cdk-common 2.0.395 → 2.0.396

package/node_modules/@aws-cdk/cfnspec/spec/cfn-docs.json

@@ -2139,6 +2139,7 @@
         "GoogleAnalytics": "The connector-specific credentials required when using Google Analytics.",
         "InforNexus": "The connector-specific credentials required when using Infor Nexus.",
         "Marketo": "The connector-specific credentials required when using Marketo.",
+        "Pardot": "The connector-specific credentials required when using Salesforce Pardot.",
         "Redshift": "The connector-specific credentials required when using Amazon Redshift.",
         "SAPOData": "The connector-specific profile credentials required when using SAPOData.",
         "Salesforce": "The connector-specific credentials required when using Salesforce.",
@@ -2160,6 +2161,7 @@
         "Dynatrace": "The connector-specific properties required by Dynatrace.",
         "InforNexus": "The connector-specific properties required by Infor Nexus.",
         "Marketo": "The connector-specific properties required by Marketo.",
+        "Pardot": "The connector-specific properties required by Salesforce Pardot.",
         "Redshift": "The connector-specific properties required by Amazon Redshift.",
         "SAPOData": "The connector-specific profile properties required when using SAPOData.",
         "Salesforce": "The connector-specific properties required by Salesforce.",
@@ -2311,6 +2313,25 @@
         "TokenUrl": "The token url required to fetch access/refresh tokens using authorization code and also to refresh expired access token using refresh token."
       }
     },
+    "AWS::AppFlow::ConnectorProfile.PardotConnectorProfileCredentials": {
+      "attributes": {},
+      "description": "The connector-specific profile credentials required when using Salesforce Pardot.",
+      "properties": {
+        "AccessToken": "The credentials used to access protected Salesforce Pardot resources.",
+        "ClientCredentialsArn": "The secret manager ARN, which contains the client ID and client secret of the connected app.",
+        "ConnectorOAuthRequest": "",
+        "RefreshToken": "The credentials used to acquire new access tokens."
+      }
+    },
+    "AWS::AppFlow::ConnectorProfile.PardotConnectorProfileProperties": {
+      "attributes": {},
+      "description": "The connector-specific profile properties required when using Salesforce Pardot.",
+      "properties": {
+        "BusinessUnitId": "The business unit id of Salesforce Pardot instance.",
+        "InstanceUrl": "The location of the Salesforce Pardot resource.",
+        "IsSandboxEnvironment": "Indicates whether the connector profile applies to a sandbox or production environment."
+      }
+    },
     "AWS::AppFlow::ConnectorProfile.RedshiftConnectorProfileCredentials": {
       "attributes": {},
       "description": "The connector-specific profile credentials required when using Amazon Redshift.",
@@ -2516,6 +2537,7 @@
         "GoogleAnalytics": "The operation to be performed on the provided Google Analytics source fields.",
         "InforNexus": "The operation to be performed on the provided Infor Nexus source fields.",
         "Marketo": "The operation to be performed on the provided Marketo source fields.",
+        "Pardot": "The operation to be performed on the provided Salesforce Pardot source fields.",
         "S3": "The operation to be performed on the provided Amazon S3 source fields.",
         "SAPOData": "The operation to be performed on the provided SAPOData source fields.",
         "Salesforce": "The operation to be performed on the provided Salesforce source fields.",
@@ -2663,6 +2685,13 @@
         "GlueDataCatalog": "Specifies the configuration that Amazon AppFlow uses when it catalogs your data with the AWS Glue Data Catalog ."
       }
     },
+    "AWS::AppFlow::Flow.PardotSourceProperties": {
+      "attributes": {},
+      "description": "The properties that are applied when Salesforce Pardot is being used as a source.",
+      "properties": {
+        "Object": "The object specified in the Salesforce Pardot flow source."
+      }
+    },
     "AWS::AppFlow::Flow.PrefixConfig": {
       "attributes": {},
       "description": "Specifies elements that Amazon AppFlow includes in the file and folder names in the flow destination.",
@@ -2812,6 +2841,7 @@
         "GoogleAnalytics": "Specifies the information that is required for querying Google Analytics.",
         "InforNexus": "Specifies the information that is required for querying Infor Nexus.",
         "Marketo": "Specifies the information that is required for querying Marketo.",
+        "Pardot": "Specifies the information that is required for querying Salesforce Pardot.",
         "S3": "Specifies the information that is required for querying Amazon S3.",
         "SAPOData": "The properties that are applied when using SAPOData as a flow source.",
         "Salesforce": "Specifies the information that is required for querying Salesforce.",
@@ -6967,11 +6997,13 @@
         "Description": "The pricing rule description.",
         "ModifierPercentage": "A percentage modifier applied on the public pricing rates.",
         "Name": "The name of a pricing rule.",
+        "Operation": "",
         "Scope": "The scope of pricing rule that indicates if it is globally applicable, or if it is service-specific.",
         "Service": "If the `Scope` attribute is `SERVICE` , this attribute indicates which service the `PricingRule` is applicable for.",
         "Tags": "A map that contains tag keys and tag values that are attached to a pricing rule.",
         "Tiering": "The set of tiering configurations for the pricing rule.",
-        "Type": "The type of pricing rule."
+        "Type": "The type of pricing rule.",
+        "UsageType": "Usage Type is the unit that each service uses to measure the usage of a specific type of resource."
       }
     },
     "AWS::BillingConductor::PricingRule.FreeTier": {
@@ -7194,7 +7226,8 @@
         "ResourceTags": "",
         "Subscribers": "A list of subscribers to notify.",
         "SubscriptionName": "The name for the subscription.",
-        "Threshold": "(deprecated)\n\nThe dollar value that triggers a notification if the threshold is exceeded.\n\nThis field has been deprecated. To specify a threshold, use ThresholdExpression. Continued use of Threshold will be treated as shorthand syntax for a ThresholdExpression.\n\nOne of Threshold or ThresholdExpression is required for this resource."
+        "Threshold": "(deprecated)\n\nThe dollar value that triggers a notification if the threshold is exceeded.\n\nThis field has been deprecated. To specify a threshold, use ThresholdExpression. Continued use of Threshold will be treated as shorthand syntax for a ThresholdExpression.\n\nOne of Threshold or ThresholdExpression is required for this resource.",
+        "ThresholdExpression": "An [Expression](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Expression.html) object used to specify the anomalies that you want to generate alerts for. This supports dimensions and nested expressions. The supported dimensions are `ANOMALY_TOTAL_IMPACT_ABSOLUTE` and `ANOMALY_TOTAL_IMPACT_PERCENTAGE` . The supported nested expression types are `AND` and `OR` . The match option `GREATER_THAN_OR_EQUAL` is required. Values must be numbers between 0 and 10,000,000,000.\n\nOne of Threshold or ThresholdExpression is required for this resource.\n\nThe following are examples of valid ThresholdExpressions:\n\n- Absolute threshold: `{ \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_ABSOLUTE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } }`\n- Percentage threshold: `{ \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_PERCENTAGE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } }`\n- `AND` two thresholds together: `{ \"And\": [ { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_ABSOLUTE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } }, { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_PERCENTAGE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } } ] }`\n- `OR` two thresholds together: `{ \"Or\": [ { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_ABSOLUTE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } }, { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_PERCENTAGE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } } ] }`"
       }
     },
     "AWS::CE::AnomalySubscription.ResourceTag": {
@@ -10669,6 +10702,16 @@
         "Tags": "An array of key-value pairs to apply to this resource."
       }
     },
+    "AWS::Connect::ApprovedOrigin": {
+      "attributes": {
+        "Ref": ""
+      },
+      "description": "",
+      "properties": {
+        "InstanceId": "",
+        "Origin": ""
+      }
+    },
     "AWS::Connect::ContactFlow": {
       "attributes": {
         "ContactFlowArn": "`Ref` returns the Amazon Resource Name (ARN) of the flow. For example:\n\n`{ \"Ref\": \"myFlowArn\" }`",
@@ -10819,6 +10862,18 @@
         "EncryptionConfig": "The Amazon S3 encryption configuration."
       }
     },
+    "AWS::Connect::IntegrationAssociation": {
+      "attributes": {
+        "IntegrationAssociationId": "",
+        "Ref": ""
+      },
+      "description": "Creates an AWS resource association with an Amazon Connect instance.",
+      "properties": {
+        "InstanceId": "The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.",
+        "IntegrationArn": "The Amazon Resource Name (ARN) for the AppIntegration.",
+        "IntegrationType": "The integration type."
+      }
+    },
     "AWS::Connect::PhoneNumber": {
       "attributes": {
         "Address": "The phone number, in E.164 format.",
@@ -10960,6 +11015,17 @@
         "References": "Information about the reference when the `referenceType` is `URL` . Otherwise, null. `URL` is the only accepted type. (Supports variable injection in the `Value` field.)"
       }
     },
+    "AWS::Connect::SecurityKey": {
+      "attributes": {
+        "AssociationId": "",
+        "Ref": ""
+      },
+      "description": "Configuration information of the security key.",
+      "properties": {
+        "InstanceId": "",
+        "Key": "The key of the security key."
+      }
+    },
     "AWS::Connect::TaskTemplate": {
       "attributes": {
         "Arn": "The Amazon Resource Name (ARN) of the task template.",
@@ -13971,6 +14037,7 @@
       "description": "Specifies a customer gateway.",
       "properties": {
         "BgpAsn": "For devices that support BGP, the customer gateway's BGP ASN.\n\nDefault: 65000",
+        "DeviceName": "The name of customer gateway device.",
         "IpAddress": "IPv4 address for the customer gateway device's outside interface. The address must be static.",
         "Tags": "One or more tags for the customer gateway.",
         "Type": "The type of VPN connection that this customer gateway supports ( `ipsec.1` )."
@@ -14360,7 +14427,7 @@
         "IpamPoolAllocationId": "The ID of an allocation.",
         "Ref": "`Ref` returns the pool ID, allocation ID, and CIDR."
       },
-      "description": "In IPAM, an allocation is a CIDR assignment from an IPAM pool to another resource or IPAM pool.",
+      "description": "In IPAM, an allocation is a CIDR assignment from an IPAM pool to another IPAM pool or to a resource.",
       "properties": {
         "Cidr": "The CIDR you would like to allocate from the IPAM pool. Note the following:\n\n- If there is no DefaultNetmaskLength allocation rule set on the pool, you must specify either the NetmaskLength or the CIDR.\n- If the DefaultNetmaskLength allocation rule is set on the pool, you can specify either the NetmaskLength or the CIDR and the DefaultNetmaskLength allocation rule will be ignored.\n\nPossible values: Any available IPv4 or IPv6 CIDR.",
         "Description": "A description for the allocation.",
@@ -14850,7 +14917,7 @@
         "EnclaveOptions": "Indicates whether the instance is enabled for AWS Nitro Enclaves. For more information, see [What is AWS Nitro Enclaves?](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html) in the *AWS Nitro Enclaves User Guide* .\n\nYou can't enable AWS Nitro Enclaves and hibernation on the same instance.",
         "HibernationOptions": "Indicates whether an instance is enabled for hibernation. This parameter is valid only if the instance meets the [hibernation prerequisites](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/hibernating-prerequisites.html) . For more information, see [Hibernate your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html) in the *Amazon Elastic Compute Cloud User Guide* .",
         "IamInstanceProfile": "The name or Amazon Resource Name (ARN) of an IAM instance profile.",
-        "ImageId": "The ID of the AMI. Alternatively, you can specify a Systems Manager parameter, which will resolve to an AMI ID on launch.\n\nValid formats:\n\n- `ami-17characters00000`\n- `resolve:ssm:parameter-name`\n- `resolve:ssm:parameter-name:version-number`\n- `resolve:ssm:parameter-name:label`\n\nFor more information, see [Use a Systems Manager parameter instead of an AMI ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html#use-an-ssm-parameter-instead-of-an-ami-id) in the *Amazon Elastic Compute Cloud User Guide* .",
+        "ImageId": "The ID of the AMI. Alternatively, you can specify a Systems Manager parameter, which will resolve to an AMI ID on launch.\n\nValid formats:\n\n- `ami-17characters00000`\n- `resolve:ssm:parameter-name`\n- `resolve:ssm:parameter-name:version-number`\n- `resolve:ssm:parameter-name:label`\n\nFor more information, see [Use a Systems Manager parameter to find an AMI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/finding-an-ami.html#using-systems-manager-parameter-to-find-AMI) in the *Amazon Elastic Compute Cloud User Guide* .",
         "InstanceInitiatedShutdownBehavior": "Indicates whether an instance stops or terminates when you initiate shutdown from the instance (using the operating system command for system shutdown).\n\nDefault: `stop`",
         "InstanceMarketOptions": "The market (purchasing) option for the instances.",
         "InstanceRequirements": "The attributes for the instance types. When you specify instance attributes, Amazon EC2 will identify instance types with these attributes.\n\nIf you specify `InstanceRequirements` , you can't specify `InstanceType` .",
@@ -15080,7 +15147,11 @@
       "properties": {
         "AllocationId": "[Public NAT gateway only] The allocation ID of the Elastic IP address that's associated with the NAT gateway. This property is required for a public NAT gateway and cannot be specified with a private NAT gateway.",
         "ConnectivityType": "Indicates whether the NAT gateway supports public or private connectivity. The default is public connectivity.",
+        "MaxDrainDurationSeconds": "",
         "PrivateIpAddress": "The private IPv4 address to assign to the NAT gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.",
+        "SecondaryAllocationIds": "",
+        "SecondaryPrivateIpAddressCount": "",
+        "SecondaryPrivateIpAddresses": "",
         "SubnetId": "The ID of the subnet in which the NAT gateway is located.",
         "Tags": "The tags for the NAT gateway."
       }
@@ -17518,6 +17589,7 @@
         "AddonVersion": "The version of the add-on.",
         "ClusterName": "The name of the cluster.",
         "ConfigurationValues": "The configuration values that you provided.",
+        "PreserveOnDelete": "Specifying this option preserves the add-on software on your cluster but Amazon EKS stops managing any settings for the add-on. If an IAM account is associated with the add-on, it isn't removed.",
         "ResolveConflicts": "How to resolve field value conflicts for an Amazon EKS add-on. Conflicts are handled based on the value you choose:\n\n- *None* – If the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail.\n- *Overwrite* – If the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value.\n- *Preserve* – Not supported. You can set this value when updating an add-on though. For more information, see [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) .\n\nIf you don't currently have the self-managed version of the add-on installed on your cluster, the Amazon EKS add-on is installed. Amazon EKS sets all values to default values, regardless of the option that you specify.",
         "ServiceAccountRoleArn": "The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role. For more information, see [Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html) in the *Amazon EKS User Guide* .\n\n> To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see [Enabling IAM roles for service accounts on your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) in the *Amazon EKS User Guide* .",
         "Tags": "The metadata that you apply to the add-on to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Add-on tags do not propagate to any other resources associated with the cluster."
@@ -17557,9 +17629,9 @@
     },
     "AWS::EKS::Cluster.ControlPlanePlacement": {
       "attributes": {},
-      "description": "",
+      "description": "The placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost. For more information, see [Capacity considerations](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-capacity-considerations.html) in the *Amazon EKS User Guide*",
       "properties": {
-        "GroupName": ""
+        "GroupName": "The name of the placement group for the Kubernetes control plane instances."
       }
     },
     "AWS::EKS::Cluster.EncryptionConfig": {
@@ -17598,7 +17670,7 @@
       "description": "The configuration of your local Amazon EKS cluster on an AWS Outpost. Before creating a cluster on an Outpost, review [Creating a local cluster on an Outpost](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-local-cluster-create.html) in the *Amazon EKS User Guide* . This API isn't available for Amazon EKS clusters on the AWS cloud.",
       "properties": {
         "ControlPlaneInstanceType": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. Choose an instance type based on the number of nodes that your cluster will have. For more information, see [Capacity considerations](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-capacity-considerations.html) in the *Amazon EKS User Guide* .\n\nThe instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. The control plane is not automatically scaled by Amazon EKS.",
-        "ControlPlanePlacement": "",
+        "ControlPlanePlacement": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost. For more information, see [Capacity considerations](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-capacity-considerations.html) in the *Amazon EKS User Guide* .",
         "OutpostArns": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. Only a single Outpost ARN is supported."
       }
     },
@@ -18417,13 +18489,15 @@
         "Architecture": "The CPU architecture type of the application. Allowed values: `X86_64` or `ARM64`",
         "AutoStartConfiguration": "The configuration for an application to automatically start on job submission.",
         "AutoStopConfiguration": "The configuration for an application to automatically stop after a certain amount of time being idle.",
+        "ImageConfiguration": "The image configuration applied to all worker types.",
         "InitialCapacity": "The initial capacity of the application.",
         "MaximumCapacity": "The maximum capacity of the application. This is cumulative across all workers at any given point in time during the lifespan of the application is created. No new resources will be created once any one of the defined limits is hit.",
         "Name": "The name of the application.\n\n*Minimum* : 1\n\n*Maximum* : 64\n\n*Pattern* : `^[A-Za-z0-9._\\\\/#-]+$`",
         "NetworkConfiguration": "The network configuration for customer VPC connectivity for the application.",
         "ReleaseLabel": "The EMR release version associated with the application.\n\n*Minimum* : 1\n\n*Maximum* : 64\n\n*Pattern* : `^[A-Za-z0-9._/-]+$`",
         "Tags": "The tags assigned to the application.",
-        "Type": "The type of application, such as Spark or Hive."
+        "Type": "The type of application, such as Spark or Hive.",
+        "WorkerTypeSpecifications": "The specification applied to each worker type."
       }
     },
     "AWS::EMRServerless::Application.AutoStartConfiguration": {
@@ -18441,6 +18515,13 @@
         "IdleTimeoutMinutes": "The amount of idle time in minutes after which your application will automatically stop. Defaults to 15 minutes.\n\n*Minimum* : 1\n\n*Maximum* : 10080"
       }
     },
+    "AWS::EMRServerless::Application.ImageConfigurationInput": {
+      "attributes": {},
+      "description": "The image configuration.",
+      "properties": {
+        "ImageUri": "The URI of an image in the Amazon ECR registry. This field is required when you create a new application. If you leave this field blank in an update, Amazon EMR will remove the image configuration."
+      }
+    },
     "AWS::EMRServerless::Application.InitialCapacityConfig": {
       "attributes": {},
       "description": "The initial capacity configuration per worker.",
@@ -18483,6 +18564,13 @@
         "Memory": "*Minimum* : 1\n\n*Maximum* : 15\n\n*Pattern* : `^[1-9][0-9]*(\\\\s)?(GB|gb|gB|Gb)?$`"
       }
     },
+    "AWS::EMRServerless::Application.WorkerTypeSpecificationInput": {
+      "attributes": {},
+      "description": "The specifications for a worker type.",
+      "properties": {
+        "ImageConfiguration": "The image configuration for a worker type."
+      }
+    },
     "AWS::ElastiCache::CacheCluster": {
       "attributes": {
         "ConfigurationEndpoint.Address": "The DNS hostname of the cache node.\n\n> Redis (cluster mode disabled) replication groups don't have this attribute. Therefore, `Fn::GetAtt` returns a value for this attribute only if the replication group is clustered. Otherwise, `Fn::GetAtt` fails.",
@@ -18502,9 +18590,9 @@
         "ClusterName": "A name for the cache cluster. If you don't specify a name, AWSCloudFormation generates a unique physical ID and uses that ID for the cache cluster. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .\n\nThe name must contain 1 to 50 alphanumeric characters or hyphens. The name must start with a letter and cannot end with a hyphen or contain two consecutive hyphens.",
         "Engine": "The name of the cache engine to be used for this cluster.\n\nValid values for this parameter are: `memcached` | `redis`",
         "EngineVersion": "The version number of the cache engine to be used for this cluster. To view the supported cache engine versions, use the DescribeCacheEngineVersions operation.\n\n*Important:* You can upgrade to a newer engine version (see [Selecting a Cache Engine and Version](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/SelectEngine.html#VersionManagement) ), but you cannot downgrade to an earlier engine version. If you want to use an earlier engine version, you must delete the existing cluster or replication group and create it anew with the earlier engine version.",
-        "IpDiscovery": "The network type you choose when modifying a cluster, either `ipv4` | `ipv6` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/https://aws.amazon.com/ec2/nitro/) .",
+        "IpDiscovery": "The network type you choose when modifying a cluster, either `ipv4` | `ipv6` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/ec2/nitro/) .",
         "LogDeliveryConfigurations": "Specifies the destination, format and type of the logs.",
-        "NetworkType": "Must be either `ipv4` | `ipv6` | `dual_stack` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/https://aws.amazon.com/ec2/nitro/) .",
+        "NetworkType": "Must be either `ipv4` | `ipv6` | `dual_stack` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/ec2/nitro/) .",
         "NotificationTopicArn": "The Amazon Resource Name (ARN) of the Amazon Simple Notification Service (SNS) topic to which notifications are sent.\n\n> The Amazon SNS topic owner must be the same as the cluster owner.",
         "NumCacheNodes": "The number of cache nodes that the cache cluster should have.\n\n> However, if the `PreferredAvailabilityZone` and `PreferredAvailabilityZones` properties were not previously specified and you don't specify any new values, an update requires [replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) .",
         "Port": "The port number on which each of the cache nodes accepts connections.",
@@ -18637,11 +18725,11 @@
         "Engine": "The name of the cache engine to be used for the clusters in this replication group. The value must be set to `Redis` .",
         "EngineVersion": "The version number of the cache engine to be used for the clusters in this replication group. To view the supported cache engine versions, use the `DescribeCacheEngineVersions` operation.\n\n*Important:* You can upgrade to a newer engine version (see [Selecting a Cache Engine and Version](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/SelectEngine.html#VersionManagement) ) in the *ElastiCache User Guide* , but you cannot downgrade to an earlier engine version. If you want to use an earlier engine version, you must delete the existing cluster or replication group and create it anew with the earlier engine version.",
         "GlobalReplicationGroupId": "The name of the Global datastore",
-        "IpDiscovery": "The network type you choose when creating a replication group, either `ipv4` | `ipv6` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/https://aws.amazon.com/ec2/nitro/) .",
+        "IpDiscovery": "The network type you choose when creating a replication group, either `ipv4` | `ipv6` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/ec2/nitro/) .",
         "KmsKeyId": "The ID of the KMS key used to encrypt the disk on the cluster.",
         "LogDeliveryConfigurations": "Specifies the destination, format and type of the logs.",
         "MultiAZEnabled": "A flag indicating if you have Multi-AZ enabled to enhance fault tolerance. For more information, see [Minimizing Downtime: Multi-AZ](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoFailover.html) .",
-        "NetworkType": "Must be either `ipv4` | `ipv6` | `dual_stack` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/https://aws.amazon.com/ec2/nitro/) .",
+        "NetworkType": "Must be either `ipv4` | `ipv6` | `dual_stack` . IPv6 is supported for workloads using Redis engine version 6.2 onward or Memcached engine version 1.6.6 on all instances built on the [Nitro system](https://docs.aws.amazon.com/ec2/nitro/) .",
         "NodeGroupConfiguration": "`NodeGroupConfiguration` is a property of the `AWS::ElastiCache::ReplicationGroup` resource that configures an Amazon ElastiCache (ElastiCache) Redis cluster node group.\n\nIf you set [UseOnlineResharding](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html#cfn-attributes-updatepolicy-useonlineresharding) to `true` , you can update `NodeGroupConfiguration` without interruption. When `UseOnlineResharding` is set to `false` , or is not specified, updating `NodeGroupConfiguration` results in [replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) .",
         "NotificationTopicArn": "The Amazon Resource Name (ARN) of the Amazon Simple Notification Service (SNS) topic to which notifications are sent.\n\n> The Amazon SNS topic owner must be the same as the cluster owner.",
         "NumCacheClusters": "The number of clusters this replication group initially has.\n\nThis parameter is not used if there is more than one node group (shard). You should use `ReplicasPerNodeGroup` instead.\n\nIf `AutomaticFailoverEnabled` is `true` , the value of this parameter must be at least 2. If `AutomaticFailoverEnabled` is `false` you can omit this parameter (it will default to 1), or you can explicitly set it to a value between 2 and 6.\n\nThe maximum permitted value for `NumCacheClusters` is 6 (1 primary plus 5 replicas).",
@@ -20406,8 +20494,10 @@
         "ExcludeMap": "Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to exclude from the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.\n\nYou can specify inclusions or exclusions, but not both. If you specify an `IncludeMap` , AWS Firewall Manager applies the policy to all accounts specified by the `IncludeMap` , and does not evaluate any `ExcludeMap` specifications. If you do not specify an `IncludeMap` , then Firewall Manager applies the policy to all accounts except for those specified by the `ExcludeMap` .\n\nYou can specify account IDs, OUs, or a combination:\n\n- Specify account IDs by setting the key to `ACCOUNT` . For example, the following is a valid map: `{“ACCOUNT” : [“accountID1”, “accountID2”]}` .\n- Specify OUs by setting the key to `ORGUNIT` . For example, the following is a valid map: `{“ORGUNIT” : [“ouid111”, “ouid112”]}` .\n- Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: `{“ACCOUNT” : [“accountID1”, “accountID2”], “ORGUNIT” : [“ouid111”, “ouid112”]}` .",
         "ExcludeResourceTags": "Used only when tags are specified in the `ResourceTags` property. If this property is `True` , resources with the specified tags are not in scope of the policy. If it's `False` , only resources with the specified tags are in scope of the policy.",
         "IncludeMap": "Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to include in the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.\n\nYou can specify inclusions or exclusions, but not both. If you specify an `IncludeMap` , AWS Firewall Manager applies the policy to all accounts specified by the `IncludeMap` , and does not evaluate any `ExcludeMap` specifications. If you do not specify an `IncludeMap` , then Firewall Manager applies the policy to all accounts except for those specified by the `ExcludeMap` .\n\nYou can specify account IDs, OUs, or a combination:\n\n- Specify account IDs by setting the key to `ACCOUNT` . For example, the following is a valid map: `{“ACCOUNT” : [“accountID1”, “accountID2”]}` .\n- Specify OUs by setting the key to `ORGUNIT` . For example, the following is a valid map: `{“ORGUNIT” : [“ouid111”, “ouid112”]}` .\n- Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: `{“ACCOUNT” : [“accountID1”, “accountID2”], “ORGUNIT” : [“ouid111”, “ouid112”]}` .",
+        "PolicyDescription": "The definition of the AWS Network Firewall firewall policy.",
         "PolicyName": "The name of the AWS Firewall Manager policy.",
         "RemediationEnabled": "Indicates if the policy should be automatically applied to new resources.",
+        "ResourceSetIds": "The unique identifiers of the resource sets used by the policy.",
         "ResourceTags": "An array of `ResourceTag` objects, used to explicitly include resources in the policy scope or explicitly exclude them. If this isn't set, then tags aren't used to modify policy scope. See also `ExcludeResourceTags` .",
         "ResourceType": "The type of resource protected by or in scope of the policy. This is in the format shown in the [AWS Resource Types Reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html) . To apply this policy to multiple resource types, specify a resource type of `ResourceTypeList` and then specify the resource types in a `ResourceTypeList` .\n\nFor AWS WAF and Shield Advanced, example resource types include `AWS::ElasticLoadBalancingV2::LoadBalancer` and `AWS::CloudFront::Distribution` . For a security group common policy, valid values are `AWS::EC2::NetworkInterface` and `AWS::EC2::Instance` . For a security group content audit policy, valid values are `AWS::EC2::SecurityGroup` , `AWS::EC2::NetworkInterface` , and `AWS::EC2::Instance` . For a security group usage audit policy, the value is `AWS::EC2::SecurityGroup` . For an AWS Network Firewall policy or DNS Firewall policy, the value is `AWS::EC2::VPC` .",
         "ResourceTypeList": "An array of `ResourceType` objects. Use this only to specify multiple resource types. To specify a single resource type, use `ResourceType` .",
@@ -23479,6 +23569,8 @@
       },
       "description": "Creates a Dataflow Endpoint Group request.\n\nDataflow endpoint groups contain a list of endpoints. When the name of a dataflow endpoint group is specified in a mission profile, the Ground Station service will connect to the endpoints and flow data during a contact.\n\nFor more information about dataflow endpoint groups, see [Dataflow Endpoint Groups](https://docs.aws.amazon.com/ground-station/latest/ug/dataflowendpointgroups.html) .",
       "properties": {
+        "ContactPostPassDurationSeconds": "",
+        "ContactPrePassDurationSeconds": "",
         "EndpointDetails": "List of Endpoint Details, containing address and port for each endpoint.",
         "Tags": "Tags assigned to a resource."
       }
@@ -23884,7 +23976,9 @@
       }
     },
     "AWS::IAM::ServiceLinkedRole": {
-      "attributes": {},
+      "attributes": {
+        "Ref": "`Ref` returns the `RoleName` created for the service-linked role appended with an underscore followed by the `CustomSuffix` . For example: `AWSServiceRoleForAutoScaling_TestSuffix` ."
+      },
       "description": "Creates an IAM role that is linked to a specific AWS service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your AWS resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see [Using service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) in the *IAM User Guide* .\n\nTo attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.",
       "properties": {
         "AWSServiceName": "The service principal for the AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: `elasticbeanstalk.amazonaws.com` .\n\nService principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide* . Look for the services that have *Yes* in the *Service-Linked Role* column. Choose the *Yes* link to view the service-linked role documentation for that service.",
@@ -24276,11 +24370,28 @@
         "DistributionConfigurationArn": "The Amazon Resource Name (ARN) of the distribution configuration.",
         "EnhancedImageMetadataEnabled": "Indicates whether Image Builder collects additional information about the image, such as the operating system (OS) version and package list.",
         "ImageRecipeArn": "The Amazon Resource Name (ARN) of the image recipe.",
+        "ImageScanningConfiguration": "",
         "ImageTestsConfiguration": "The configuration settings for your image test components, which includes a toggle that allows you to turn off tests, and a timeout setting.",
         "InfrastructureConfigurationArn": "The Amazon Resource Name (ARN) of the infrastructure configuration associated with this image pipeline.",
         "Tags": "The tags of the image."
       }
     },
+    "AWS::ImageBuilder::Image.EcrConfiguration": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "ContainerTags": "",
+        "RepositoryName": ""
+      }
+    },
+    "AWS::ImageBuilder::Image.ImageScanningConfiguration": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "EcrConfiguration": "",
+        "ImageScanningEnabled": ""
+      }
+    },
     "AWS::ImageBuilder::Image.ImageTestsConfiguration": {
       "attributes": {},
       "description": "When you create an image or container recipe with Image Builder , you can add the build or test components that are used to create the final image. You must have at least one build component to create a recipe, but test components are not required. If you have added tests, they run after the image is created, to ensure that the target image is functional and can be used reliably for launching Amazon EC2 instances.",
@@ -24302,6 +24413,7 @@
         "DistributionConfigurationArn": "The Amazon Resource Name (ARN) of the distribution configuration associated with this image pipeline.",
         "EnhancedImageMetadataEnabled": "Collects additional information about the image being created, including the operating system (OS) version and package list. This information is used to enhance the overall experience of using EC2 Image Builder. Enabled by default.",
         "ImageRecipeArn": "The Amazon Resource Name (ARN) of the image recipe associated with this image pipeline.",
+        "ImageScanningConfiguration": "",
         "ImageTestsConfiguration": "The configuration of the image tests that run after image creation to ensure the quality of the image that was created.",
         "InfrastructureConfigurationArn": "The Amazon Resource Name (ARN) of the infrastructure configuration associated with this image pipeline.",
         "Name": "The name of the image pipeline.",
@@ -24310,6 +24422,22 @@
         "Tags": "The tags of this image pipeline."
       }
     },
+    "AWS::ImageBuilder::ImagePipeline.EcrConfiguration": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "ContainerTags": "",
+        "RepositoryName": ""
+      }
+    },
+    "AWS::ImageBuilder::ImagePipeline.ImageScanningConfiguration": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "EcrConfiguration": "",
+        "ImageScanningEnabled": ""
+      }
+    },
     "AWS::ImageBuilder::ImagePipeline.ImageTestsConfiguration": {
       "attributes": {},
       "description": "When you create an image or container recipe with Image Builder , you can add the build or test components that your image pipeline uses to create the final image. You must have at least one build component to create a recipe, but test components are not required. Your pipeline runs tests after it builds the image, to ensure that the target image is functional and can be used reliably for launching Amazon EC2 instances.",
@@ -28547,7 +28675,7 @@
         "ExclusionPatterns": "A list of regular expression patterns. Documents that match the patterns are excluded from the index. Documents that don't match the patterns are included in the index. If a document matches both an exclusion pattern and an inclusion pattern, the document is not included in the index.\n\nThe regex is applied to the display URL of the SharePoint document.",
         "FieldMappings": "A list of `DataSourceToIndexFieldMapping` objects that map Microsoft SharePoint attributes or fields to Amazon Kendra index fields. You must first create the index fields using the [UpdateIndex](https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateIndex.html) operation before you map SharePoint attributes. For more information, see [Mapping Data Source Fields](https://docs.aws.amazon.com/kendra/latest/dg/field-mapping.html) .",
         "InclusionPatterns": "A list of regular expression patterns to include certain documents in your SharePoint. Documents that match the patterns are included in the index. Documents that don't match the patterns are excluded from the index. If a document matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the document isn't included in the index.\n\nThe regex applies to the display URL of the SharePoint document.",
-        "SecretArn": "The Amazon Resource Name (ARN) of an AWS Secrets Manager secret that contains the user name and password required to connect to the SharePoint instance. If you use SharePoint Server, you also need to provide the sever domain name as part of the credentials. For more information, see [Using a Microsoft SharePoint Data Source](https://docs.aws.amazon.com/kendra/latest/dg/data-source-sharepoint.html) .\n\nYou can also provide OAuth authentication credentials of user name, password, client ID, and client secret. For more information, see [Using a SharePoint data source](https://docs.aws.amazon.com/kendra/latest/dg/data-source-sharepoint.html) .",
+        "SecretArn": "The Amazon Resource Name (ARN) of an AWS Secrets Manager secret that contains the user name and password required to connect to the SharePoint instance. For more information, see [Microsoft SharePoint](https://docs.aws.amazon.com/kendra/latest/dg/data-source-sharepoint.html) .",
         "SharePointVersion": "The version of Microsoft SharePoint that you use.",
         "SslCertificateS3Path": "Information required to find a specific file in an Amazon S3 bucket.",
         "Urls": "The Microsoft SharePoint site URLs for the documents you want to index.",
@@ -28756,6 +28884,27 @@
         "Value": "The boost value for a document when the key is part of the metadata of a document."
       }
     },
+    "AWS::KendraRanking::ExecutionPlan": {
+      "attributes": {
+        "Arn": "The Amazon Resource Name (ARN) of the rescore execution plan.",
+        "Id": "The identifier of the rescore execution plan.",
+        "Ref": "`Ref` returns the rescore execution plan ID. For example:\n\n`{\"Ref\": \"rescore-execution-plan-id\"}`"
+      },
+      "description": "Creates a rescore execution plan. A rescore execution plan is an Amazon Kendra Intelligent Ranking resource used for provisioning the `Rescore` API. You set the number of capacity units that you require for Amazon Kendra Intelligent Ranking to rescore or re-rank a search service's results.\n\nFor an example of using the `CreateRescoreExecutionPlan` API, including using the Python and Java SDKs, see [Semantically ranking a search service's results](https://docs.aws.amazon.com/kendra/latest/dg/search-service-rerank.html) .",
+      "properties": {
+        "CapacityUnits": "You can set additional capacity units to meet the needs of your rescore execution plan. You are given a single capacity unit by default. If you want to use the default capacity, you don't set additional capacity units. For more information on the default capacity and additional capacity units, see [Adjusting capacity](https://docs.aws.amazon.com/kendra/latest/dg/adjusting-capacity.html) .",
+        "Description": "A description for the rescore execution plan.",
+        "Name": "A name for the rescore execution plan.",
+        "Tags": "A list of key-value pairs that identify or categorize your rescore execution plan. You can also use tags to help control access to the rescore execution plan. Tag keys and values can consist of Unicode letters, digits, white space. They can also consist of underscore, period, colon, equal, plus, and asperand."
+      }
+    },
+    "AWS::KendraRanking::ExecutionPlan.CapacityUnitsConfiguration": {
+      "attributes": {},
+      "description": "Sets additional capacity units configured for your rescore execution plan. A rescore execution plan is an Amazon Kendra Intelligent Ranking resource used for provisioning the `Rescore` API. You can add and remove capacity units to fit your usage requirements.",
+      "properties": {
+        "RescoreCapacityUnits": "The amount of extra capacity for your rescore execution plan.\n\nA single extra capacity unit for a rescore execution plan provides 0.01 rescore requests per second. You can add up to 1000 extra capacity units."
+      }
+    },
     "AWS::Kinesis::Stream": {
       "attributes": {
         "Arn": "The Amazon resource name (ARN) of the Kinesis stream, such as `arn:aws:kinesis:us-east-2:123456789012:stream/mystream` .",
@@ -30399,7 +30548,7 @@
         "MaximumRetryAttempts": "(Streams only) Discard records after the specified number of retries. The default value is -1,\nwhich sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.",
         "ParallelizationFactor": "(Streams only) The number of batches to process concurrently from each shard. The default value is 1.",
         "Queues": "(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.",
-        "ScalingConfig": "(Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) .",
+        "ScalingConfig": "( Amazon Simple Queue Service only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) .",
         "SelfManagedEventSource": "The self-managed Apache Kafka cluster for your event source.",
         "SelfManagedKafkaEventSourceConfig": "Specific configuration settings for a self-managed Apache Kafka event source.",
         "SourceAccessConfigurations": "An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.",
@@ -30453,7 +30602,7 @@
     },
     "AWS::Lambda::EventSourceMapping.ScalingConfig": {
       "attributes": {},
-      "description": "(Amazon SQS only) The scaling configuration for the event source. To remove the configuration, pass an empty value.",
+      "description": "( Amazon Simple Queue Service only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) .",
       "properties": {
         "MaximumConcurrency": "Limits the number of concurrent instances that the Amazon SQS event source can invoke."
       }
@@ -30508,6 +30657,7 @@
         "ReservedConcurrentExecutions": "The number of simultaneous executions to reserve for the function.",
         "Role": "The Amazon Resource Name (ARN) of the function's execution role.",
         "Runtime": "The identifier of the function's [runtime](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html) . Runtime is required if the deployment package is a .zip file archive.",
+        "RuntimeManagementConfig": "Sets the runtime management configuration for a function's version. For more information, see [Runtime updates](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html) .",
         "SnapStart": "The function's [AWS Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) setting.",
         "Tags": "A list of [tags](https://docs.aws.amazon.com/lambda/latest/dg/tagging.html) to apply to the function.",
         "Timeout": "The amount of time (in seconds) that Lambda allows a function to run before stopping it. The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see [Lambda execution environment](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html) .",
@@ -30564,6 +30714,14 @@
         "WorkingDirectory": "Specifies the working directory."
       }
     },
+    "AWS::Lambda::Function.RuntimeManagementConfig": {
+      "attributes": {},
+      "description": "Sets the runtime management configuration for a function's version. For more information, see [Runtime updates](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html) .",
+      "properties": {
+        "RuntimeVersionArn": "The ARN of the runtime version you want the function to use.\n\n> This is only required if you're using the *Manual* runtime update mode.",
+        "UpdateRuntimeOn": "Specify the runtime update mode.\n\n- *Auto (default)* - Automatically update to the most recent and secure runtime version using a [Two-phase runtime version rollout](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase) . This is the best choice for most customers to ensure they always benefit from runtime updates.\n- *Function update* - Lambda updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date.\n- *Manual* - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see [Roll back a runtime version](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback) .\n\n*Valid Values* : `Auto` | `Function update` | `Manual`"
+      }
+    },
     "AWS::Lambda::Function.SnapStart": {
       "attributes": {},
       "description": "The function's [AWS Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) setting.",
@@ -30573,10 +30731,10 @@
     },
     "AWS::Lambda::Function.SnapStartResponse": {
       "attributes": {},
-      "description": "The function's [SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) setting.",
+      "description": "",
       "properties": {
-        "ApplyOn": "When set to `PublishedVersions` , Lambda creates a snapshot of the execution environment when you publish a function version.",
-        "OptimizationStatus": "When you provide a [qualified Amazon Resource Name (ARN)](https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html#versioning-versions-using) , this response element indicates whether SnapStart is activated for the specified function version."
+        "ApplyOn": "",
+        "OptimizationStatus": ""
       }
     },
     "AWS::Lambda::Function.TracingConfig": {
@@ -30809,6 +30967,32 @@
         "LambdaCodeHook": "Specifies a Lambda function that verifies requests to a bot or fulfills the user's request to a bot."
       }
     },
+    "AWS::Lex::Bot.Condition": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "ExpressionString": ""
+      }
+    },
+    "AWS::Lex::Bot.ConditionalBranch": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "Condition": "",
+        "Name": "",
+        "NextStep": "",
+        "Response": ""
+      }
+    },
+    "AWS::Lex::Bot.ConditionalSpecification": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "ConditionalBranches": "",
+        "DefaultBranch": "",
+        "IsActive": ""
+      }
+    },
     "AWS::Lex::Bot.ConversationLogSettings": {
       "attributes": {},
       "description": "Specifies settings that manage logging that saves audio, text, and metadata for the conversations with your users.",
@@ -30856,6 +31040,33 @@
         "ChildDirected": ""
       }
     },
+    "AWS::Lex::Bot.DefaultConditionalBranch": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "NextStep": "",
+        "Response": ""
+      }
+    },
+    "AWS::Lex::Bot.DialogAction": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "SlotToElicit": "",
+        "SuppressNextMessage": "",
+        "Type": ""
+      }
+    },
+    "AWS::Lex::Bot.DialogCodeHookInvocationSetting": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "EnableCodeHookInvocation": "",
+        "InvocationLabel": "",
+        "IsActive": "",
+        "PostCodeHookSpecification": ""
+      }
+    },
     "AWS::Lex::Bot.DialogCodeHookSetting": {
       "attributes": {},
       "description": "Specifies whether an intent uses the dialog code hook during conversations with a user.",
@@ -30863,6 +31074,23 @@
         "Enabled": "Indicates whether an intent uses the dialog code hook during a conversation with a user."
       }
     },
+    "AWS::Lex::Bot.DialogState": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "DialogAction": "",
+        "Intent": "",
+        "SessionAttributes": ""
+      }
+    },
+    "AWS::Lex::Bot.ElicitationCodeHookInvocationSetting": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "EnableCodeHookInvocation": "",
+        "InvocationLabel": ""
+      }
+    },
     "AWS::Lex::Bot.ExternalSourceSetting": {
       "attributes": {},
       "description": "Provides information about the external source of the slot type's definition.",
@@ -30876,6 +31104,7 @@
       "properties": {
         "Enabled": "Indicates whether a Lambda function should be invoked for fulfill a specific intent.",
         "FulfillmentUpdatesSpecification": "Provides settings for update messages sent to the user for long-running Lambda fulfillment functions. Fulfillment updates can be used only with streaming conversations.",
+        "IsActive": "",
         "PostFulfillmentStatusSpecification": "Provides settings for messages sent to the user for after the Lambda fulfillment function completes. Post-fulfillment messages can be sent for both streaming and non-streaming conversations."
       }
     },
@@ -30933,6 +31162,16 @@
         "Title": "The title to display on the response card. The format of the title is determined by the platform displaying the response card."
       }
     },
+    "AWS::Lex::Bot.InitialResponseSetting": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "CodeHook": "",
+        "Conditional": "",
+        "InitialResponse": "",
+        "NextStep": ""
+      }
+    },
     "AWS::Lex::Bot.InputContext": {
       "attributes": {},
       "description": "The name of a context that must be active for an intent to be selected by Amazon Lex .",
@@ -30947,6 +31186,7 @@
         "Description": "A description of the intent. Use the description to help identify the intent in lists.",
         "DialogCodeHook": "Specifies that Amazon Lex invokes the alias Lambda function for each user input. You can invoke this Lambda function to personalize user interaction.",
         "FulfillmentCodeHook": "Specifies that Amazon Lex invokes the alias Lambda function when the intent is ready for fulfillment. You can invoke this function to complete the bot's transaction with the user.",
+        "InitialResponseSetting": "",
         "InputContexts": "A list of contexts that must be active for this intent to be considered by Amazon Lex .",
         "IntentClosingSetting": "Sets the response that Amazon Lex sends to the user when the intent is closed.",
         "IntentConfirmationSetting": "Provides prompts that Amazon Lex sends to the user to confirm the completion of an intent. If the user answers \"no,\" the settings contain a statement that is sent to the user to end the intent.",
@@ -30964,18 +31204,38 @@
       "description": "Provides a statement the Amazon Lex conveys to the user when the intent is successfully fulfilled.",
       "properties": {
         "ClosingResponse": "The response that Amazon Lex sends to the user when the intent is complete.",
-        "IsActive": "Specifies whether an intent's closing response is used. When this field is false, the closing response isn't sent to the user and no closing input from the user is used. If the IsActive field isn't specified, the default is true."
+        "Conditional": "",
+        "IsActive": "Specifies whether an intent's closing response is used. When this field is false, the closing response isn't sent to the user and no closing input from the user is used. If the IsActive field isn't specified, the default is true.",
+        "NextStep": ""
       }
     },
     "AWS::Lex::Bot.IntentConfirmationSetting": {
       "attributes": {},
       "description": "Provides a prompt for making sure that the user is ready for the intent to be fulfilled.",
       "properties": {
+        "CodeHook": "",
+        "ConfirmationConditional": "",
+        "ConfirmationNextStep": "",
+        "ConfirmationResponse": "",
+        "DeclinationConditional": "",
+        "DeclinationNextStep": "",
         "DeclinationResponse": "When the user answers \"no\" to the question defined in PromptSpecification, Amazon Lex responds with this response to acknowledge that the intent was canceled.",
+        "ElicitationCodeHook": "",
+        "FailureConditional": "",
+        "FailureNextStep": "",
+        "FailureResponse": "",
         "IsActive": "Specifies whether the intent's confirmation is sent to the user. When this field is false, confirmation and declination responses aren't sent and processing continues as if the responses aren't present. If the active field isn't specified, the default is true.",
         "PromptSpecification": "Prompts the user to confirm the intent. This question should have a yes or no answer."
       }
     },
+    "AWS::Lex::Bot.IntentOverride": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "Name": "",
+        "Slots": ""
+      }
+    },
     "AWS::Lex::Bot.KendraConfiguration": {
       "attributes": {},
       "description": "Provides configuration information for the AMAZON.KendraSearchIntent intent. When you use this intent, Amazon Lex searches the specified Amazon Kendra index and returns documents from the index that match the user's utterance.",
@@ -31041,12 +31301,33 @@
         "Value": "The message to send to the user."
       }
     },
+    "AWS::Lex::Bot.PostDialogCodeHookInvocationSpecification": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "FailureConditional": "",
+        "FailureNextStep": "",
+        "FailureResponse": "",
+        "SuccessConditional": "",
+        "SuccessNextStep": "",
+        "SuccessResponse": "",
+        "TimeoutConditional": "",
+        "TimeoutNextStep": "",
+        "TimeoutResponse": ""
+      }
+    },
     "AWS::Lex::Bot.PostFulfillmentStatusSpecification": {
       "attributes": {},
       "description": "Provides a setting that determines whether the post-fulfillment response is sent to the user. For more information, see [Post-fulfillment response](https://docs.aws.amazon.com/lex/latest/dg/streaming-progress.html#progress-complete) in the *Amazon Lex developer guide* .",
       "properties": {
+        "FailureConditional": "",
+        "FailureNextStep": "",
         "FailureResponse": "Specifies a list of message groups that Amazon Lex uses to respond when fulfillment isn't successful.",
+        "SuccessConditional": "",
+        "SuccessNextStep": "",
         "SuccessResponse": "Specifies a list of message groups that Amazon Lex uses to respond when the fulfillment is successful.",
+        "TimeoutConditional": "",
+        "TimeoutNextStep": "",
         "TimeoutResponse": "Specifies a list of message groups that Amazon Lex uses to respond when fulfillment isn't completed within the timeout period."
       }
     },
@@ -31125,6 +31406,14 @@
         "DetectSentiment": ""
       }
     },
+    "AWS::Lex::Bot.SessionAttribute": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "Key": "",
+        "Value": ""
+      }
+    },
     "AWS::Lex::Bot.Slot": {
       "attributes": {},
       "description": "Specifies the definition of a slot. Amazon Lex elicits slot values from uses to fulfill the user's intent.",
@@ -31137,6 +31426,20 @@
         "ValueElicitationSetting": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- OriginalValue - Returns the value entered by the user, if the user value is similar to a slot value.\n- TopResolution - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the valueSelectionStrategy, the default is OriginalValue."
       }
     },
+    "AWS::Lex::Bot.SlotCaptureSetting": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "CaptureConditional": "",
+        "CaptureNextStep": "",
+        "CaptureResponse": "",
+        "CodeHook": "",
+        "ElicitationCodeHook": "",
+        "FailureConditional": "",
+        "FailureNextStep": "",
+        "FailureResponse": ""
+      }
+    },
     "AWS::Lex::Bot.SlotDefaultValue": {
       "attributes": {},
       "description": "Specifies the default value to use when a user doesn't provide a value for a slot.",
@@ -31179,6 +31482,13 @@
         "Synonyms": "Additional values related to the slot type entry."
       }
     },
+    "AWS::Lex::Bot.SlotValue": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "InterpretedValue": ""
+      }
+    },
     "AWS::Lex::Bot.SlotValueElicitationSetting": {
       "attributes": {},
       "description": "Settings that you can use for eliciting a slot value.",
@@ -31186,10 +31496,28 @@
         "DefaultValueSpecification": "A list of default values for a slot. Default values are used when Amazon Lex hasn't determined a value for a slot. You can specify default values from context variables, session attributes, and defined values.",
         "PromptSpecification": "The prompt that Amazon Lex uses to elicit the slot value from the user.",
         "SampleUtterances": "If you know a specific pattern that users might respond to an Amazon Lex request for a slot value, you can provide those utterances to improve accuracy. This is optional. In most cases Amazon Lex is capable of understanding user utterances.",
+        "SlotCaptureSetting": "",
         "SlotConstraint": "Specifies whether the slot is required or optional.",
         "WaitAndContinueSpecification": "Specifies the prompts that Amazon Lex uses while a bot is waiting for customer input."
       }
     },
+    "AWS::Lex::Bot.SlotValueOverride": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "Shape": "",
+        "Value": "",
+        "Values": ""
+      }
+    },
+    "AWS::Lex::Bot.SlotValueOverrideMap": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "SlotName": "",
+        "SlotValueOverride": ""
+      }
+    },
     "AWS::Lex::Bot.SlotValueRegexFilter": {
       "attributes": {},
       "description": "Provides a regular expression used to validate the value of a slot.",
@@ -32002,9 +32330,7 @@
       "properties": {
         "CollectionName": "A custom name for the geofence collection.\n\nRequirements:\n\n- Contain only alphanumeric characters (A–Z, a–z, 0–9), hyphens (-), periods (.), and underscores (_).\n- Must be a unique geofence collection name.\n- No spaces allowed. For example, `ExampleGeofenceCollection` .",
         "Description": "An optional description for the geofence collection.",
-        "KmsKeyId": "A key identifier for an [AWS KMS customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html) . Enter a key ID, key ARN, alias name, or alias ARN.",
-        "PricingPlan": "No longer used. If included, the only allowed value is `RequestBasedUsage` .\n\n*Allowed Values* : `RequestBasedUsage`",
-        "PricingPlanDataSource": "This parameter is no longer used."
+        "KmsKeyId": "A key identifier for an [AWS KMS customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html) . Enter a key ID, key ARN, alias name, or alias ARN."
       }
     },
     "AWS::Location::Map": {
@@ -32128,6 +32454,7 @@
     },
     "AWS::Logs::LogStream": {
       "attributes": {
+        "Id": "",
         "Ref": "`Ref` returns the resource name, such as `MyAppLogStream` ."
       },
       "description": "The `AWS::Logs::LogStream` resource specifies an Amazon CloudWatch Logs log stream in a specific log group. A log stream represents the sequence of events coming from an application instance or resource that you are monitoring.\n\nThere is no limit on the number of log streams that you can create for a log group.\n\nYou must use the following guidelines when naming a log stream:\n\n- Log stream names must be unique within the log group.\n- Log stream names can be between 1 and 512 characters long.\n- The ':' (colon) and '*' (asterisk) characters are not allowed.",
@@ -36413,6 +36740,26 @@
         "Tags": "The list of key-value tags that changed for the segment."
       }
     },
+    "AWS::NetworkManager::TransitGatewayPeering": {
+      "attributes": {
+        "CoreNetworkArn": "The ARN of the core network.",
+        "CreatedAt": "The timestamp when the core network peering was created.",
+        "EdgeLocation": "The edge location for the peer.",
+        "OwnerAccountId": "The ID of the account owner.",
+        "PeeringId": "The ID of the peering.",
+        "PeeringType": "The peering type. This will be `TRANSIT_GATEWAY` .",
+        "Ref": "`Ref` returns the `peeringId` . For example: `peering-01234ab1234a12a12` .",
+        "ResourceArn": "The ARN of the resource peered to a core network.",
+        "State": "The current state of the peer. This can be `CREATING` | `FAILED` | `AVAILABLE` | `DELETING` .",
+        "TransitGatewayPeeringAttachmentId": "The ID of the peering attachment."
+      },
+      "description": "Creates a transit gateway peering connection.",
+      "properties": {
+        "CoreNetworkId": "The ID of the core network.",
+        "Tags": "The list of key-value tags associated with the peering.",
+        "TransitGatewayArn": "The ARN of the transit gateway."
+      }
+    },
     "AWS::NetworkManager::TransitGatewayRegistration": {
       "attributes": {
         "Ref": "`Ref` returns the ID of the global network and the ARN of the transit gateway. For example: `global-network-01231231231231231|arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc` ."
@@ -36769,6 +37116,7 @@
     },
     "AWS::OpenSearchService::Domain": {
       "attributes": {
+        "AdvancedSecurityOptions.AnonymousAuthDisableDate": "Date and time when the migration period will be disabled. Only necessary when [enabling fine-grained access control on an existing domain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing) .",
         "Arn": "The Amazon Resource Name (ARN) of the domain, such as `arn:aws:es:us-west-2:123456789012:domain/mystack-1ab2cdefghij` .",
         "DomainArn": "The Amazon Resource Name (ARN) of the domain.",
         "DomainEndpoint": "The domain-specific endpoint used for requests to the OpenSearch APIs, such as `search-mystack-1ab2cdefghij-ab1c2deckoyb3hofw7wpqa3cm.us-west-1.es.amazonaws.com` .",
@@ -36789,7 +37137,7 @@
       "properties": {
         "AccessPolicies": "An AWS Identity and Access Management ( IAM ) policy document that specifies who can access the OpenSearch Service domain and their permissions. For more information, see [Configuring access policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html#ac-creating) in the *Amazon OpenSearch Service Developer Guide* .",
         "AdvancedOptions": "Additional options to specify for the OpenSearch Service domain. For more information, see [AdvancedOptions](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateDomain.html#API_CreateDomain_RequestBody) in the OpenSearch Service API reference.",
-        "AdvancedSecurityOptions": "Specifies options for fine-grained access control. If you specify advanced security options, you must also enable node-to-node encryption ( [NodeToNodeEncryptionOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.html) ) and encryption at rest ( [EncryptionAtRestOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-encryptionatrestoptions.html) ). You must also enable `EnforceHTTPS` within [DomainEndpointOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html) , which requires HTTPS for all traffic to the domain.",
+        "AdvancedSecurityOptions": "Specifies options for fine-grained access control and SAML authentication.\n\nIf you specify advanced security options, you must also enable node-to-node encryption ( [NodeToNodeEncryptionOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.html) ) and encryption at rest ( [EncryptionAtRestOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-encryptionatrestoptions.html) ). You must also enable `EnforceHTTPS` within [DomainEndpointOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html) , which requires HTTPS for all traffic to the domain.",
         "ClusterConfig": "Container for the cluster configuration of a domain.",
         "CognitoOptions": "Configures OpenSearch Service to use Amazon Cognito authentication for OpenSearch Dashboards.",
         "DomainEndpointOptions": "Specifies additional options for the domain endpoint, such as whether to require HTTPS for all traffic or whether to use a custom endpoint rather than the default endpoint.",
@@ -36806,11 +37154,14 @@
     },
     "AWS::OpenSearchService::Domain.AdvancedSecurityOptionsInput": {
       "attributes": {},
-      "description": "Specifies options for fine-grained access control. If you specify advanced security options, you must also enable node-to-node encryption ( [NodeToNodeEncryptionOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.html) ) and encryption at rest ( [EncryptionAtRestOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-encryptionatrestoptions.html) ). You must also enable `EnforceHTTPS` within [DomainEndpointOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html) , which requires HTTPS for all traffic to the domain.",
+      "description": "Specifies options for fine-grained access control.\n\nIf you specify advanced security options, you must also enable node-to-node encryption ( [NodeToNodeEncryptionOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-nodetonodeencryptionoptions.html) ) and encryption at rest ( [EncryptionAtRestOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-encryptionatrestoptions.html) ). You must also enable `EnforceHTTPS` within [DomainEndpointOptions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html) , which requires HTTPS for all traffic to the domain.",
       "properties": {
+        "AnonymousAuthDisableDate": "Date and time when the migration period will be disabled. Only necessary when [enabling fine-grained access control on an existing domain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing) .",
+        "AnonymousAuthEnabled": "True to enable a 30-day migration period during which administrators can create role mappings. Only necessary when [enabling fine-grained access control on an existing domain](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-enabling-existing) .",
         "Enabled": "True to enable fine-grained access control. You must also enable encryption of data at rest and node-to-node encryption. See [Fine-grained access control in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html) .",
         "InternalUserDatabaseEnabled": "True to enable the internal user database.",
-        "MasterUserOptions": "Specifies information about the master user."
+        "MasterUserOptions": "Specifies information about the master user.",
+        "SAMLOptions": "Container for information about the SAML configuration for OpenSearch Dashboards."
       }
     },
     "AWS::OpenSearchService::Domain.ClusterConfig": {
@@ -36869,6 +37220,14 @@
         "KmsKeyId": "The KMS key ID. Takes the form `1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a` . Required if you enable encryption at rest.\n\nYou can also use `keyAlias` as a value."
       }
     },
+    "AWS::OpenSearchService::Domain.Idp": {
+      "attributes": {},
+      "description": "The SAML Identity Provider's information.",
+      "properties": {
+        "EntityId": "The unique entity ID of the application in the SAML identity provider.",
+        "MetadataContent": "The metadata of the SAML application, in XML format."
+      }
+    },
     "AWS::OpenSearchService::Domain.LogPublishingOption": {
       "attributes": {},
       "description": "Specifies whether the OpenSearch Service domain publishes application, search slow logs, or index slow logs to Amazon CloudWatch. Each option must be an object of name `SEARCH_SLOW_LOGS` , `ES_APPLICATION_LOGS` , `INDEX_SLOW_LOGS` , or `AUDIT_LOGS` depending on the type of logs you want to publish. For the full syntax, see the [examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-opensearchservice-domain.html#aws-resource-opensearchservice-domain--examples) .\n\nBefore you enable log publishing, you need to create a CloudWatch log group and provide OpenSearch Service the correct permissions to write to it. To learn more, see [Enabling log publishing ( AWS CloudFormation)](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html#createdomain-configure-slow-logs-cfn) .",
@@ -36893,6 +37252,19 @@
         "Enabled": "Specifies to enable or disable node-to-node encryption on the domain. Required if you enable fine-grained access control in [AdvancedSecurityOptionsInput](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-advancedsecurityoptionsinput.html) ."
       }
     },
+    "AWS::OpenSearchService::Domain.SAMLOptions": {
+      "attributes": {},
+      "description": "Container for information about the SAML configuration for OpenSearch Dashboards.",
+      "properties": {
+        "Enabled": "True to enable SAML authentication for a domain.",
+        "Idp": "The SAML Identity Provider's information.",
+        "MasterBackendRole": "The backend role that the SAML master user is mapped to.",
+        "MasterUserName": "The SAML master user name, which is stored in the domain's internal user database.",
+        "RolesKey": "Element of the SAML assertion to use for backend roles. Default is `roles` .",
+        "SessionTimeoutMinutes": "The duration, in minutes, after which a user session becomes inactive. Acceptable values are between 1 and 1440, and the default value is 60.",
+        "SubjectKey": "Element of the SAML assertion to use for the user name. Default is `NameID` ."
+      }
+    },
     "AWS::OpenSearchService::Domain.ServiceSoftwareOptions": {
       "attributes": {},
       "description": "The current status of the service software for an Amazon OpenSearch Service domain. For more information, see [Service software updates in Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html) .",
@@ -37258,7 +37630,7 @@
       "attributes": {
         "Arn": "The Amazon Resource Name (ARN) of the server, such as `arn:aws:OpsWorksCM:us-east-1:123456789012:server/server-a1bzhi` .",
         "Endpoint": "A DNS name that can be used to access the engine. Example: `myserver-asdfghjkl.us-east-1.opsworks.io` .",
-        "Id": "",
+        "Id": "The ID of the server.",
         "Ref": "`Ref` returns the server's ARN, such as `arn:aws:OpsWorksCM:us-east-1:123456789012:server/server-a1bzhi` ."
       },
       "description": "The `AWS::OpsWorksCM::Server` resource creates an AWS OpsWorks for Chef Automate or OpsWorks for Puppet Enterprise configuration management server. For more information, see [Create a Chef Automate Server in AWS CloudFormation](https://docs.aws.amazon.com/opsworks/latest/userguide/opscm-create-server-cfn.html) or [Create a Puppet Enterprise Master in AWS CloudFormation](https://docs.aws.amazon.com/opsworks/latest/userguide/opspup-create-server-cfn.html) in the *AWS OpsWorks User Guide* , and [CreateServer](https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_CreateServer.html) in the *AWS OpsWorks CM API Reference* .",
@@ -39471,7 +39843,7 @@
       "description": "A *logical table* is a unit that joins and that data transformations operate on. A logical table has a source, which can be either a physical table or result of a join. When a logical table points to a physical table, the logical table acts as a mutable copy of that physical table through transform operations.",
       "properties": {
         "Alias": "A display name for the logical table.",
-        "DataTransforms": "Transform operations that act on this logical table.",
+        "DataTransforms": "Transform operations that act on this logical table. For this structure to be valid, only one of the attributes can be non-null.",
         "Source": "Source of this logical table."
       }
     },
@@ -39974,7 +40346,7 @@
         "Errors": "Errors associated with this template version.",
         "Sheets": "A list of the associated sheets with the unique identifier and name of each sheet.",
         "SourceEntityArn": "The Amazon Resource Name (ARN) of an analysis or template that was used to create this template.",
-        "Status": "The HTTP status of the request.",
+        "Status": "The status that is associated with the template.\n\n- `CREATION_IN_PROGRESS`\n- `CREATION_SUCCESSFUL`\n- `CREATION_FAILED`\n- `UPDATE_IN_PROGRESS`\n- `UPDATE_SUCCESSFUL`\n- `UPDATE_FAILED`\n- `DELETED`",
         "ThemeArn": "The ARN of the theme associated with this version of the template.",
         "VersionNumber": "The version number of the template version."
       }
@@ -40288,6 +40660,8 @@
     },
     "AWS::RDS::DBInstance": {
       "attributes": {
+        "CertificateDetails.CAIdentifier": "",
+        "CertificateDetails.ValidTill": "",
         "DBInstanceArn": "The Amazon Resource Name (ARN) for the DB instance.",
         "DBSystemId": "The Oracle system ID (Oracle SID) for a container database (CDB). The Oracle SID is also the name of the CDB.\n\nThis setting is valid for RDS Custom only.",
         "DbiResourceId": "The AWS Region-unique, immutable identifier for the DB instance. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB instance is accessed.",
@@ -40306,6 +40680,8 @@
         "AvailabilityZone": "The Availability Zone (AZ) where the database will be created. For information on AWS Regions and Availability Zones, see [Regions and Availability Zones](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html) .\n\n*Amazon Aurora*\n\nEach Aurora DB cluster hosts copies of its storage in three separate Availability Zones. Specify one of these Availability Zones. Aurora automatically chooses an appropriate Availability Zone if you don't specify one.\n\nDefault: A random, system-chosen Availability Zone in the endpoint's AWS Region .\n\nExample: `us-east-1d`\n\nConstraint: The `AvailabilityZone` parameter can't be specified if the DB instance is a Multi-AZ deployment. The specified Availability Zone must be in the same AWS Region as the current endpoint.",
         "BackupRetentionPeriod": "The number of days for which automated backups are retained. Setting this parameter to a positive number enables backups. Setting this parameter to 0 disables automated backups.\n\n*Amazon Aurora*\n\nNot applicable. The retention period for automated backups is managed by the DB cluster.\n\nDefault: 1\n\nConstraints:\n\n- Must be a value from 0 to 35\n- Can't be set to 0 if the DB instance is a source to read replicas",
         "CACertificateIdentifier": "The identifier of the CA certificate for this DB instance.\n\n> Specifying or updating this property triggers a reboot. \n\nFor more information about CA certificate identifiers for RDS DB engines, see [Rotating Your SSL/TLS Certificate](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html) in the *Amazon RDS User Guide* .\n\nFor more information about CA certificate identifiers for Aurora DB engines, see [Rotating Your SSL/TLS Certificate](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html) in the *Amazon Aurora User Guide* .",
+        "CertificateDetails": "The details of the DB instance's server certificate.",
+        "CertificateRotationRestart": "A value that indicates whether the DB instance is restarted when you rotate your SSL/TLS certificate.\n\nBy default, the DB instance is restarted when you rotate your SSL/TLS certificate. The certificate is not updated until the DB instance is restarted.\n\n> Set this parameter only if you are *not* using SSL/TLS to connect to the DB instance. \n\nIf you are using SSL/TLS to connect to the DB instance, follow the appropriate instructions for your DB engine to rotate your SSL/TLS certificate:\n\n- For more information about rotating your SSL/TLS certificate for RDS DB engines, see [Rotating Your SSL/TLS Certificate.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html) in the *Amazon RDS User Guide.*\n- For more information about rotating your SSL/TLS certificate for Aurora DB engines, see [Rotating Your SSL/TLS Certificate](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html) in the *Amazon Aurora User Guide* .\n\nThis setting doesn't apply to RDS Custom.",
         "CharacterSetName": "For supported engines, indicates that the DB instance should be associated with the specified character set.\n\n*Amazon Aurora*\n\nNot applicable. The character set is managed by the DB cluster. For more information, see [AWS::RDS::DBCluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html) .",
         "CopyTagsToSnapshot": "A value that indicates whether to copy tags from the DB instance to snapshots of the DB instance. By default, tags are not copied.\n\n*Amazon Aurora*\n\nNot applicable. Copying tags to snapshots is managed by the DB cluster. Setting this value for an Aurora DB instance has no effect on the DB cluster setting.",
         "CustomIAMInstanceProfile": "The instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance. The instance profile must meet the following requirements:\n\n- The profile must exist in your account.\n- The profile must have an IAM role that Amazon EC2 has permissions to assume.\n- The instance profile name and the associated IAM role name must start with the prefix `AWSRDSCustom` .\n\nFor the list of permissions required for the IAM role, see [Configure IAM and your VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-setup-orcl.html#custom-setup-orcl.iam-vpc) in the *Amazon RDS User Guide* .\n\nThis setting is required for RDS Custom.",
@@ -40366,6 +40742,14 @@
         "VPCSecurityGroups": "A list of the VPC security group IDs to assign to the DB instance. The list can include both the physical IDs of existing VPC security groups and references to [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html) resources created in the template.\n\nIf you plan to update the resource, don't specify VPC security groups in a shared VPC.\n\nIf you set `VPCSecurityGroups` , you must not set [`DBSecurityGroups`](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-dbsecuritygroups) , and vice versa.\n\n> You can migrate a DB instance in your stack from an RDS DB security group to a VPC security group, but keep the following in mind:\n> \n> - You can't revert to using an RDS security group after you establish a VPC security group membership.\n> - When you migrate your DB instance to VPC security groups, if your stack update rolls back because the DB instance update fails or because an update fails in another AWS CloudFormation resource, the rollback fails because it can't revert to an RDS security group.\n> - To use the properties that are available when you use a VPC security group, you must recreate the DB instance. If you don't, AWS CloudFormation submits only the property values that are listed in the [`DBSecurityGroups`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-dbsecuritygroups) property. \n\nTo avoid this situation, migrate your DB instance to using VPC security groups only when that is the only change in your stack template.\n\n*Amazon Aurora*\n\nNot applicable. The associated list of EC2 VPC security groups is managed by the DB cluster. If specified, the setting must match the DB cluster setting."
       }
     },
+    "AWS::RDS::DBInstance.CertificateDetails": {
+      "attributes": {},
+      "description": "Returns the details of the DB instance’s server certificate.\n\nFor more information, see [Using SSL/TLS to encrypt a connection to a DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html) in the *Amazon RDS User Guide* and [Using SSL/TLS to encrypt a connection to a DB cluster](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html) in the *Amazon Aurora User Guide* .",
+      "properties": {
+        "CAIdentifier": "The CA identifier of the CA certificate used for the DB instance's server certificate.",
+        "ValidTill": "The expiration date of the DB instance’s server certificate."
+      }
+    },
     "AWS::RDS::DBInstance.DBInstanceRole": {
       "attributes": {},
       "description": "Describes an AWS Identity and Access Management (IAM) role that is associated with a DB instance.",
@@ -40622,6 +41006,7 @@
       "description": "Creates a CloudWatch RUM app monitor, which you can use to collect telemetry data from your application and send it to CloudWatch RUM. The data includes performance and reliability information such as page load time, client-side errors, and user behavior.\n\nAfter you create an app monitor, sign in to the CloudWatch RUM console to get the JavaScript code snippet to add to your web application. For more information, see [How do I find a code snippet that I've already generated?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-find-code-snippet.html)",
       "properties": {
         "AppMonitorConfiguration": "A structure that contains much of the configuration data for the app monitor. If you are using Amazon Cognito for authorization, you must include this structure in your request, and it must include the ID of the Amazon Cognito identity pool to use for authorization. If you don't include `AppMonitorConfiguration` , you must set up your own authorization method. For more information, see [Authorize your application to send data to AWS](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-get-started-authorization.html) .\n\nIf you omit this argument, the sample rate used for CloudWatch RUM is set to 10% of the user sessions.",
+        "CustomEvents": "Specifies whether this app monitor allows the web client to define and send custom events. If you omit this parameter, custom events are `DISABLED` .",
         "CwLogEnabled": "Data collected by CloudWatch RUM is kept by RUM for 30 days and then deleted. This parameter specifies whether CloudWatch RUM sends a copy of this telemetry data to Amazon CloudWatch Logs in your account. This enables you to keep the telemetry data for more than 30 days, but it does incur Amazon CloudWatch Logs charges.\n\nIf you omit this parameter, the default is `false` .",
         "Domain": "The top-level internet domain name for which your application has administrative authority. This parameter is required.",
         "Name": "A name for the app monitor. This parameter is required.",
@@ -40644,6 +41029,13 @@
         "Telemetries": "An array that lists the types of telemetry data that this app monitor is to collect.\n\n- `errors` indicates that RUM collects data about unhandled JavaScript errors raised by your application.\n- `performance` indicates that RUM collects performance data about how your application and its resources are loaded and rendered. This includes Core Web Vitals.\n- `http` indicates that RUM collects data about HTTP errors thrown by your application."
       }
     },
+    "AWS::RUM::AppMonitor.CustomEvents": {
+      "attributes": {},
+      "description": "This structure specifies whether this app monitor allows the web client to define and send custom events.",
+      "properties": {
+        "Status": "Set this to `ENABLED` to allow the web client to send custom events for this app monitor.\n\nValid values are `ENABLED` and `DISABLED` ."
+      }
+    },
     "AWS::RUM::AppMonitor.MetricDefinition": {
       "attributes": {},
       "description": "Specifies the extended metrics that you want the CloudWatch RUM app monitor to send to a destination. Valid destinations include CloudWatch and Evidently.\n\nBy default, RUM app monitors send some metrics to CloudWatch . These default metrics are listed in [CloudWatch metrics that you can collect with CloudWatch RUM](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-metrics.html) .\n\nIf you also send extended metrics, you can send metrics to Evidently as well as CloudWatch , and you can also optionally send the metrics with additional dimensions. The valid dimension names for the additional dimensions are `BrowserName` , `CountryCode` , `DeviceType` , `FileType` , `OSName` , and `PageId` . For more information, see [Extended metrics that you can send to CloudWatch and CloudWatch Evidently](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-RUM-vended-metrics.html) .\n\nThe maximum number of metric definitions that one destination can contain is 2000.\n\nExtended metrics sent are charged as CloudWatch custom metrics. Each combination of additional dimension name and dimension value counts as a custom metric.\n\nIf some metric definitions that you specify are not valid, then the operation will not modify any metric definitions even if other metric definitions specified are valid.",
@@ -41055,7 +41447,7 @@
       "description": "The collection of computing resources from which an endpoint is created.",
       "properties": {
         "BaseCapacity": "The base data warehouse capacity of the workgroup in Redshift Processing Units (RPUs).",
-        "ConfigParameters": "An array of parameters to set for finer control over a database. The options are `datestyle` , `enable_user_activity_logging` , `query_group` , `search_path` , and `max_query_execution_time` .",
+        "ConfigParameters": "An array of parameters to set for advanced control over a database. The options are `auto_mv` , `datestyle` , `enable_case_sensitivity_identifier` , `enable_user_activity_logging` , `query_group` , , `search_path` , and query monitoring metrics that let you define performance boundaries. For more information about query monitoring rules and available metrics, see [Query monitoring metrics for Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/dg/cm-c-wlm-query-monitoring-rules.html#cm-c-wlm-query-monitoring-metrics-serverless) .",
         "CreationDate": "The creation date of the workgroup.",
         "Endpoint": "The endpoint that is created from the workgroup.",
         "EnhancedVpcRouting": "The value that specifies whether to enable enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC.",
@@ -41591,42 +41983,42 @@
     "AWS::RolesAnywhere::CRL": {
       "attributes": {
         "CrlId": "The unique primary identifier of the Crl",
-        "Ref": "`Ref` returns `CrlId` ."
+        "Ref": "The name of the CRL."
       },
-      "description": "The state of the certificate revocation list (CRL) after a read or write operation.",
+      "description": "Creates a Crl.",
       "properties": {
-        "CrlData": "The revocation record for a certificate, following the x509 v3 standard.",
-        "Enabled": "Indicates whether the certificate revocation list (CRL) is enabled.",
-        "Name": "The name of the certificate revocation list (CRL).",
-        "Tags": "A list of tags to attach to the CRL.",
+        "CrlData": "x509 v3 Certificate Revocation List to revoke auth for corresponding certificates presented in CreateSession operations",
+        "Enabled": "The enabled status of the resource.",
+        "Name": "The customer specified name of the resource.",
+        "Tags": "A list of Tags.",
         "TrustAnchorArn": "The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for."
       }
     },
     "AWS::RolesAnywhere::Profile": {
       "attributes": {
-        "ProfileArn": "The ARN of the profile.",
+        "ProfileArn": "",
         "ProfileId": "The unique primary identifier of the Profile",
-        "Ref": "`Ref` returns `ProfileId` ."
+        "Ref": "The name of the Profile"
       },
-      "description": "Creates a *profile* , a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.\n\n*Required permissions:* `rolesanywhere:CreateProfile` .",
+      "description": "Creates a Profile.",
       "properties": {
-        "DurationSeconds": "Sets the maximum number of seconds that vended temporary credentials through [CreateSession](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html) will be valid for, between 900 and 3600.",
-        "Enabled": "Indicates whether the profile is enabled.",
-        "ManagedPolicyArns": "A list of managed policy ARNs that apply to the vended session credentials.",
-        "Name": "The name of the profile.",
-        "RequireInstanceProperties": "Specifies whether instance properties are required in temporary credential requests with this profile.",
-        "RoleArns": "A list of IAM role ARNs. During `CreateSession` , if a matching role ARN is provided, the properties in this profile will be applied to the intersection session policy.",
-        "SessionPolicy": "A session policy that applies to the trust boundary of the vended session credentials.",
-        "Tags": "A list of tags to attach to the profile."
+        "DurationSeconds": "The number of seconds vended session credentials will be valid for",
+        "Enabled": "The enabled status of the resource.",
+        "ManagedPolicyArns": "A list of managed policy ARNs. Managed policies identified by this list will be applied to the vended session credentials.",
+        "Name": "The customer specified name of the resource.",
+        "RequireInstanceProperties": "Specifies whether instance properties are required in CreateSession requests with this profile.",
+        "RoleArns": "A list of IAM role ARNs that can be assumed when this profile is specified in a CreateSession request.",
+        "SessionPolicy": "A session policy that will applied to the trust boundary of the vended session credentials.",
+        "Tags": "A list of Tags."
       }
     },
     "AWS::RolesAnywhere::TrustAnchor": {
       "attributes": {
         "Ref": "`Ref` returns `TrustAnchorId` .",
         "TrustAnchorArn": "The ARN of the trust anchor.",
-        "TrustAnchorId": "The unique primary identifier of the TrustAnchor"
+        "TrustAnchorId": ""
       },
-      "description": "The state of the trust anchor after a read or write operation.",
+      "description": "Creates a TrustAnchor.",
       "properties": {
         "Enabled": "Indicates whether the trust anchor is enabled.",
         "Name": "The name of the trust anchor.",
@@ -41636,15 +42028,15 @@
     },
     "AWS::RolesAnywhere::TrustAnchor.Source": {
       "attributes": {},
-      "description": "The trust anchor type and its related certificate data.",
+      "description": "Object representing the TrustAnchor type and its related certificate data.",
       "properties": {
-        "SourceData": "The data field of the trust anchor depending on its type.",
-        "SourceType": "The type of the trust anchor."
+        "SourceData": "A union object representing the data field of the TrustAnchor depending on its type",
+        "SourceType": "The type of the TrustAnchor."
       }
     },
     "AWS::RolesAnywhere::TrustAnchor.SourceData": {
       "attributes": {},
-      "description": "The data field of the trust anchor depending on its type.",
+      "description": "A union object representing the data field of the TrustAnchor depending on its type",
       "properties": {
         "AcmPcaArn": "The root certificate of the AWS Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type `AWS_ACM_PCA` .",
         "X509CertificateData": "The PEM-encoded data for the certificate anchor. Included for trust anchors of type `CERTIFICATE_BUNDLE` ."
@@ -42192,7 +42584,8 @@
         "OutpostArn": "",
         "PreferredInstanceType": "",
         "Ref": "`Ref` returns the `ResolverEndpoint` object.",
-        "ResolverEndpointId": "The ID of the resolver endpoint."
+        "ResolverEndpointId": "The ID of the resolver endpoint.",
+        "ResolverEndpointType": ""
       },
       "description": "Creates a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound:\n\n- An *inbound Resolver endpoint* forwards DNS queries to the DNS service for a VPC from your network.\n- An *outbound Resolver endpoint* forwards DNS queries from the DNS service for a VPC to your network.",
       "properties": {
@@ -42201,6 +42594,7 @@
         "Name": "A friendly name that lets you easily find a configuration in the Resolver dashboard in the Route 53 console.",
         "OutpostArn": "",
         "PreferredInstanceType": "",
+        "ResolverEndpointType": "",
         "SecurityGroupIds": "The ID of one or more security groups that control access to this VPC. The security group must include one or more inbound rules (for inbound endpoints) or outbound rules (for outbound endpoints). Inbound and outbound rules must allow TCP and UDP access. For inbound access, open port 53. For outbound access, open the port that you're using for DNS queries on your network.",
         "Tags": "Route 53 Resolver doesn't support updating tags through CloudFormation."
       }
@@ -42210,6 +42604,7 @@
       "description": "In a [CreateResolverEndpoint](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverEndpoint.html) request, the IP address that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). `IpAddressRequest` also includes the ID of the subnet that contains the IP address.",
       "properties": {
         "Ip": "The IP address that you want to use for DNS queries.",
+        "Ipv6": "",
         "SubnetId": "The ID of the subnet that contains the IP address."
       }
     },
@@ -44700,6 +45095,7 @@
         "AppNetworkAccessType": "Specifies the VPC used for non-EFS traffic. The default value is `PublicInternetOnly` .\n\n- `PublicInternetOnly` - Non-EFS traffic is through a VPC managed by Amazon SageMaker , which allows direct internet access\n- `VpcOnly` - All Studio traffic is through the specified VPC and subnets\n\n*Valid Values* : `PublicInternetOnly | VpcOnly`",
         "AppSecurityGroupManagement": "The entity that creates and manages the required security groups for inter-app communication in `VpcOnly` mode. Required when `CreateDomain.AppNetworkAccessType` is `VpcOnly` and `DomainSettings.RStudioServerProDomainSettings.DomainExecutionRoleArn` is provided.",
         "AuthMode": "The mode of authentication that members use to access the Domain.\n\n*Valid Values* : `SSO | IAM`",
+        "DefaultSpaceSettings": "",
         "DefaultUserSettings": "The default user settings.",
         "DomainName": "The domain name.",
         "DomainSettings": "A collection of settings that apply to the `SageMaker Domain` . These settings are specified through the `CreateDomain` API call.",
@@ -44718,6 +45114,16 @@
         "ImageVersionNumber": "The version number of the CustomImage."
       }
     },
+    "AWS::SageMaker::Domain.DefaultSpaceSettings": {
+      "attributes": {},
+      "description": "A collection of settings that apply to spaces created in the Domain.",
+      "properties": {
+        "ExecutionRole": "The execution role for the space.",
+        "JupyterServerAppSettings": "",
+        "KernelGatewayAppSettings": "",
+        "SecurityGroups": "The security groups for the Amazon Virtual Private Cloud that the space uses for communication."
+      }
+    },
     "AWS::SageMaker::Domain.DomainSettings": {
       "attributes": {},
       "description": "A collection of settings that apply to the `SageMaker Domain` . These settings are specified through the `CreateDomain` API call.",
@@ -46965,12 +47371,12 @@
       "attributes": {
         "Ref": "`Ref` returns a unique identifier for the association."
       },
-      "description": "Associates the specified principal ARN with the specified portfolio.\n\nIf you share the portfolio with principal name sharing enabled, the `PrincipalARN` association is included in the share.\n\nThe `PortfolioID` , `PrincipalARN` , and `PrincipalType` parameters are required.\n\nYou can associate a maximum of 10 Principals with a portfolio using `PrincipalType` as `IAM_PATTERN`\n\n> When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is *not* an AWS Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through AWS Service Catalog , they may be able to guess the user. If this potential escalation path is a concern, then AWS Service Catalog recommends using `PrincipalType` as `IAM` . With this configuration, the `PrincipalARN` must already exist in the recipient account before it can be associated.",
+      "description": "Associates the specified principal ARN with the specified portfolio.",
       "properties": {
         "AcceptLanguage": "The language code.\n\n- `en` - English (default)\n- `jp` - Japanese\n- `zh` - Chinese",
         "PortfolioId": "The portfolio identifier.",
-        "PrincipalARN": "The ARN of the principal (IAM user, role, or group). This field allows an ARN with no `accountID` if `PrincipalType` is `IAM_PATTERN` .\n\nYou can associate multiple `IAM` patterns even if the account has no principal with that name. This is useful in Principal Name Sharing if you want to share a principal without creating it in the account that owns the portfolio.",
-        "PrincipalType": "The principal type. The supported value is `IAM` if you use a fully defined ARN, or `IAM_PATTERN` if you use an ARN with no `accountID` ."
+        "PrincipalARN": "The ARN of the principal (IAM user, role, or group).",
+        "PrincipalType": "The principal type. The supported value is `IAM` ."
       }
     },
     "AWS::ServiceCatalog::PortfolioProductAssociation": {
@@ -47959,6 +48365,17 @@
         "TimeoutSeconds": ""
       }
     },
+    "AWS::Transfer::Workflow.DecryptStepDetails": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "DestinationFileLocation": "",
+        "Name": "",
+        "OverwriteExisting": "",
+        "SourceFileLocation": "",
+        "Type": ""
+      }
+    },
     "AWS::Transfer::Workflow.DeleteStepDetails": {
       "attributes": {},
       "description": "",
@@ -47967,7 +48384,23 @@
         "SourceFileLocation": ""
       }
     },
+    "AWS::Transfer::Workflow.EfsInputFileLocation": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "FileSystemId": "",
+        "Path": ""
+      }
+    },
     "AWS::Transfer::Workflow.InputFileLocation": {
+      "attributes": {},
+      "description": "",
+      "properties": {
+        "EfsFileLocation": "",
+        "S3FileLocation": ""
+      }
+    },
+    "AWS::Transfer::Workflow.S3FileLocation": {
       "attributes": {},
       "description": "",
       "properties": {
@@ -48005,6 +48438,7 @@
       "properties": {
         "CopyStepDetails": "Details for a step that performs a file copy.\n\nConsists of the following values:\n\n- A description\n- An Amazon S3 location for the destination of the file copy.\n- A flag that indicates whether to overwrite an existing file of the same name. The default is `FALSE` .",
         "CustomStepDetails": "Details for a step that invokes an AWS Lambda function.\n\nConsists of the Lambda function's name, target, and timeout (in seconds).",
+        "DecryptStepDetails": "",
         "DeleteStepDetails": "Details for a step that deletes the file.",
         "TagStepDetails": "Details for a step that creates one or more tags.\n\nYou specify one or more tags. Each tag contains a key-value pair.",
         "Type": "Currently, the following step types are supported.\n\n- *`COPY`* - Copy the file to another location.\n- *`CUSTOM`* - Perform a custom step with an AWS Lambda function target.\n- *`DECRYPT`* - Decrypt a file that was encrypted before it was uploaded.\n- *`DELETE`* - Delete the file.\n- *`TAG`* - Add a tag to the file."