model data is prepared. Allowed values are: `None` and `Gzip`.
          */
         compressionType: pulumi.Input<string>;
+        /**
+         * Configuration for deploying a model from a SageMaker JumpStart private hub. See Hub Access Config.
+         */
+        hubAccessConfig?: pulumi.Input<inputs.sagemaker.ModelPrimaryContainerAdditionalModelDataSourceS3DataSourceHubAccessConfig | undefined>;
         /**
          * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the `modelAccessConfig` configuration block. See Model Access Config.
          */
@@ -93743,6 +93896,12 @@ export declare namespace sagemaker {
          */
         s3Uri: pulumi.Input<string>;
     }
+    interface ModelPrimaryContainerAdditionalModelDataSourceS3DataSourceHubAccessConfig {
+        /**
+         * Versioned ARN of the private hub content to deploy, such as the `versionedHubContentArn` of an `aws.sagemaker.HubContentReference`. `s3Uri` must match the hub content's hosting artifact URI.
+         */
+        hubContentArn: pulumi.Input<string>;
+    }
     interface ModelPrimaryContainerAdditionalModelDataSourceS3DataSourceModelAccessConfig {
         /**
          * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
@@ -93776,6 +93935,10 @@ export declare namespace sagemaker {
          * How the model data is prepared. Allowed values are: `None` and `Gzip`.
          */
         compressionType: pulumi.Input<string>;
+        /**
+         * Configuration for deploying a model from a SageMaker JumpStart private hub. See Hub Access Config.
+         */
+        hubAccessConfig?: pulumi.Input<inputs.sagemaker.ModelPrimaryContainerModelDataSourceS3DataSourceHubAccessConfig | undefined>;
         /**
          * Specifies the access configuration file for the ML model. You can explicitly accept the model end-user license agreement (EULA) within the `modelAccessConfig` configuration block. See Model Access Config.
          */
@@ -93789,6 +93952,12 @@ export declare namespace sagemaker {
          */
         s3Uri: pulumi.Input<string>;
     }
+    interface ModelPrimaryContainerModelDataSourceS3DataSourceHubAccessConfig {
+        /**
+         * Versioned ARN of the private hub content to deploy, such as the `versionedHubContentArn` of an `aws.sagemaker.HubContentReference`. `s3Uri` must match the hub content's hosting artifact URI.
+         */
+        hubContentArn: pulumi.Input<string>;
+    }
     interface ModelPrimaryContainerModelDataSourceS3DataSourceModelAccessConfig {
         /**
          * Specifies agreement to the model end-user license agreement (EULA). The value must be set to `true` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model.
@@ -101828,6 +101997,10 @@ export declare namespace vpclattice {
          * Resource DNS Configuration. See `arnResource` Block for details.
          */
         arnResource?: pulumi.Input<inputs.vpclattice.ResourceConfigurationResourceConfigurationDefinitionArnResource | undefined>;
+        /**
+         * Resource CIDR configuration. Only valid when `type` is `CIDR`. See `cidrResource` Block for details.
+         */
+        cidrResource?: pulumi.Input<inputs.vpclattice.ResourceConfigurationResourceConfigurationDefinitionCidrResource | undefined>;
         /**
          * Resource DNS Configuration. See `dnsResource` Block for details.
          */
@@ -101843,6 +102016,12 @@ export declare namespace vpclattice {
          */
         arn: pulumi.Input<string>;
     }
+    interface ResourceConfigurationResourceConfigurationDefinitionCidrResource {
+        /**
+         * Set of 1 to 10 IPv4 and/or IPv6 CIDR ranges (prefix length required), for example `10.0.0.0/16`. `0.0.0.0/0` and `::/0` are only allowed as the sole range. Reserved ranges such as `169.254.0.0/16`, `100.64.0.0/10`, `224.0.0.0/4`, `fe80::/10` and `ff00::/8` are rejected by AWS.
+         */
+        cidrRanges: pulumi.Input<pulumi.Input<string>[]>;
+    }
     interface ResourceConfigurationResourceConfigurationDefinitionDnsResource {
         /**
          * Hostname of the Resource for this configuration.
@@ -107388,15 +107567,15 @@ export declare namespace wafv2 {
         /**
          * Match requests that appear to contain cross-site scripting attacks. See Cross-Site Scripting Match Statement below.
          *
-         * > **NOTE:** Logical statements (`andStatement`, `notStatement`, `orStatement`) can be nested up to 3 levels deep. This matches the nesting limit of the `aws.wafv2.WebAcl` resource.
+         * > **NOTE:** Logical statements (`andStatement`, `notStatement`, `orStatement`) can be nested up to 3 levels deep. This matches the nesting limit of the `aws.wafv2.WebAcl` resource. As in AWS WAF, `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement` can only be used at the top level of a rule's `statement`, not inside a logical statement.
          */
         xssMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementXssMatchStatement | undefined>;
     }
     interface WebAclRuleStatementAndStatement {
         /**
-         * List of statements to combine. At least one statement is required. Each nested statement supports the same statement types listed above.
+         * List of statements to combine. At least two statements are required. Each nested statement supports the statement types listed above except `andStatement`, `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statements?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatement>[] | undefined>;
+        statements: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatement>[]>;
     }
     interface WebAclRuleStatementAsnMatchStatement {
         /**
@@ -108071,15 +108250,15 @@ export declare namespace wafv2 {
         /**
          * Match requests that appear to contain cross-site scripting attacks.
          *
-         * > **NOTE:** Logical statements (`andStatement`, `notStatement`, `orStatement`) within a scope down statement wrap the leaf statement types listed above.
+         * > **NOTE:** Logical statements (`andStatement`, `notStatement`, `orStatement`) can be nested up to 2 levels deep. This matches the nesting limit of the `aws.wafv2.WebAcl` resource.
          */
         xssMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementXssMatchStatement | undefined>;
     }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAndStatement {
         /**
-         * List of statements to combine. At least one statement is required. Each nested statement supports the same statement types listed above.
+         * List of statements to combine. At least two statements are required. Each nested statement supports the statement types listed above except `andStatement`, `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statements?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement>[] | undefined>;
+        statements: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement>[]>;
     }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementAsnMatchStatement {
         /**
@@ -108374,15 +108553,15 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementNotStatement {
         /**
-         * Single statement to negate. Exactly one statement must be specified.
+         * Single statement to negate. Exactly one statement must be specified. The nested statement supports the statement types listed above except `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement | undefined>;
+        statement: pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement>;
     }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementOrStatement {
         /**
-         * List of statements to combine. At least one statement is required. Each nested statement supports the same statement types listed above.
+         * List of statements to combine. At least two statements are required. Each nested statement supports the statement types listed above except `managedRuleGroupStatement`, `orStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statements?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement>[] | undefined>;
+        statements: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement>[]>;
     }
     interface WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementRegexMatchStatement {
         /**
@@ -109439,15 +109618,15 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleStatementNotStatement {
         /**
-         * Single statement to negate. Exactly one statement must be specified.
+         * Single statement to negate. Exactly one statement must be specified. The nested statement supports the statement types listed above except `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statement?: pulumi.Input<inputs.wafv2.WebAclRuleStatement | undefined>;
+        statement: pulumi.Input<inputs.wafv2.WebAclRuleStatement>;
     }
     interface WebAclRuleStatementOrStatement {
         /**
-         * List of statements to combine. At least one statement is required. Each nested statement supports the same statement types listed above.
+         * List of statements to combine. At least two statements are required. Each nested statement supports the statement types listed above except `managedRuleGroupStatement`, `orStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statements?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatement>[] | undefined>;
+        statements: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatement>[]>;
     }
     interface WebAclRuleStatementRateBasedStatement {
         /**
@@ -109687,15 +109866,15 @@ export declare namespace wafv2 {
         /**
          * Match requests that appear to contain cross-site scripting attacks.
          *
-         * > **NOTE:** Logical statements (`andStatement`, `notStatement`, `orStatement`) within a scope down statement wrap the leaf statement types listed above.
+         * > **NOTE:** Logical statements (`andStatement`, `notStatement`, `orStatement`) can be nested up to 2 levels deep. This matches the nesting limit of the `aws.wafv2.WebAcl` resource.
          */
         xssMatchStatement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatementXssMatchStatement | undefined>;
     }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementAndStatement {
         /**
-         * List of statements to combine. At least one statement is required. Each nested statement supports the same statement types listed above.
+         * List of statements to combine. At least two statements are required. Each nested statement supports the statement types listed above except `andStatement`, `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statements?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatement>[] | undefined>;
+        statements: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatement>[]>;
     }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementAsnMatchStatement {
         /**
@@ -109990,15 +110169,15 @@ export declare namespace wafv2 {
     }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementNotStatement {
         /**
-         * Single statement to negate. Exactly one statement must be specified.
+         * Single statement to negate. Exactly one statement must be specified. The nested statement supports the statement types listed above except `managedRuleGroupStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statement?: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatement | undefined>;
+        statement: pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatement>;
     }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementOrStatement {
         /**
-         * List of statements to combine. At least one statement is required. Each nested statement supports the same statement types listed above.
+         * List of statements to combine. At least two statements are required. Each nested statement supports the statement types listed above except `managedRuleGroupStatement`, `orStatement`, `rateBasedStatement` and `ruleGroupReferenceStatement`.
          */
-        statements?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatement>[] | undefined>;
+        statements: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleStatementRateBasedStatementScopeDownStatement>[]>;
     }
     interface WebAclRuleStatementRateBasedStatementScopeDownStatementRegexMatchStatement {
         /**