cdk-common 2.0.404 → 2.0.406

package/node_modules/@aws-cdk/cfnspec/spec/cfn-docs.json

@@ -1931,7 +1931,7 @@
       "properties": {
         "ApplicationId": "The application ID.",
         "Description": "A description of the configuration profile.",
-        "LocationUri": "A URI to locate the configuration. You can specify the AWS AppConfig hosted configuration store, Systems Manager (SSM) document, an SSM Parameter Store parameter, or an Amazon S3 object. For the hosted configuration store and for feature flags, specify `hosted` . For an SSM document, specify either the document name in the format `ssm-document://<Document_name>` or the Amazon Resource Name (ARN). For a parameter, specify either the parameter name in the format `ssm-parameter://<Parameter_name>` or the ARN. For an Amazon S3 object, specify the URI in the following format: `s3://<bucket>/<objectKey>` . Here is an example: `s3://my-bucket/my-app/us-east-1/my-config.json`",
+        "LocationUri": "A URI to locate the configuration. You can specify the following:\n\n- For the AWS AppConfig hosted configuration store and for feature flags, specify `hosted` .\n- For an AWS Systems Manager Parameter Store parameter, specify either the parameter name in the format `ssm-parameter://<parameter name>` or the ARN.\n- For an AWS Secrets Manager secret, specify the URI in the following format: `secrets-manager` ://<secret name>.\n- For an Amazon S3 object, specify the URI in the following format: `s3://<bucket>/<objectKey>` . Here is an example: `s3://my-bucket/my-app/us-east-1/my-config.json`\n- For an SSM document, specify either the document name in the format `ssm-document://<document name>` or the Amazon Resource Name (ARN).",
         "Name": "A name for the configuration profile.",
         "RetrievalRoleArn": "The ARN of an IAM role with permission to access the configuration at the specified `LocationUri` .\n\n> A retrieval role ARN is not required for configurations stored in the AWS AppConfig hosted configuration store. It is required for all other sources that store your configuration.",
         "Tags": "Metadata to assign to the configuration profile. Tags help organize and categorize your AWS AppConfig resources. Each tag consists of a key and an optional value, both of which you define.",
@@ -4841,14 +4841,14 @@
         "Description": "The description of the data source.",
         "DynamoDBConfig": "AWS Region and TableName for an Amazon DynamoDB table in your account.",
         "ElasticsearchConfig": "AWS Region and Endpoints for an Amazon OpenSearch Service domain in your account.\n\nAs of September 2021, Amazon Elasticsearch Service is Amazon OpenSearch Service . This property is deprecated. For new data sources, use *OpenSearchServiceConfig* to specify an OpenSearch Service data source.",
-        "EventBridgeConfig": "",
+        "EventBridgeConfig": "An EventBridge configuration that contains a valid ARN of an event bus.",
         "HttpConfig": "Endpoints for an HTTP data source.",
         "LambdaConfig": "An ARN of a Lambda function in valid ARN format. This can be the ARN of a Lambda function that exists in the current account or in another account.",
         "Name": "Friendly name for you to identify your AppSync data source after creation.",
         "OpenSearchServiceConfig": "AWS Region and Endpoints for an Amazon OpenSearch Service domain in your account.",
         "RelationalDatabaseConfig": "Relational Database configuration of the relational database data source.",
-        "ServiceRoleArn": "The AWS Identity and Access Management service role ARN for the data source. The system assumes this role when accessing the data source.\n\nRequired if `Type` is specified as `AWS_LAMBDA` , `AMAZON_DYNAMODB` , `AMAZON_ELASTICSEARCH` , or `AMAZON_OPENSEARCH_SERVICE` .",
-        "Type": "The type of the data source.\n\n- *AWS_LAMBDA* : The data source is an AWS Lambda function.\n- *AMAZON_DYNAMODB* : The data source is an Amazon DynamoDB table.\n- *AMAZON_ELASTICSEARCH* : The data source is an Amazon OpenSearch Service domain.\n- *AMAZON_OPENSEARCH_SERVICE* : The data source is an Amazon OpenSearch Service domain.\n- *NONE* : There is no data source. This type is used when you wish to invoke a GraphQL operation without connecting to a data source, such as performing data transformation with resolvers or triggering a subscription to be invoked from a mutation.\n- *HTTP* : The data source is an HTTP endpoint.\n- *RELATIONAL_DATABASE* : The data source is a relational database."
+        "ServiceRoleArn": "The AWS Identity and Access Management service role ARN for the data source. The system assumes this role when accessing the data source.\n\nRequired if `Type` is specified as `AWS_LAMBDA` , `AMAZON_DYNAMODB` , `AMAZON_ELASTICSEARCH` , `AMAZON_EVENTBRIDGE` , or `AMAZON_OPENSEARCH_SERVICE` .",
+        "Type": "The type of the data source.\n\n- *AWS_LAMBDA* : The data source is an AWS Lambda function.\n- *AMAZON_DYNAMODB* : The data source is an Amazon DynamoDB table.\n- *AMAZON_ELASTICSEARCH* : The data source is an Amazon OpenSearch Service domain.\n- *AMAZON_EVENTBRIDGE* : The data source is an Amazon EventBridge event bus.\n- *AMAZON_OPENSEARCH_SERVICE* : The data source is an Amazon OpenSearch Service domain.\n- *NONE* : There is no data source. This type is used when you wish to invoke a GraphQL operation without connecting to a data source, such as performing data transformation with resolvers or triggering a subscription to be invoked from a mutation.\n- *HTTP* : The data source is an HTTP endpoint.\n- *RELATIONAL_DATABASE* : The data source is a relational database."
       }
     },
     "AWS::AppSync::DataSource.AuthorizationConfig": {
@@ -4897,9 +4897,9 @@
     },
     "AWS::AppSync::DataSource.EventBridgeConfig": {
       "attributes": {},
-      "description": "",
+      "description": "The data source. This can be an API destination, resource, or AWS service.",
       "properties": {
-        "EventBusArn": ""
+        "EventBusArn": "The event bus pipeline's ARN. For more information about event buses, see [EventBridge event buses](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus.html) ."
       }
     },
     "AWS::AppSync::DataSource.HttpConfig": {
@@ -5591,7 +5591,7 @@
         "AssessmentName": "The name of the assessment that's associated with the delegation.",
         "Comment": "The comment that's related to the delegation.",
         "ControlSetId": "The identifier for the control set that's associated with the delegation.",
-        "CreatedBy": "The IAM user or role that created the delegation.\n\n*Minimum* : `1`\n\n*Maximum* : `100`\n\n*Pattern* : `^[a-zA-Z0-9-_()\\\\[\\\\]\\\\s]+$`",
+        "CreatedBy": "The user or role that created the delegation.\n\n*Minimum* : `1`\n\n*Maximum* : `100`\n\n*Pattern* : `^[a-zA-Z0-9-_()\\\\[\\\\]\\\\s]+$`",
         "CreationTime": "Specifies when the delegation was created.",
         "Id": "The unique identifier for the delegation.",
         "LastUpdated": "Specifies when the delegation was last updated.",
@@ -8558,6 +8558,37 @@
         "Enabled": "This field is `true` if any of the AWS accounts have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies. If not, this field is `false` ."
       }
     },
+    "AWS::CloudTrail::Channel": {
+      "attributes": {
+        "ChannelArn": "`Ref` returns the ARN of the CloudTrail channel, such as `arn:aws:cloudtrail:us-east-2:123456789012:channel/01234567890` .",
+        "Channels": "`Ref` returns the names of CloudTrail channels.",
+        "Ref": "When the logical ID of this resource is provided to the Ref intrinsic function, `Ref` returns the resource name."
+      },
+      "description": "Contains information about a returned CloudTrail channel.",
+      "properties": {
+        "Channel": "Contains information about a returned CloudTrail channel.",
+        "Destinations": "One or more event data stores to which events arriving through a channel will be logged.",
+        "Name": "The name of the channel.",
+        "Source": "The name of the partner or external event source. You cannot change this name after you create the channel. A maximum of one channel is allowed per source.\n\nA source can be either `Custom` for all valid non- AWS events, or the name of a partner event source. For information about the source names for available partners, see [Additional information about integration partners](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-integration.html#cloudtrail-lake-partner-information) in the CloudTrail User Guide.",
+        "Tags": "A list of tags."
+      }
+    },
+    "AWS::CloudTrail::Channel.Channel": {
+      "attributes": {},
+      "description": "Contains information about a returned CloudTrail channel.",
+      "properties": {
+        "ChannelArn": "The Amazon Resource Name (ARN) of a channel.",
+        "Name": "The name of the CloudTrail channel. For service-linked channels, the name is `aws-service-channel/service-name/custom-suffix` where `service-name` represents the name of the AWS service that created the channel and `custom-suffix` represents the suffix created by the AWS service."
+      }
+    },
+    "AWS::CloudTrail::Channel.Destination": {
+      "attributes": {},
+      "description": "Contains information about the destination receiving events.",
+      "properties": {
+        "Location": "For channels used for a CloudTrail Lake integration, the location is the ARN of an event data store that receives events from a channel. For service-linked channels, the location is the name of the AWS service.",
+        "Type": "The type of destination for events arriving from a channel. For channels used for a CloudTrail Lake integration, the value is `EventDataStore` . For service-linked channels, the value is `AWS_SERVICE` ."
+      }
+    },
     "AWS::CloudTrail::EventDataStore": {
       "attributes": {
         "CreatedTimestamp": "`Ref` returns the time stamp of the creation of the event data store, such as `1248496624` .",
@@ -8568,7 +8599,7 @@
       },
       "description": "Creates a new event data store.",
       "properties": {
-        "AdvancedEventSelectors": "The advanced event selectors to use to select the events for the data store. You can configure up to five advanced event selectors for each event data store.\n\nFor more information about how to use advanced event selectors to log CloudTrail events, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.\n\nFor more information about how to use advanced event selectors to include AWS Config configuration items in your event data store, see [Create an event data store for AWS Config configuration items](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/lake-cli-create-eds-config.html) in the CloudTrail User Guide.",
+        "AdvancedEventSelectors": "The advanced event selectors to use to select the events for the data store. You can configure up to five advanced event selectors for each event data store.\n\nFor more information about how to use advanced event selectors to log CloudTrail events, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.\n\nFor more information about how to use advanced event selectors to include AWS Config configuration items in your event data store, see [Create an event data store for AWS Config configuration items](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-lake-cli.html#lake-cli-create-eds-config) in the CloudTrail User Guide.\n\nFor more information about how to use advanced event selectors to include non- AWS events in your event data store, see [Create an integration to log events from outside AWS](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-lake-cli.html#lake-cli-create-integration) in the CloudTrail User Guide.",
         "KmsKeyId": "Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by `alias/` , a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.\n\n> Disabling or deleting the KMS key, or removing CloudTrail permissions on the key, prevents CloudTrail from logging events to the event data store, and prevents users from querying the data in the event data store that was encrypted with the key. After you associate an event data store with a KMS key, the KMS key cannot be removed or changed. Before you disable or delete a KMS key that you are using with an event data store, delete or back up your event data store. \n\nCloudTrail also supports AWS KMS multi-Region keys. For more information about multi-Region keys, see [Using multi-Region keys](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html) in the *AWS Key Management Service Developer Guide* .\n\nExamples:\n\n- `alias/MyAliasName`\n- `arn:aws:kms:us-east-2:123456789012:alias/MyAliasName`\n- `arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012`\n- `12345678-1234-1234-1234-123456789012`",
         "MultiRegionEnabled": "Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created.",
         "Name": "The name of the event data store.",
@@ -8592,13 +8623,23 @@
       "properties": {
         "EndsWith": "An operator that includes events that match the last few characters of the event record field specified as the value of `Field` .",
         "Equals": "An operator that includes events that match the exact value of the event record field specified as the value of `Field` . This is the only valid operator that you can use with the `readOnly` , `eventCategory` , and `resources.type` fields.",
-        "Field": "A field in a CloudTrail event record on which to filter events to be logged. For event data stores for AWS Config configuration items, the field is used only for selecting configuration items as filtering is not supported.\n\nFor CloudTrail event records, supported fields include `readOnly` , `eventCategory` , `eventSource` (for management events), `eventName` , `resources.type` , and `resources.ARN` .\n\nFor AWS Config configuration item records, the only supported field is `eventCategory` .\n\n- *`readOnly`* - Optional. Can be set to `Equals` a value of `true` or `false` . If you do not add this field, CloudTrail logs both `read` and `write` events. A value of `true` logs only `read` events. A value of `false` logs only `write` events.\n- *`eventSource`* - For filtering management events only. This can be set only to `NotEquals` `kms.amazonaws.com` .\n- *`eventName`* - Can use any operator. You can use it to filter in or filter out any data event logged to CloudTrail, such as `PutBucket` or `GetSnapshotBlock` . You can have multiple values for this field, separated by commas.\n- *`eventCategory`* - This is required and must be set to `Equals` . For CloudTrail event records, the value must be `Management` or `Data` . For AWS Config configuration item records, the value must be `ConfigurationItem` .\n- *`resources.type`* - This field is required for CloudTrail data events. `resources.type` can only use the `Equals` operator, and the value can be one of the following:\n\n- `AWS::S3::Object`\n- `AWS::Lambda::Function`\n- `AWS::DynamoDB::Table`\n- `AWS::S3Outposts::Object`\n- `AWS::ManagedBlockchain::Node`\n- `AWS::S3ObjectLambda::AccessPoint`\n- `AWS::EC2::Snapshot`\n- `AWS::S3::AccessPoint`\n- `AWS::DynamoDB::Stream`\n- `AWS::Glue::Table`\n- `AWS::FinSpace::Environment`\n- `AWS::SageMaker::ExperimentTrialComponent`\n- `AWS::SageMaker::FeatureGroup`\n\nYou can have only one `resources.type` field per selector. To log data events on more than one resource type, add another selector.\n- *`resources.ARN`* - You can use any operator with `resources.ARN` , but if you use `Equals` or `NotEquals` , the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type. For example, if resources.type equals `AWS::S3::Object` , the ARN must be in one of the following formats. To log all data events for all objects in a specific S3 bucket, use the `StartsWith` operator, and include only the bucket ARN as the matching value.\n\nThe trailing slash is intentional; do not exclude it. Replace the text between less than and greater than symbols (<>) with resource-specific information.\n\n- `arn:<partition>:s3:::<bucket_name>/`\n- `arn:<partition>:s3:::<bucket_name>/<object_path>/`\n\nWhen `resources.type` equals `AWS::S3::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in one of the following formats. To log events on all objects in an S3 access point, we recommend that you use only the access point ARN, don’t include the object path, and use the `StartsWith` or `NotStartsWith` operators.\n\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>`\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>/object/<object_path>`\n\nWhen resources.type equals `AWS::Lambda::Function` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:lambda:<region>:<account_ID>:function:<function_name>`\n\nWhen resources.type equals `AWS::DynamoDB::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>`\n\nWhen `resources.type` equals `AWS::S3Outposts::Object` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-outposts:<region>:<account_ID>:<object_path>`\n\nWhen `resources.type` equals `AWS::ManagedBlockchain::Node` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:managedblockchain:<region>:<account_ID>:nodes/<node_ID>`\n\nWhen `resources.type` equals `AWS::S3ObjectLambda::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-object-lambda:<region>:<account_ID>:accesspoint/<access_point_name>`\n\nWhen `resources.type` equals `AWS::EC2::Snapshot` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:ec2:<region>::snapshot/<snapshot_ID>`\n\nWhen `resources.type` equals `AWS::DynamoDB::Stream` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>/stream/<date_time>`\n\nWhen `resources.type` equals `AWS::Glue::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:glue:<region>:<account_ID>:table/<database_name>/<table_name>`\n\nWhen `resources.type` equals `AWS::FinSpace::Environment` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:finspace:<region>:<account_ID>:environment/<environment_ID>`\n\nWhen `resources.type` equals `AWS::SageMaker::ExperimentTrialComponent` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:experiment-trial-component/<experiment_trial_component_name>`\n\nWhen `resources.type` equals `AWS::SageMaker::FeatureGroup` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:feature-group/<feature_group_name>`",
+        "Field": "A field in a CloudTrail event record on which to filter events to be logged. For event data stores for AWS Config configuration items, Audit Manager evidence, or non- AWS events, the field is used only for selecting events as filtering is not supported.\n\nFor CloudTrail event records, supported fields include `readOnly` , `eventCategory` , `eventSource` (for management events), `eventName` , `resources.type` , and `resources.ARN` .\n\nFor event data stores for AWS Config configuration items, Audit Manager evidence, or non- AWS events, the only supported field is `eventCategory` .\n\n- *`readOnly`* - Optional. Can be set to `Equals` a value of `true` or `false` . If you do not add this field, CloudTrail logs both `read` and `write` events. A value of `true` logs only `read` events. A value of `false` logs only `write` events.\n- *`eventSource`* - For filtering management events only. This can be set only to `NotEquals` `kms.amazonaws.com` .\n- *`eventName`* - Can use any operator. You can use it to filter in or filter out any data event logged to CloudTrail, such as `PutBucket` or `GetSnapshotBlock` . You can have multiple values for this field, separated by commas.\n- *`eventCategory`* - This is required and must be set to `Equals` .\n\n- For CloudTrail event records, the value must be `Management` or `Data` .\n- For AWS Config configuration items, the value must be `ConfigurationItem` .\n- For Audit Manager evidence, the value must be `Evidence` .\n- For non- AWS events, the value must be `ActivityAuditLog` .\n- *`resources.type`* - This field is required for CloudTrail data events. `resources.type` can only use the `Equals` operator, and the value can be one of the following:\n\n- `AWS::CloudTrail::Channel`\n- `AWS::S3::Object`\n- `AWS::Lambda::Function`\n- `AWS::DynamoDB::Table`\n- `AWS::S3Outposts::Object`\n- `AWS::ManagedBlockchain::Node`\n- `AWS::S3ObjectLambda::AccessPoint`\n- `AWS::EC2::Snapshot`\n- `AWS::S3::AccessPoint`\n- `AWS::DynamoDB::Stream`\n- `AWS::Glue::Table`\n- `AWS::FinSpace::Environment`\n- `AWS::SageMaker::ExperimentTrialComponent`\n- `AWS::SageMaker::FeatureGroup`\n\nYou can have only one `resources.type` field per selector. To log data events on more than one resource type, add another selector.\n- *`resources.ARN`* - You can use any operator with `resources.ARN` , but if you use `Equals` or `NotEquals` , the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type. For example, if resources.type equals `AWS::S3::Object` , the ARN must be in one of the following formats. To log all data events for all objects in a specific S3 bucket, use the `StartsWith` operator, and include only the bucket ARN as the matching value.\n\nThe trailing slash is intentional; do not exclude it. Replace the text between less than and greater than symbols (<>) with resource-specific information.\n\n- `arn:<partition>:s3:::<bucket_name>/`\n- `arn:<partition>:s3:::<bucket_name>/<object_path>/`\n\nWhen `resources.type` equals `AWS::S3::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in one of the following formats. To log events on all objects in an S3 access point, we recommend that you use only the access point ARN, don’t include the object path, and use the `StartsWith` or `NotStartsWith` operators.\n\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>`\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>/object/<object_path>`\n\nWhen resources.type equals `AWS::Lambda::Function` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:lambda:<region>:<account_ID>:function:<function_name>`\n\nWhen resources.type equals `AWS::DynamoDB::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>`\n\nWhen resources.type equals `AWS::CloudTrail::Channel` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:cloudtrail:<region>:<account_ID>:channel/<channel_UUID>`\n\nWhen `resources.type` equals `AWS::S3Outposts::Object` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-outposts:<region>:<account_ID>:<object_path>`\n\nWhen `resources.type` equals `AWS::ManagedBlockchain::Node` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:managedblockchain:<region>:<account_ID>:nodes/<node_ID>`\n\nWhen `resources.type` equals `AWS::S3ObjectLambda::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-object-lambda:<region>:<account_ID>:accesspoint/<access_point_name>`\n\nWhen `resources.type` equals `AWS::EC2::Snapshot` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:ec2:<region>::snapshot/<snapshot_ID>`\n\nWhen `resources.type` equals `AWS::DynamoDB::Stream` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>/stream/<date_time>`\n\nWhen `resources.type` equals `AWS::Glue::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:glue:<region>:<account_ID>:table/<database_name>/<table_name>`\n\nWhen `resources.type` equals `AWS::FinSpace::Environment` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:finspace:<region>:<account_ID>:environment/<environment_ID>`\n\nWhen `resources.type` equals `AWS::SageMaker::ExperimentTrialComponent` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:experiment-trial-component/<experiment_trial_component_name>`\n\nWhen `resources.type` equals `AWS::SageMaker::FeatureGroup` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:feature-group/<feature_group_name>`",
         "NotEndsWith": "An operator that excludes events that match the last few characters of the event record field specified as the value of `Field` .",
         "NotEquals": "An operator that excludes events that match the exact value of the event record field specified as the value of `Field` .",
         "NotStartsWith": "An operator that excludes events that match the first few characters of the event record field specified as the value of `Field` .",
         "StartsWith": "An operator that includes events that match the first few characters of the event record field specified as the value of `Field` ."
       }
     },
+    "AWS::CloudTrail::ResourcePolicy": {
+      "attributes": {
+        "Ref": "When the logical ID of this resource is provided to the Ref intrinsic function, `Ref` returns the resource. The resource is a combination of the resource-based policy document and the channel ARN."
+      },
+      "description": "Attaches a resource-based permission policy to a CloudTrail channel that is used for an integration with an event source outside of AWS . For more information about resource-based policies, see [CloudTrail resource-based policy examples](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/security_iam_resource-based-policy-examples.html) in the *CloudTrail User Guide* .",
+      "properties": {
+        "ResourceArn": "The Amazon Resource Name (ARN) of the CloudTrail channel attached to the resource-based policy. The following is the format of a resource ARN: `arn:aws:cloudtrail:us-east-2:123456789012:channel/MyChannel` .",
+        "ResourcePolicy": "A JSON-formatted string for an AWS resource-based policy.\n\nThe following are requirements for the resource policy:\n\n- Contains only one action: cloudtrail-data:PutAuditEvents\n- Contains at least one statement. The policy can have a maximum of 20 statements.\n- Each statement contains at least one principal. A statement can have a maximum of 50 principals."
+      }
+    },
     "AWS::CloudTrail::Trail": {
       "attributes": {
         "Arn": "`Ref` returns the ARN of the CloudTrail trail, such as `arn:aws:cloudtrail:us-east-2:123456789012:trail/myCloudTrail` .",
@@ -10706,10 +10747,10 @@
       "attributes": {
         "Ref": ""
       },
-      "description": "",
+      "description": "The approved origin for the instance.",
       "properties": {
-        "InstanceId": "",
-        "Origin": ""
+        "InstanceId": "The Amazon Resource Name (ARN) of the instance.\n\n*Minimum* : `1`\n\n*Maximum* : `100`",
+        "Origin": "Domain name to be added to the allow-list of the instance.\n\n*Maximum* : `267`"
       }
     },
     "AWS::Connect::ContactFlow": {
@@ -10864,14 +10905,14 @@
     },
     "AWS::Connect::IntegrationAssociation": {
       "attributes": {
-        "IntegrationAssociationId": "",
+        "IntegrationAssociationId": "Identifier of the association with an Amazon Connect instance.",
         "Ref": ""
       },
-      "description": "Creates an AWS resource association with an Amazon Connect instance.",
+      "description": "Specifies the association of an AWS resource such as Lex bot (both v1 and v2) and Lambda function with an Amazon Connect instance.",
       "properties": {
-        "InstanceId": "The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.",
-        "IntegrationArn": "The Amazon Resource Name (ARN) for the AppIntegration.",
-        "IntegrationType": "The integration type."
+        "InstanceId": "The Amazon Resource Name (ARN) of the instance.\n\n*Minimum* : `1`\n\n*Maximum* : `100`",
+        "IntegrationArn": "ARN of the integration being associated with the instance.\n\n*Minimum* : `1`\n\n*Maximum* : `140`",
+        "IntegrationType": "Specifies the integration type to be associated with the instance.\n\n*Allowed Values* : `LEX_BOT` | `LAMBDA_FUNCTION`"
       }
     },
     "AWS::Connect::PhoneNumber": {
@@ -11017,13 +11058,13 @@
     },
     "AWS::Connect::SecurityKey": {
       "attributes": {
-        "AssociationId": "",
+        "AssociationId": "An `AssociationId` is automatically generated when a storage config is associated with an instance.",
         "Ref": ""
       },
-      "description": "Configuration information of the security key.",
+      "description": "The security key for the instance.\n\n> Only two security keys are allowed per Amazon Connect instance.",
       "properties": {
-        "InstanceId": "",
-        "Key": "The key of the security key."
+        "InstanceId": "The Amazon Resource Name (ARN) of the instance.\n\n*Minimum* : `1`\n\n*Maximum* : `100`",
+        "Key": "A valid security key in PEM format.\n\n*Minimum* : `1`\n\n*Maximum* : `1024`"
       }
     },
     "AWS::Connect::TaskTemplate": {
@@ -13229,12 +13270,12 @@
       "description": "Information about a filter used to specify which AWS resources are analyzed for anomalous behavior by DevOps Guru.",
       "properties": {
         "CloudFormation": "Information about AWS CloudFormation stacks. You can use up to 500 stacks to specify which AWS resources in your account to analyze. For more information, see [Stacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacks.html) in the *AWS CloudFormation User Guide* .",
-        "Tags": "The AWS tags used to filter the resources in the resource collection.\n\nTags help you identify and organize your AWS resources. Many AWS services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you can assign the same tag to an Amazon DynamoDB table resource that you assign to an AWS Lambda function. For more information about using tags, see the [Tagging best practices](https://docs.aws.amazon.com/https://d1.awsstatic.com/whitepapers/aws-tagging-best-practices.pdf) whitepaper.\n\nEach AWS tag has two parts.\n\n- A tag *key* (for example, `CostCenter` , `Environment` , `Project` , or `Secret` ). Tag *keys* are case-sensitive.\n- An optional field known as a tag *value* (for example, `111122223333` , `Production` , or a team name). Omitting the tag *value* is the same as using an empty string. Like tag *keys* , tag *values* are case-sensitive.\n\nTogether these are known as *key* - *value* pairs.\n\n> The string used for a *key* in a tag that you use to define your resource coverage must begin with the prefix `Devops-guru-` . The tag *key* might be `DevOps-Guru-deployment-application` or `devops-guru-rds-application` . When you create a *key* , the case of characters in the *key* can be whatever you choose. After you create a *key* , it is case-sensitive. For example, DevOps Guru works with a *key* named `devops-guru-rds` and a *key* named `DevOps-Guru-RDS` , and these act as two different *keys* . Possible *key* / *value* pairs in your application might be `Devops-Guru-production-application/RDS` or `Devops-Guru-production-application/containers` ."
+        "Tags": "The AWS tags used to filter the resources in the resource collection.\n\nTags help you identify and organize your AWS resources. Many AWS services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you can assign the same tag to an Amazon DynamoDB table resource that you assign to an AWS Lambda function. For more information about using tags, see the [Tagging best practices](https://docs.aws.amazon.com/https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html) whitepaper.\n\nEach AWS tag has two parts.\n\n- A tag *key* (for example, `CostCenter` , `Environment` , `Project` , or `Secret` ). Tag *keys* are case-sensitive.\n- An optional field known as a tag *value* (for example, `111122223333` , `Production` , or a team name). Omitting the tag *value* is the same as using an empty string. Like tag *keys* , tag *values* are case-sensitive.\n\nTogether these are known as *key* - *value* pairs.\n\n> The string used for a *key* in a tag that you use to define your resource coverage must begin with the prefix `Devops-guru-` . The tag *key* might be `DevOps-Guru-deployment-application` or `devops-guru-rds-application` . When you create a *key* , the case of characters in the *key* can be whatever you choose. After you create a *key* , it is case-sensitive. For example, DevOps Guru works with a *key* named `devops-guru-rds` and a *key* named `DevOps-Guru-RDS` , and these act as two different *keys* . Possible *key* / *value* pairs in your application might be `Devops-Guru-production-application/RDS` or `Devops-Guru-production-application/containers` ."
       }
     },
     "AWS::DevOpsGuru::ResourceCollection.TagCollection": {
       "attributes": {},
-      "description": "A collection of AWS tags.\n\nTags help you identify and organize your AWS resources. Many AWS services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you can assign the same tag to an Amazon DynamoDB table resource that you assign to an AWS Lambda function. For more information about using tags, see the [Tagging best practices](https://docs.aws.amazon.com/https://d1.awsstatic.com/whitepapers/aws-tagging-best-practices.pdf) whitepaper.\n\nEach AWS tag has two parts.\n\n- A tag *key* (for example, `CostCenter` , `Environment` , `Project` , or `Secret` ). Tag *keys* are case-sensitive.\n- An optional field known as a tag *value* (for example, `111122223333` , `Production` , or a team name). Omitting the tag *value* is the same as using an empty string. Like tag *keys* , tag *values* are case-sensitive.\n\nTogether these are known as *key* - *value* pairs.\n\n> The string used for a *key* in a tag that you use to define your resource coverage must begin with the prefix `Devops-guru-` . The tag *key* might be `DevOps-Guru-deployment-application` or `devops-guru-rds-application` . When you create a *key* , the case of characters in the *key* can be whatever you choose. After you create a *key* , it is case-sensitive. For example, DevOps Guru works with a *key* named `devops-guru-rds` and a *key* named `DevOps-Guru-RDS` , and these act as two different *keys* . Possible *key* / *value* pairs in your application might be `Devops-Guru-production-application/RDS` or `Devops-Guru-production-application/containers` .",
+      "description": "A collection of AWS tags.\n\nTags help you identify and organize your AWS resources. Many AWS services support tagging, so you can assign the same tag to resources from different services to indicate that the resources are related. For example, you can assign the same tag to an Amazon DynamoDB table resource that you assign to an AWS Lambda function. For more information about using tags, see the [Tagging best practices](https://docs.aws.amazon.com/https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html) whitepaper.\n\nEach AWS tag has two parts.\n\n- A tag *key* (for example, `CostCenter` , `Environment` , `Project` , or `Secret` ). Tag *keys* are case-sensitive.\n- An optional field known as a tag *value* (for example, `111122223333` , `Production` , or a team name). Omitting the tag *value* is the same as using an empty string. Like tag *keys* , tag *values* are case-sensitive.\n\nTogether these are known as *key* - *value* pairs.\n\n> The string used for a *key* in a tag that you use to define your resource coverage must begin with the prefix `Devops-guru-` . The tag *key* might be `DevOps-Guru-deployment-application` or `devops-guru-rds-application` . When you create a *key* , the case of characters in the *key* can be whatever you choose. After you create a *key* , it is case-sensitive. For example, DevOps Guru works with a *key* named `devops-guru-rds` and a *key* named `DevOps-Guru-RDS` , and these act as two different *keys* . Possible *key* / *value* pairs in your application might be `Devops-Guru-production-application/RDS` or `Devops-Guru-production-application/containers` .",
       "properties": {
         "AppBoundaryKey": "An AWS tag *key* that is used to identify the AWS resources that DevOps Guru analyzes. All AWS resources in your account and Region tagged with this *key* make up your DevOps Guru application and analysis boundary.\n\n> The string used for a *key* in a tag that you use to define your resource coverage must begin with the prefix `Devops-guru-` . The tag *key* might be `DevOps-Guru-deployment-application` or `devops-guru-rds-application` . When you create a *key* , the case of characters in the *key* can be whatever you choose. After you create a *key* , it is case-sensitive. For example, DevOps Guru works with a *key* named `devops-guru-rds` and a *key* named `DevOps-Guru-RDS` , and these act as two different *keys* . Possible *key* / *value* pairs in your application might be `Devops-Guru-production-application/RDS` or `Devops-Guru-production-application/containers` .",
         "TagValues": "The values in an AWS tag collection.\n\nThe tag's *value* is an optional field used to associate a string with the tag *key* (for example, `111122223333` , `Production` , or a team name). The *key* and *value* are the tag's *key* pair. Omitting the tag *value* is the same as using an empty string. Like tag *keys* , tag *values* are case-sensitive. You can specify a maximum of 256 characters for a tag value."
@@ -13890,7 +13931,7 @@
     },
     "AWS::EC2::CapacityReservationFleet.TagSpecification": {
       "attributes": {},
-      "description": "The tags to apply to a resource when the resource is being created.\n\n> The `Valid Values` lists all the resource types that can be tagged. However, the action you're using might not support tagging all of these resource types. If you try to tag a resource type that is unsupported for the action you're using, you'll get an error.",
+      "description": "The tags to apply to a resource when the resource is being created. When you specify a tag, you must specify the resource type to tag, otherwise the request will fail.\n\n> The `Valid Values` lists all the resource types that can be tagged. However, the action you're using might not support tagging all of these resource types. If you try to tag a resource type that is unsupported for the action you're using, you'll get an error.",
       "properties": {
         "ResourceType": "The type of resource to tag on creation. Specify `capacity-reservation-fleet` .\n\nTo tag a resource after it has been created, see [CreateTags](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html) .",
         "Tags": "The tags to apply to the resource."
@@ -14003,7 +14044,7 @@
     },
     "AWS::EC2::ClientVpnEndpoint.TagSpecification": {
       "attributes": {},
-      "description": "The tags to apply to a resource when the resource is being created.\n\n> The `Valid Values` lists all the resource types that can be tagged. However, the action you're using might not support tagging all of these resource types. If you try to tag a resource type that is unsupported for the action you're using, you'll get an error.",
+      "description": "The tags to apply to a resource when the resource is being created. When you specify a tag, you must specify the resource type to tag, otherwise the request will fail.\n\n> The `Valid Values` lists all the resource types that can be tagged. However, the action you're using might not support tagging all of these resource types. If you try to tag a resource type that is unsupported for the action you're using, you'll get an error.",
       "properties": {
         "ResourceType": "The type of resource to tag.",
         "Tags": "The tags to apply to the resource."
@@ -14305,7 +14346,7 @@
         "NetworkBorderGroup": "A unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. Use this parameter to limit the IP address to this location. IP addresses cannot move between network border groups.\n\nUse [DescribeAvailabilityZones](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html) to view the network border groups.\n\nYou cannot use a network border group with EC2 Classic. If you attempt this operation on EC2 Classic, you receive an `InvalidParameterCombination` error.",
         "PublicIpv4Pool": "The ID of an address pool that you own. Use this parameter to let Amazon EC2 select an address from the address pool.\n\n> Updates to the `PublicIpv4Pool` property may require *some interruptions* . Updates on an EIP reassociates the address on its associated resource.",
         "Tags": "Any tags assigned to the Elastic IP address.\n\n> Updates to the `Tags` property may require *some interruptions* . Updates on an EIP reassociates the address on its associated resource.",
-        "TransferAddress": "The Elastic IP address you are accepting for transfer."
+        "TransferAddress": "The Elastic IP address you are accepting for transfer. You can only accept one transferred address. For more information on Elastic IP address transfers, see [Transfer Elastic IP addresses](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html#transfer-EIPs-intro) in the *Amazon Virtual Private Cloud User Guide* ."
       }
     },
     "AWS::EC2::EIPAssociation": {
@@ -14460,6 +14501,7 @@
         "IpamScopeId": "The ID of the scope in which you would like to create the IPAM pool.",
         "Locale": "The locale of the IPAM pool. In IPAM, the locale is the AWS Region where you want to make an IPAM pool available for allocations. Only resources in the same Region as the locale of the pool can get IP address allocations from the pool. You can only allocate a CIDR for a VPC, for example, from an IPAM pool that shares a locale with the VPC’s Region. Note that once you choose a Locale for a pool, you cannot modify it. If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.",
         "ProvisionedCidrs": "Information about the CIDRs provisioned to an IPAM pool.",
+        "PublicIpSource": "The IP address source for pools in the public scope. Only used for provisioning IP address CIDRs to pools in the public scope. Default is `BYOIP` . For more information, see [Create IPv6 pools](https://docs.aws.amazon.com//vpc/latest/ipam/intro-create-ipv6-pools.html) in the *Amazon VPC IPAM User Guide* . By default, you can add only one Amazon-provided IPv6 CIDR block to a top-level IPv6 pool. For information on increasing the default limit, see [Quotas for your IPAM](https://docs.aws.amazon.com//vpc/latest/ipam/quotas-ipam.html) in the *Amazon VPC IPAM User Guide* .",
         "PubliclyAdvertisable": "Determines if a pool is publicly advertisable. This option is not available for pools with AddressFamily set to `ipv4` .",
         "SourceIpamPoolId": "The ID of the source IPAM pool. You can use this option to create an IPAM pool within an existing source pool.",
         "Tags": "The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key `Owner` and the value `TeamA` , specify `tag:Owner` for the filter name and `TeamA` for the filter value."
@@ -14467,11 +14509,65 @@
     },
     "AWS::EC2::IPAMPool.ProvisionedCidr": {
       "attributes": {},
-      "description": "The CIDR provisioned to the IPAM pool. A CIDR is a representation of an IP address and its associated network mask (or netmask) and refers to a range of IP addresses. An IPv4 CIDR example is `10.24.34.0/23` . An IPv6 CIDR example is `2001:DB8::/32` .",
+      "description": "The CIDR provisioned to the IPAM pool. A CIDR is a representation of an IP address and its associated network mask (or netmask) and refers to a range of IP addresses. An IPv4 CIDR example is `10.24.34.0/23` . An IPv6 CIDR example is `2001:DB8::/32` .\n\n> This resource type does not allow you to provision a CIDR using the netmask length. To provision a CIDR using netmask length, use [AWS::EC2::IPAMPoolCidr](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-ipampoolcidr.html) .",
       "properties": {
         "Cidr": "The CIDR provisioned to the IPAM pool. A CIDR is a representation of an IP address and its associated network mask (or netmask) and refers to a range of IP addresses. An IPv4 CIDR example is `10.24.34.0/23` . An IPv6 CIDR example is `2001:DB8::/32` ."
       }
     },
+    "AWS::EC2::IPAMPoolCidr": {
+      "attributes": {
+        "IpamPoolCidrId": "The IPAM pool CIDR ID.",
+        "Ref": "`Ref` returns the IPAM pool ID and IPAM pool CIDR ID in the following format: `ipam-pool-01123456|ipam-pool-cidr-0123456` .",
+        "State": "The state of the CIDR."
+      },
+      "description": "A CIDR provisioned to an IPAM pool.",
+      "properties": {
+        "Cidr": "The CIDR provisioned to the IPAM pool. A CIDR is a representation of an IP address and its associated network mask (or netmask) and refers to a range of IP addresses. An IPv4 CIDR example is `10.24.34.0/23` . An IPv6 CIDR example is `2001:DB8::/32` .",
+        "IpamPoolId": "The ID of the IPAM pool.",
+        "NetmaskLength": "The netmask length of the CIDR you'd like to provision to a pool. Can be used for provisioning Amazon-provided IPv6 CIDRs to top-level pools and for provisioning CIDRs to pools with source pools. Cannot be used to provision BYOIP CIDRs to top-level pools. \"NetmaskLength\" or \"Cidr\" is required."
+      }
+    },
+    "AWS::EC2::IPAMResourceDiscovery": {
+      "attributes": {
+        "IpamResourceDiscoveryArn": "The resource discovery ARN.",
+        "IpamResourceDiscoveryId": "The resource discovery ID.",
+        "IpamResourceDiscoveryRegion": "The resource discovery Region.",
+        "IsDefault": "Defines if the resource discovery is the default. The default resource discovery is the resource discovery automatically created when you create an IPAM.",
+        "OwnerId": "The owner ID.",
+        "Ref": "`Ref` returns the resource discovery ID. For example: `ipam-res-disco-111122223333` .",
+        "State": "The resource discovery's state.\n\n- `create-in-progress` - Resource discovery is being created.\n- `create-complete` - Resource discovery creation is complete.\n- `create-failed` - Resource discovery creation has failed.\n- `modify-in-progress` - Resource discovery is being modified.\n- `modify-complete` - Resource discovery modification is complete.\n- `modify-failed` - Resource discovery modification has failed.\n- `delete-in-progress` - Resource discovery is being deleted.\n- `delete-complete` - Resource discovery deletion is complete.\n- `delete-failed` - Resource discovery deletion has failed.\n- `isolate-in-progress` - AWS account that created the resource discovery has been removed and the resource discovery is being isolated.\n- `isolate-complete` - Resource discovery isolation is complete.\n- `restore-in-progress` - AWS account that created the resource discovery and was isolated has been restored."
+      },
+      "description": "A resource discovery is an IPAM component that enables IPAM to manage and monitor resources that belong to the owning account.",
+      "properties": {
+        "Description": "The resource discovery description.",
+        "OperatingRegions": "The operating Regions for the resource discovery. Operating Regions are AWS Regions where the IPAM is allowed to manage IP address CIDRs. IPAM only discovers and monitors resources in the AWS Regions you select as operating Regions.",
+        "Tags": "A tag is a label that you assign to an AWS resource. Each tag consists of a key and an optional value. You can use tags to search and filter your resources or track your AWS costs."
+      }
+    },
+    "AWS::EC2::IPAMResourceDiscovery.IpamOperatingRegion": {
+      "attributes": {},
+      "description": "The operating Regions for an IPAM. Operating Regions are AWS Regions where the IPAM is allowed to manage IP address CIDRs. IPAM only discovers and monitors resources in the AWS Regions you select as operating Regions.\n\nFor more information about operating Regions, see [Create an IPAM](https://docs.aws.amazon.com//vpc/latest/ipam/create-ipam.html) in the *Amazon VPC IPAM User Guide* .",
+      "properties": {
+        "RegionName": "The name of the operating Region."
+      }
+    },
+    "AWS::EC2::IPAMResourceDiscoveryAssociation": {
+      "attributes": {
+        "IpamResourceDiscoveryAssociationArn": "The resource discovery association ARN.",
+        "IpamResourceDiscoveryAssociationId": "The resource discovery association ID.",
+        "IsDefault": "Defines if the resource discovery is the default. When you create an IPAM, a default resource discovery is created for your IPAM and it's associated with your IPAM.",
+        "OwnerId": "The owner ID.",
+        "Ref": "`Ref` returns the resource discovery ID. For example: `ipam-res-disco-111122223333` .",
+        "State": "The lifecycle state of the association when you associate or disassociate a resource discovery.\n\n- `associate-in-progress` - Resource discovery is being associated.\n- `associate-complete` - Resource discovery association is complete.\n- `associate-failed` - Resource discovery association has failed.\n- `disassociate-in-progress` - Resource discovery is being disassociated.\n- `disassociate-complete` - Resource discovery disassociation is complete.\n- `disassociate-failed` - Resource discovery disassociation has failed.\n- `isolate-in-progress` - AWS account that created the resource discovery association has been removed and the resource discovery associatation is being isolated.\n- `isolate-complete` - Resource discovery isolation is complete..\n- `restore-in-progress` - Resource discovery is being restored.",
+        "Status": "The resource discovery status.\n\n- `active` : The connection or permissions required to read the results of the resource discovery are intact.\n- `not-found` : The connection or permissions required to read the results of the resource discovery are broken. This may happen if the owner of the resource discovery stopped sharing it or deleted the resource discovery. Verify the resource discovery still exists and the AWS RAM resource share is still in tact."
+      },
+      "description": "An IPAM resource discovery association. An associated resource discovery is a resource discovery that has been associated with an IPAM. IPAM aggregates the resource CIDRs discovered by the associated resource discovery.",
+      "properties": {
+        "IpamId": "The IPAM ID.",
+        "IpamResourceDiscoveryId": "The resource discovery ID.",
+        "Tags": "A tag is a label that you assign to an AWS resource. Each tag consists of a key and an optional value. You can use tags to search and filter your resources or track your AWS costs."
+      }
+    },
     "AWS::EC2::IPAMScope": {
       "attributes": {
         "Arn": "The ARN of the scope.",
@@ -14538,7 +14634,7 @@
         "SubnetId": "[EC2-VPC] The ID of the subnet to launch the instance into.\n\nIf you specify a network interface, you must specify any subnets as part of the network interface.",
         "Tags": "The tags to add to the instance. These tags are not applied to the EBS volumes, such as the root volume.",
         "Tenancy": "The tenancy of the instance (if the instance is running in a VPC). An instance with a tenancy of `dedicated` runs on single-tenant hardware.",
-        "UserData": "The user data script to make available to the instance. For more information, see [Run commands on your Linux instance at launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html) and [Run commands on your Windows instance at launch](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-windows-user-data.html) . If you are using a command line tool, base64-encoding is performed for you, and you can load the text from a file. Otherwise, you must provide base64-encoded text. User data is limited to 16 KB.",
+        "UserData": "The user data script to make available to the instance. User data is limited to 16 KB. You must provide base64-encoded text. For more information, see [Fn::Base64](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-base64.html) .\n\nUser data runs only at instance launch. For more information, see [Run commands on your Linux instance at launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html) and [Run commands on your Windows instance at launch](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-windows-user-data.html) .",
         "Volumes": "The volumes to attach to the instance."
       }
     },
@@ -15147,11 +15243,11 @@
       "properties": {
         "AllocationId": "[Public NAT gateway only] The allocation ID of the Elastic IP address that's associated with the NAT gateway. This property is required for a public NAT gateway and cannot be specified with a private NAT gateway.",
         "ConnectivityType": "Indicates whether the NAT gateway supports public or private connectivity. The default is public connectivity.",
-        "MaxDrainDurationSeconds": "",
+        "MaxDrainDurationSeconds": "The maximum amount of time to wait (in seconds) before forcibly releasing the IP addresses if connections are still in progress. Default value is 350 seconds.",
         "PrivateIpAddress": "The private IPv4 address to assign to the NAT gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.",
-        "SecondaryAllocationIds": "",
-        "SecondaryPrivateIpAddressCount": "",
-        "SecondaryPrivateIpAddresses": "",
+        "SecondaryAllocationIds": "Secondary EIP allocation IDs. For more information about secondary addresses, see [Create a NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-creating) in the *Amazon Virtual Private Cloud User Guide* .",
+        "SecondaryPrivateIpAddressCount": "[Private NAT gateway only] The number of secondary private IPv4 addresses you want to assign to the NAT gateway. For more information about secondary addresses, see [Create a NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-creating) in the *Amazon Virtual Private Cloud User Guide* .\n\n> `SecondaryPrivateIpAddressCount` and `SecondaryPrivateIpAddresses` cannot be set at the same time.",
+        "SecondaryPrivateIpAddresses": "Secondary private IPv4 addresses. For more information about secondary addresses, see [Create a NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-creating) in the *Amazon Virtual Private Cloud User Guide* .\n\n> `SecondaryPrivateIpAddressCount` and `SecondaryPrivateIpAddresses` cannot be set at the same time.",
         "SubnetId": "The ID of the subnet in which the NAT gateway is located.",
         "Tags": "The tags for the NAT gateway."
       }
@@ -16649,7 +16745,7 @@
         "SnapshotId": "The snapshot from which to create the volume. You must specify either a snapshot ID or a volume size.",
         "Tags": "The tags to apply to the volume during creation.",
         "Throughput": "The throughput to provision for a volume, with a maximum of 1,000 MiB/s.\n\nThis parameter is valid only for `gp3` volumes. The default value is 125.\n\nValid Range: Minimum value of 125. Maximum value of 1000.",
-        "VolumeType": "The volume type. This parameter can be one of the following values:\n\n- General Purpose SSD: `gp2` | `gp3`\n- Provisioned IOPS SSD: `io1` | `io2`\n- Throughput Optimized HDD: `st1`\n- Cold HDD: `sc1`\n- Magnetic: `standard`\n\n> Throughput Optimized HDD ( `st1` ) and Cold HDD ( `sc1` ) volumes can't be used as boot volumes. \n\nFor more information, see [Amazon EBS volume types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) in the *Amazon Elastic Compute Cloud User Guide* .\n\nDefault: `gp2`"
+        "VolumeType": "The volume type. This parameter can be one of the following values:\n\n- General Purpose SSD: `gp2` | `gp3`\n- Provisioned IOPS SSD: `io1` | `io2`\n- Throughput Optimized HDD: `st1`\n- Cold HDD: `sc1`\n- Magnetic: `standard`\n\nFor more information, see [Amazon EBS volume types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) in the *Amazon Elastic Compute Cloud User Guide* .\n\nDefault: `gp2`"
       }
     },
     "AWS::EC2::VolumeAttachment": {
@@ -19450,13 +19546,13 @@
     },
     "AWS::ElasticLoadBalancingV2::TargetGroup": {
       "attributes": {
-        "LoadBalancerArns": "The Amazon Resource Names (ARNs) of the load balancers that route traffic to this target group.",
+        "LoadBalancerArns": "The Amazon Resource Name (ARN) of the load balancer that routes traffic to this target group.",
         "Ref": "`Ref` returns the Amazon Resource Name (ARN) of the target group.",
-        "TargetGroupArn": "",
+        "TargetGroupArn": "The Amazon Resource Name (ARN) of the target group.",
         "TargetGroupFullName": "The full name of the target group. For example, `targetgroup/my-target-group/cbf133c568e0d028` .",
         "TargetGroupName": "The name of the target group. For example, `my-target-group` ."
       },
-      "description": "Specifies a target group for an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer.\n\nIf the protocol of the target group is TCP, TLS, UDP, or TCP_UDP, you can't modify the health check protocol, interval, timeout, or success codes.\n\nBefore you register a Lambda function as a target, you must create a `AWS::Lambda::Permission` resource that grants the Elastic Load Balancing service principal permission to invoke the Lambda function.",
+      "description": "Specifies a target group for an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer.\n\nBefore you register a Lambda function as a target, you must create a `AWS::Lambda::Permission` resource that grants the Elastic Load Balancing service principal permission to invoke the Lambda function.",
       "properties": {
         "HealthCheckEnabled": "Indicates whether health checks are enabled. If the target type is `lambda` , health checks are disabled by default but can be enabled. If the target type is `instance` , `ip` , or `alb` , health checks are always enabled and cannot be disabled.",
         "HealthCheckIntervalSeconds": "The approximate amount of time, in seconds, between health checks of an individual target. The range is 5-300. If the target group protocol is TCP, TLS, UDP, TCP_UDP, HTTP or HTTPS, the default is 30 seconds. If the target group protocol is GENEVE, the default is 10 seconds. If the target type is `lambda` , the default is 35 seconds.",
@@ -19464,7 +19560,7 @@
         "HealthCheckPort": "The port the load balancer uses when performing health checks on targets. If the protocol is HTTP, HTTPS, TCP, TLS, UDP, or TCP_UDP, the default is `traffic-port` , which is the port on which each target receives traffic from the load balancer. If the protocol is GENEVE, the default is port 80.",
         "HealthCheckProtocol": "The protocol the load balancer uses when performing health checks on targets. For Application Load Balancers, the default is HTTP. For Network Load Balancers and Gateway Load Balancers, the default is TCP. The TCP protocol is not supported for health checks if the protocol of the target group is HTTP or HTTPS. The GENEVE, TLS, UDP, and TCP_UDP protocols are not supported for health checks.",
         "HealthCheckTimeoutSeconds": "The amount of time, in seconds, during which no response from a target means a failed health check. The range is 2–120 seconds. For target groups with a protocol of HTTP, the default is 6 seconds. For target groups with a protocol of TCP, TLS or HTTPS, the default is 10 seconds. For target groups with a protocol of GENEVE, the default is 5 seconds. If the target type is `lambda` , the default is 30 seconds.",
-        "HealthyThresholdCount": "The number of consecutive health check successes required before considering a target healthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 5. For target groups with a protocol of GENEVE, the default is 3. If the target type is `lambda` , the default is 5.",
+        "HealthyThresholdCount": "The number of consecutive health check successes required before considering a target healthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 5. For target groups with a protocol of GENEVE, the default is 5. If the target type is `lambda` , the default is 5.",
         "IpAddressType": "The type of IP address used for this target group. The possible values are `ipv4` and `ipv6` . This is an optional parameter. If not specified, the IP address type defaults to `ipv4` .",
         "Matcher": "[HTTP/HTTPS health checks] The HTTP or gRPC codes to use when checking for a successful response from a target. For target groups with a protocol of TCP, TCP_UDP, UDP or TLS the range is 200-599. For target groups with a protocol of HTTP or HTTPS, the range is 200-499. For target groups with a protocol of GENEVE, the range is 200-399.",
         "Name": "The name of the target group.\n\nThis name must be unique per region per account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen.",
@@ -19475,7 +19571,7 @@
         "TargetGroupAttributes": "The attributes.",
         "TargetType": "The type of target that you must specify when registering targets with this target group. You can't specify targets for a target group using more than one target type.\n\n- `instance` - Register targets by instance ID. This is the default value.\n- `ip` - Register targets by IP address. You can specify IP addresses from the subnets of the virtual private cloud (VPC) for the target group, the RFC 1918 range (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), and the RFC 6598 range (100.64.0.0/10). You can't specify publicly routable IP addresses.\n- `lambda` - Register a single Lambda function as a target.\n- `alb` - Register a single Application Load Balancer as a target.",
         "Targets": "The targets.",
-        "UnhealthyThresholdCount": "The number of consecutive health check failures required before considering a target unhealthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 2. For target groups with a protocol of GENEVE, the default is 3. If the target type is `lambda` , the default is 5.",
+        "UnhealthyThresholdCount": "The number of consecutive health check failures required before considering a target unhealthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 2. For target groups with a protocol of GENEVE, the default is 2. If the target type is `lambda` , the default is 5.",
         "VpcId": "The identifier of the virtual private cloud (VPC). If the target is a Lambda function, this parameter does not apply. Otherwise, this parameter is required."
       }
     },
@@ -30352,7 +30448,7 @@
     },
     "AWS::LakeFormation::Resource": {
       "attributes": {},
-      "description": "The `AWS::LakeFormation::Resource` represents the data (  buckets and folders) that is being registered with AWS Lake Formation . During a stack operation, AWS CloudFormation calls the AWS Lake Formation [`RegisterResource`](https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-credential-vending.html#aws-lake-formation-api-credential-vending-RegisterResource) API operation to register the resource. To remove a `Resource` type, AWS CloudFormation calls the AWS Lake Formation [`DeregisterResource`](https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-credential-vending.html#aws-lake-formation-api-credential-vending-DeregisterResource) API operation.",
+      "description": "The `AWS::LakeFormation::Resource` represents the data (  buckets and folders) that is being registered with AWS Lake Formation . During a stack operation, AWS CloudFormation calls the AWS Lake Formation [`RegisterResource`](https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-credential-vending.html#aws-lake-formation-api-credential-vending-RegisterResource) API operation to register the resource. To remove a `Resource` type, AWS CloudFormation calls the AWS Lake Formation [`DeregisterResource`](https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-credential-vending.html#aws-lake-formation-api-credential-vending-DeregisterResource) API operation.\n\n> `AWS::LakeFormation::Resource` is a legacy resource that doesn't support the `UPDATE` operation. Changes to the resource will require an explicit deletion and recreation to apply new properties.",
       "properties": {
         "ResourceArn": "The Amazon Resource Name (ARN) of the resource.",
         "RoleArn": "The IAM role that registered a resource.",
@@ -30416,7 +30512,7 @@
         "CatalogId": "The identifier for the Data Catalog . By default, it is the account ID of the caller.",
         "DatabaseName": "The name of the database for the table. Unique to a Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database privileges to a principal.",
         "Name": "The name of the table.",
-        "TableWildcard": "A wildcard object representing every table under a database.\n\nAt least one of `TableResource$Name` or `TableResource$TableWildcard` is required."
+        "TableWildcard": "A wildcard object representing every table under a database.This is an object with no properties that effectively behaves as a true or false depending on whether not it is passed as a parameter. The valid inputs for a property with this type in either yaml or json is null or {}.\n\nAt least one of `TableResource$Name` or `TableResource$TableWildcard` is required."
       }
     },
     "AWS::LakeFormation::TagAssociation.TableWithColumnsResource": {
@@ -30650,7 +30746,7 @@
         "FunctionName": "The name of the Lambda function, up to 64 characters in length. If you don't specify a name, AWS CloudFormation generates one.\n\nIf you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.",
         "Handler": "The name of the method within your code that Lambda calls to run your function. Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see [Lambda programming model](https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html) .",
         "ImageConfig": "Configuration values that override the container image Dockerfile settings. For more information, see [Container image settings](https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms) .",
-        "KmsKeyArn": "The ARN of the AWS Key Management Service ( AWS KMS ) key that's used to encrypt your function's environment variables. If it's not provided, Lambda uses a default service key.",
+        "KmsKeyArn": "The ARN of the AWS Key Management Service ( AWS KMS ) customer managed key that's used to encrypt your function's [environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption) . When [Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html) is activated, this key is also used to encrypt your function's snapshot. If you don't provide a customer managed key, Lambda uses a default service key.",
         "Layers": "A list of [function layers](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) to add to the function's execution environment. Specify each layer by its ARN, including the version.",
         "MemorySize": "The amount of [memory available to the function](https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html#configuration-memory-console) at runtime. Increasing the function memory also increases its CPU allocation. The default value is 128 MB. The value can be any multiple of 1 MB.",
         "PackageType": "The type of deployment package. Set to `Image` for container image and set `Zip` for .zip file archive.",
@@ -30794,7 +30890,7 @@
         "Action": "The action that the principal can use on the function. For example, `lambda:InvokeFunction` or `lambda:GetFunction` .",
         "EventSourceToken": "For Alexa Smart Home functions, a token that the invoker must supply.",
         "FunctionName": "The name of the Lambda function, version, or alias.\n\n**Name formats** - *Function name* – `my-function` (name-only), `my-function:v1` (with alias).\n- *Function ARN* – `arn:aws:lambda:us-west-2:123456789012:function:my-function` .\n- *Partial ARN* – `123456789012:function:my-function` .\n\nYou can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.",
-        "FunctionUrlAuthType": "The type of authentication that your function URL uses. Set to `AWS_IAM` if you want to restrict access to authenticated IAM users only. Set to `NONE` if you want to bypass IAM authentication to create a public endpoint. For more information, see [Security and auth model for Lambda function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) .",
+        "FunctionUrlAuthType": "The type of authentication that your function URL uses. Set to `AWS_IAM` if you want to restrict access to authenticated users only. Set to `NONE` if you want to bypass IAM authentication to create a public endpoint. For more information, see [Security and auth model for Lambda function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) .",
         "Principal": "The AWS service or AWS account that invokes the function. If you specify a service, use `SourceArn` or `SourceAccount` to limit who can invoke the function through that service.",
         "PrincipalOrgID": "The identifier for your organization in AWS Organizations . Use this to grant permissions to all the AWS accounts under this organization.",
         "SourceAccount": "For AWS service , the ID of the AWS account that owns the resource. Use this together with `SourceArn` to ensure that the specified account owns the resource. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.",
@@ -30809,7 +30905,7 @@
       },
       "description": "The `AWS::Lambda::Url` resource creates a function URL with the specified configuration parameters. A [function URL](https://docs.aws.amazon.com/lambda/latest/dg/lambda-urls.html) is a dedicated HTTP(S) endpoint that you can use to invoke your function.",
       "properties": {
-        "AuthType": "The type of authentication that your function URL uses. Set to `AWS_IAM` if you want to restrict access to authenticated IAM users only. Set to `NONE` if you want to bypass IAM authentication to create a public endpoint. For more information, see [Security and auth model for Lambda function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) .",
+        "AuthType": "The type of authentication that your function URL uses. Set to `AWS_IAM` if you want to restrict access to authenticated users only. Set to `NONE` if you want to bypass IAM authentication to create a public endpoint. For more information, see [Security and auth model for Lambda function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) .",
         "Cors": "The [Cross-Origin Resource Sharing (CORS)](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) settings for your function URL.",
         "InvokeMode": "",
         "Qualifier": "The alias name.",
@@ -30853,16 +30949,16 @@
         "Arn": "The Amazon Resource Name (ARN) of the bot.",
         "Id": "The unique identifier of the bot."
       },
-      "description": "> Amazon Lex V2 is the only supported version in AWS CloudFormation . \n\nSpecifies an Amazon Lex conversational bot.\n\nYou must configure an intent based on the AMAZON.FallbackIntent built-in intent. If you don't add one, creating the bot will fail.",
+      "description": "> Amazon Lex V2 is the only supported version in AWS CloudFormation . \n\nSpecifies an Amazon Lex conversational bot.\n\nYou must configure an intent based on the `AMAZON.FallbackIntent` built-in intent. If you don't add one, creating the bot will fail.",
       "properties": {
         "AutoBuildBotLocales": "Indicates whether Amazon Lex V2 should automatically build the locales for the bot after a change.",
         "BotFileS3Location": "The Amazon S3 location of files used to import a bot. The files must be in the import format specified in [JSON format for importing and exporting](https://docs.aws.amazon.com/lexv2/latest/dg/import-export-format.html) in the *Amazon Lex developer guide.*",
         "BotLocales": "A list of locales for the bot.",
         "BotTags": "A list of tags to add to the bot. You can only add tags when you import a bot. You can't use the `UpdateBot` operation to update tags. To update tags, use the `TagResource` operation.",
-        "DataPrivacy": "Provides information on additional privacy protections Amazon Lex should use with the bot's data.",
+        "DataPrivacy": "",
         "Description": "The description of the version.",
         "IdleSessionTTLInSeconds": "The time, in seconds, that Amazon Lex should keep information about a user's conversation with the bot.\n\nA user interaction remains active for the amount of time specified. If no conversation occurs during this time, the session expires and Amazon Lex deletes any data provided before the timeout.\n\nYou can specify between 60 (1 minute) and 86,400 (24 hours) seconds.",
-        "Name": "The name of the field to filter the list of bots.",
+        "Name": "The name of the bot locale.",
         "RoleArn": "The Amazon Resource Name (ARN) of the IAM role used to build and run the bot.",
         "TestBotAliasSettings": "Specifies configuration settings for the alias used to test the bot. If the `TestBotAliasSettings` property is not specified, the settings are configured with default values.",
         "TestBotAliasTags": "A list of tags to add to the test alias for a bot. You can only add tags when you import a bot. You can't use the `UpdateAlias` operation to update tags. To update tags on the test alias, use the `TagResource` operation."
@@ -30870,57 +30966,57 @@
     },
     "AWS::Lex::Bot.AdvancedRecognitionSetting": {
       "attributes": {},
-      "description": "Specifies settings that enable advanced audio recognition for slot values.",
+      "description": "Provides settings that enable advanced recognition settings for slot values.",
       "properties": {
-        "AudioRecognitionStrategy": "Specifies that Amazon Lex should use slot values as a custom vocabulary when recognizing user utterances."
+        "AudioRecognitionStrategy": "Enables using the slot values as a custom vocabulary for recognizing user utterances."
       }
     },
     "AWS::Lex::Bot.AllowedInputTypes": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies the allowed input types.",
       "properties": {
-        "AllowAudioInput": "",
-        "AllowDTMFInput": ""
+        "AllowAudioInput": "Indicates whether audio input is allowed.",
+        "AllowDTMFInput": "Indicates whether DTMF input is allowed."
       }
     },
     "AWS::Lex::Bot.AudioAndDTMFInputSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies the audio and DTMF input specification.",
       "properties": {
-        "AudioSpecification": "",
-        "DTMFSpecification": "",
-        "StartTimeoutMs": ""
+        "AudioSpecification": "Specifies the settings on audio input.",
+        "DTMFSpecification": "Specifies the settings on DTMF input.",
+        "StartTimeoutMs": "Time for which a bot waits before assuming that the customer isn't going to speak or press a key. This timeout is shared between Audio and DTMF inputs."
       }
     },
     "AWS::Lex::Bot.AudioLogDestination": {
       "attributes": {},
-      "description": "Specifies the location of audio log files collected when conversation logging is enabled for a bot.",
+      "description": "The location of audio log files collected when conversation logging is enabled for a bot.",
       "properties": {
         "S3Bucket": "Specifies the Amazon S3 bucket where the audio files are stored."
       }
     },
     "AWS::Lex::Bot.AudioLogSetting": {
       "attributes": {},
-      "description": "Specifies settings for logging the audio of conversations between Amazon Lex and a user. You specify whether to log audio and the Amazon S3 bucket where the audio file is stored.",
+      "description": "Settings for logging audio of conversations between Amazon Lex and a user. You specify whether to log audio and the Amazon S3 bucket where the audio file is stored.",
       "properties": {
         "Destination": "Specifies the location of the audio log files collected when conversation logging is enabled for a bot.",
-        "Enabled": "Specifies whether audio logging is enabled for the bot."
+        "Enabled": "Determines whether audio logging in enabled for the bot."
       }
     },
     "AWS::Lex::Bot.AudioSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies the audio input specifications.",
       "properties": {
-        "EndTimeoutMs": "",
-        "MaxLengthMs": ""
+        "EndTimeoutMs": "Time for which a bot waits after the customer stops speaking to assume the utterance is finished.",
+        "MaxLengthMs": "Time for how long Amazon Lex waits before speech input is truncated and the speech is returned to application."
       }
     },
     "AWS::Lex::Bot.BotAliasLocaleSettings": {
       "attributes": {},
-      "description": "Specifies settings that are unique to a locale. For example, you can use a different Lambda function for each locale.",
+      "description": "Specifies settings that are unique to a locale. For example, you can use different Lambda function depending on the bot's locale.",
       "properties": {
-        "CodeHookSpecification": "Specifies the Lambda function to use in this locale.",
-        "Enabled": "Specifies whether the locale is enabled for the bot. If the value is false, the locale isn't available for use."
+        "CodeHookSpecification": "Specifies the Lambda function that should be used in the locale.",
+        "Enabled": "Determines whether the locale is enabled for the bot. If the value is `false` , the locale isn't available for use."
       }
     },
     "AWS::Lex::Bot.BotAliasLocaleSettingsItem": {
@@ -30939,71 +31035,71 @@
         "Description": "A description of the bot locale. Use this to help identify the bot locale in lists.",
         "Intents": "One or more intents defined for the locale.",
         "LocaleId": "The identifier of the language and locale that the bot will be used in. The string must match one of the supported locales.",
-        "NluConfidenceThreshold": "Determines the threshold where Amazon Lex will insert the AMAZON.FallbackIntent, AMAZON.KendraSearchIntent, or both when returning alternative intents. You must configure an AMAZON.FallbackIntent. AMAZON.KendraSearchIntent is only inserted if it is configured for the bot.",
+        "NluConfidenceThreshold": "Determines the threshold where Amazon Lex will insert the `AMAZON.FallbackIntent` , `AMAZON.KendraSearchIntent` , or both when returning alternative intents. You must configure an `AMAZON.FallbackIntent` . `AMAZON.KendraSearchIntent` is only inserted if it is configured for the bot.",
         "SlotTypes": "One or more slot types defined for the locale.",
-        "VoiceSettings": "Identifies the Amazon Polly voice used for audio interaction with the user."
+        "VoiceSettings": "Defines settings for using an Amazon Polly voice to communicate with a user."
       }
     },
     "AWS::Lex::Bot.Button": {
       "attributes": {},
       "description": "Describes a button to use on a response card used to gather slot values from a user.",
       "properties": {
-        "Text": "The text that appears on the button. Use this to tell the user the value that is returned when they choose this button.",
+        "Text": "The text that appears on the button. Use this to tell the user what value is returned when they choose this button.",
         "Value": "The value returned to Amazon Lex when the user chooses this button. This must be one of the slot values configured for the slot."
       }
     },
     "AWS::Lex::Bot.CloudWatchLogGroupLogDestination": {
       "attributes": {},
-      "description": "Specifies the Amazon CloudWatch Logs log group where text and metadata logs are delivered. The log group must exist before you enable logging.",
+      "description": "The Amazon CloudWatch Logs log group where the text and metadata logs are delivered. The log group must exist before you enable logging.",
       "properties": {
-        "CloudWatchLogGroupArn": "Specifies the Amazon Resource Name (ARN) of the log group where text and metadata logs are delivered.",
-        "LogPrefix": "Specifies the prefix of the log stream name within the log group that you specified."
+        "CloudWatchLogGroupArn": "The Amazon Resource Name (ARN) of the log group where text and metadata logs are delivered.",
+        "LogPrefix": "The prefix of the log stream name within the log group that you specified"
       }
     },
     "AWS::Lex::Bot.CodeHookSpecification": {
       "attributes": {},
-      "description": "Specifies information about code hooks that Amazon Lex calls during a conversation.",
+      "description": "Contains information about code hooks that Amazon Lex calls during a conversation.",
       "properties": {
         "LambdaCodeHook": "Specifies a Lambda function that verifies requests to a bot or fulfills the user's request to a bot."
       }
     },
     "AWS::Lex::Bot.Condition": {
       "attributes": {},
-      "description": "",
+      "description": "Provides an expression that evaluates to true or false.",
       "properties": {
-        "ExpressionString": ""
+        "ExpressionString": "The expression string that is evaluated."
       }
     },
     "AWS::Lex::Bot.ConditionalBranch": {
       "attributes": {},
-      "description": "",
+      "description": "A set of actions that Amazon Lex should run if the condition is matched.",
       "properties": {
-        "Condition": "",
-        "Name": "",
-        "NextStep": "",
-        "Response": ""
+        "Condition": "Contains the expression to evaluate. If the condition is true, the branch's actions are taken.",
+        "Name": "The name of the branch.",
+        "NextStep": "The next step in the conversation.",
+        "Response": "Specifies a list of message groups that Amazon Lex uses to respond the user input."
       }
     },
     "AWS::Lex::Bot.ConditionalSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Provides a list of conditional branches. Branches are evaluated in the order that they are entered in the list. The first branch with a condition that evaluates to true is executed. The last branch in the list is the default branch. The default branch should not have any condition expression. The default branch is executed if no other branch has a matching condition.",
       "properties": {
-        "ConditionalBranches": "",
-        "DefaultBranch": "",
-        "IsActive": ""
+        "ConditionalBranches": "A list of conditional branches. A conditional branch is made up of a condition, a response and a next step. The response and next step are executed when the condition is true.",
+        "DefaultBranch": "The conditional branch that should be followed when the conditions for other branches are not satisfied. A conditional branch is made up of a condition, a response and a next step.",
+        "IsActive": "Determines whether a conditional branch is active. When `IsActive` is false, the conditions are not evaluated."
       }
     },
     "AWS::Lex::Bot.ConversationLogSettings": {
       "attributes": {},
-      "description": "Specifies settings that manage logging that saves audio, text, and metadata for the conversations with your users.",
+      "description": "Configures conversation logging that saves audio, text, and metadata for the conversations with your users.",
       "properties": {
-        "AudioLogSettings": "Specifies the Amazon S3 settings for logging audio to an S3 bucket.",
-        "TextLogSettings": "Specifies settings to enable text conversation logs. You specify the Amazon CloudWatch Logs log group and whether logs should be stored for an alias."
+        "AudioLogSettings": "The Amazon S3 settings for logging audio to an S3 bucket.",
+        "TextLogSettings": "The Amazon CloudWatch Logs settings for logging text and metadata."
       }
     },
     "AWS::Lex::Bot.CustomPayload": {
       "attributes": {},
-      "description": "A custom response string that Amazon Lex sends to your application. You define the content and structure of the string.",
+      "description": "A custom response string that Amazon Lex sends to your application. You define the content and structure the string.",
       "properties": {
         "Value": "The string that is sent to your application."
       }
@@ -31025,70 +31121,70 @@
     },
     "AWS::Lex::Bot.DTMFSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies the DTMF input specifications.",
       "properties": {
-        "DeletionCharacter": "",
-        "EndCharacter": "",
-        "EndTimeoutMs": "",
-        "MaxLength": ""
+        "DeletionCharacter": "The DTMF character that clears the accumulated DTMF digits and immediately ends the input.",
+        "EndCharacter": "The DTMF character that immediately ends input. If the user does not press this character, the input ends after the end timeout.",
+        "EndTimeoutMs": "How long the bot should wait after the last DTMF character input before assuming that the input has concluded.",
+        "MaxLength": "The maximum number of DTMF digits allowed in an utterance."
       }
     },
     "AWS::Lex::Bot.DataPrivacy": {
       "attributes": {},
-      "description": "",
+      "description": "Provides information on additional privacy protections Amazon Lex should use with the bot's data.",
       "properties": {
-        "ChildDirected": ""
+        "ChildDirected": "For each Amazon Lex bot created with the Amazon Lex Model Building Service, you must specify whether your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to the Children's Online Privacy Protection Act (COPPA) by specifying `true` or `false` in the `childDirected` field. By specifying `true` in the `childDirected` field, you confirm that your use of Amazon Lex *is* related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA. By specifying `false` in the `childDirected` field, you confirm that your use of Amazon Lex *is not* related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA. You may not specify a default value for the `childDirected` field that does not accurately reflect whether your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA. If your use of Amazon Lex relates to a website, program, or other application that is directed in whole or in part, to children under age 13, you must obtain any required verifiable parental consent under COPPA. For information regarding the use of Amazon Lex in connection with websites, programs, or other applications that are directed or targeted, in whole or in part, to children under age 13, see the [Amazon Lex FAQ](https://docs.aws.amazon.com/lex/faqs#data-security) ."
       }
     },
     "AWS::Lex::Bot.DefaultConditionalBranch": {
       "attributes": {},
-      "description": "",
+      "description": "A set of actions that Amazon Lex should run if none of the other conditions are met.",
       "properties": {
-        "NextStep": "",
-        "Response": ""
+        "NextStep": "The next step in the conversation.",
+        "Response": "Specifies a list of message groups that Amazon Lex uses to respond the user input."
       }
     },
     "AWS::Lex::Bot.DialogAction": {
       "attributes": {},
-      "description": "",
+      "description": "Defines the action that the bot executes at runtime when the conversation reaches this step.",
       "properties": {
-        "SlotToElicit": "",
-        "SuppressNextMessage": "",
-        "Type": ""
+        "SlotToElicit": "If the dialog action is `ElicitSlot` , defines the slot to elicit from the user.",
+        "SuppressNextMessage": "When true the next message for the intent is not used.",
+        "Type": "The action that the bot should execute."
       }
     },
     "AWS::Lex::Bot.DialogCodeHookInvocationSetting": {
       "attributes": {},
-      "description": "",
+      "description": "Settings that specify the dialog code hook that is called by Amazon Lex at a step of the conversation.",
       "properties": {
-        "EnableCodeHookInvocation": "",
-        "InvocationLabel": "",
-        "IsActive": "",
-        "PostCodeHookSpecification": ""
+        "EnableCodeHookInvocation": "Indicates whether a Lambda function should be invoked for the dialog.",
+        "InvocationLabel": "A label that indicates the dialog step from which the dialog code hook is happening.",
+        "IsActive": "Determines whether a dialog code hook is used when the intent is activated.",
+        "PostCodeHookSpecification": "Contains the responses and actions that Amazon Lex takes after the Lambda function is complete."
       }
     },
     "AWS::Lex::Bot.DialogCodeHookSetting": {
       "attributes": {},
-      "description": "Specifies whether an intent uses the dialog code hook during conversations with a user.",
+      "description": "Settings that determine the Lambda function that Amazon Lex uses for processing user responses.",
       "properties": {
-        "Enabled": "Indicates whether an intent uses the dialog code hook during a conversation with a user."
+        "Enabled": "Enables the dialog code hook so that it processes user requests."
       }
     },
     "AWS::Lex::Bot.DialogState": {
       "attributes": {},
-      "description": "",
+      "description": "The current state of the conversation with the user.",
       "properties": {
-        "DialogAction": "",
-        "Intent": "",
-        "SessionAttributes": ""
+        "DialogAction": "Defines the action that the bot executes at runtime when the conversation reaches this step.",
+        "Intent": "Override settings to configure the intent state.",
+        "SessionAttributes": "Map of key/value pairs representing session-specific context information. It contains application information passed between Amazon Lex and a client application."
       }
     },
     "AWS::Lex::Bot.ElicitationCodeHookInvocationSetting": {
       "attributes": {},
-      "description": "",
+      "description": "Settings that specify the dialog code hook that is called by Amazon Lex between eliciting slot values.",
       "properties": {
-        "EnableCodeHookInvocation": "",
-        "InvocationLabel": ""
+        "EnableCodeHookInvocation": "Indicates whether a Lambda function should be invoked for the dialog.",
+        "InvocationLabel": "A label that indicates the dialog step from which the dialog code hook is happening."
       }
     },
     "AWS::Lex::Bot.ExternalSourceSetting": {
@@ -31102,9 +31198,9 @@
       "attributes": {},
       "description": "Determines if a Lambda function should be invoked for a specific intent.",
       "properties": {
-        "Enabled": "Indicates whether a Lambda function should be invoked for fulfill a specific intent.",
+        "Enabled": "Indicates whether a Lambda function should be invoked to fulfill a specific intent.",
         "FulfillmentUpdatesSpecification": "Provides settings for update messages sent to the user for long-running Lambda fulfillment functions. Fulfillment updates can be used only with streaming conversations.",
-        "IsActive": "",
+        "IsActive": "Determines whether the fulfillment code hook is used. When `active` is false, the code hook doesn't run.",
         "PostFulfillmentStatusSpecification": "Provides settings for messages sent to the user for after the Lambda fulfillment function completes. Post-fulfillment messages can be sent for both streaming and non-streaming conversations."
       }
     },
@@ -31114,23 +31210,23 @@
       "properties": {
         "AllowInterrupt": "Determines whether the user can interrupt the start message while it is playing.",
         "DelayInSeconds": "The delay between when the Lambda fulfillment function starts running and the start message is played. If the Lambda function returns before the delay is over, the start message isn't played.",
-        "MessageGroups": "One to 5 message groups that contain start messages. Amazon Lex chooses one of the messages to play to the user."
+        "MessageGroups": "1 - 5 message groups that contain start messages. Amazon Lex chooses one of the messages to play to the user."
       }
     },
     "AWS::Lex::Bot.FulfillmentUpdateResponseSpecification": {
       "attributes": {},
-      "description": "Provides information for updating the user on the progress of fulfilling an intent.",
+      "description": "Provides settings for a message that is sent periodically to the user while a fulfillment Lambda function is running.",
       "properties": {
         "AllowInterrupt": "Determines whether the user can interrupt an update message while it is playing.",
-        "FrequencyInSeconds": "The frequency that a message is sent to the user. When the period ends, Amazon Lex chooses a message from the message groups and plays it to the user. If the fulfillment Lambda function returns before the first period ends, an update message is not played to the user.",
-        "MessageGroups": "One to 5 message groups that contain update messages. Amazon Lex chooses one of the messages to play to the user."
+        "FrequencyInSeconds": "The frequency that a message is sent to the user. When the period ends, Amazon Lex chooses a message from the message groups and plays it to the user. If the fulfillment Lambda returns before the first period ends, an update message is not played to the user.",
+        "MessageGroups": "1 - 5 message groups that contain update messages. Amazon Lex chooses one of the messages to play to the user."
       }
     },
     "AWS::Lex::Bot.FulfillmentUpdatesSpecification": {
       "attributes": {},
       "description": "Provides information for updating the user on the progress of fulfilling an intent.",
       "properties": {
-        "Active": "Determines whether fulfillment updates are sent to the user. When this field is true, updates are sent.\n\nIf the active field is set to true, the `startResponse` , `updateResponse` , and `timeoutInSeconds` fields are required.",
+        "Active": "Determines whether fulfillment updates are sent to the user. When this field is true, updates are sent.\n\nIf the `active` field is set to true, the `startResponse` , `updateResponse` , and `timeoutInSeconds` fields are required.",
         "StartResponse": "Provides configuration information for the message sent to users when the fulfillment Lambda functions starts running.",
         "TimeoutInSeconds": "The length of time that the fulfillment Lambda function should run before it times out.",
         "UpdateResponse": "Provides configuration information for messages sent periodically to the user while the fulfillment Lambda function is running."
@@ -31138,25 +31234,25 @@
     },
     "AWS::Lex::Bot.GrammarSlotTypeSetting": {
       "attributes": {},
-      "description": "Settings required for a slot type based on a grammar that you provide.",
+      "description": "Settings requried for a slot type based on a grammar that you provide.",
       "properties": {
         "Source": "The source of the grammar used to create the slot type."
       }
     },
     "AWS::Lex::Bot.GrammarSlotTypeSource": {
       "attributes": {},
-      "description": "Describes the Amazon S3 bucket name and location for the grammar that is the source of the slot type.",
+      "description": "Describes the Amazon S3 bucket name and location for the grammar that is the source for the slot type.",
       "properties": {
-        "KmsKeyArn": "The AWS Key Management Service key required to decrypt the contents of the grammar, if any.",
-        "S3BucketName": "The name of the S3 bucket that contains the grammar source.",
-        "S3ObjectKey": "The path to the grammar in the S3 bucket."
+        "KmsKeyArn": "The AWS KMS key required to decrypt the contents of the grammar, if any.",
+        "S3BucketName": "The name of the Amazon S3 bucket that contains the grammar source.",
+        "S3ObjectKey": "The path to the grammar in the Amazon S3 bucket."
       }
     },
     "AWS::Lex::Bot.ImageResponseCard": {
       "attributes": {},
       "description": "A card that is shown to the user by a messaging platform. You define the contents of the card, the card is displayed by the platform.\n\nWhen you use a response card, the response from the user is constrained to the text associated with a button on the card.",
       "properties": {
-        "Buttons": "A list of buttons that should be displayed on the response card. The arrangement of the buttons is determined by the platform that displays the buttons.",
+        "Buttons": "A list of buttons that should be displayed on the response card. The arrangement of the buttons is determined by the platform that displays the button.",
         "ImageUrl": "The URL of an image to display on the response card. The image URL must be publicly available so that the platform displaying the response card has access to the image.",
         "Subtitle": "The subtitle to display on the response card. The format of the subtitle is determined by the platform displaying the response card.",
         "Title": "The title to display on the response card. The format of the title is determined by the platform displaying the response card."
@@ -31164,17 +31260,17 @@
     },
     "AWS::Lex::Bot.InitialResponseSetting": {
       "attributes": {},
-      "description": "",
+      "description": "Configuration setting for a response sent to the user before Amazon Lex starts eliciting slots.",
       "properties": {
-        "CodeHook": "",
-        "Conditional": "",
-        "InitialResponse": "",
-        "NextStep": ""
+        "CodeHook": "Settings that specify the dialog code hook that is called by Amazon Lex at a step of the conversation.",
+        "Conditional": "Provides a list of conditional branches. Branches are evaluated in the order that they are entered in the list. The first branch with a condition that evaluates to true is executed. The last branch in the list is the default branch. The default branch should not have any condition expression. The default branch is executed if no other branch has a matching condition.",
+        "InitialResponse": "Specifies a list of message groups that Amazon Lex uses to respond the user input.",
+        "NextStep": "The next step in the conversation."
       }
     },
     "AWS::Lex::Bot.InputContext": {
       "attributes": {},
-      "description": "The name of a context that must be active for an intent to be selected by Amazon Lex .",
+      "description": "The name of a context that must be active for an intent to be selected by Amazon Lex.",
       "properties": {
         "Name": "The name of the context."
       }
@@ -31186,11 +31282,11 @@
         "Description": "A description of the intent. Use the description to help identify the intent in lists.",
         "DialogCodeHook": "Specifies that Amazon Lex invokes the alias Lambda function for each user input. You can invoke this Lambda function to personalize user interaction.",
         "FulfillmentCodeHook": "Specifies that Amazon Lex invokes the alias Lambda function when the intent is ready for fulfillment. You can invoke this function to complete the bot's transaction with the user.",
-        "InitialResponseSetting": "",
+        "InitialResponseSetting": "Configuration setting for a response sent to the user before Amazon Lex starts eliciting slots.",
         "InputContexts": "A list of contexts that must be active for this intent to be considered by Amazon Lex .",
         "IntentClosingSetting": "Sets the response that Amazon Lex sends to the user when the intent is closed.",
         "IntentConfirmationSetting": "Provides prompts that Amazon Lex sends to the user to confirm the completion of an intent. If the user answers \"no,\" the settings contain a statement that is sent to the user to end the intent.",
-        "KendraConfiguration": "Configuration information required to use the AMAZON.KendraSearchIntent intent to connect to an Amazon Kendra index. The AMAZON.KendraSearchIntent intent is called when Amazon Lex can't determine another intent to invoke.",
+        "KendraConfiguration": "Provides configuration information for the AMAZON.KendraSearchIntent intent. When you use this intent, Amazon Lex searches the specified Amazon Kendra index and returns documents from the index that match the user's utterance.",
         "Name": "The name of the intent. Intent names must be unique within the locale that contains the intent and can't match the name of any built-in intent.",
         "OutputContexts": "A list of contexts that the intent activates when it is fulfilled.",
         "ParentIntentSignature": "A unique identifier for the built-in intent to base this intent on.",
@@ -31204,36 +31300,36 @@
       "description": "Provides a statement the Amazon Lex conveys to the user when the intent is successfully fulfilled.",
       "properties": {
         "ClosingResponse": "The response that Amazon Lex sends to the user when the intent is complete.",
-        "Conditional": "",
-        "IsActive": "Specifies whether an intent's closing response is used. When this field is false, the closing response isn't sent to the user and no closing input from the user is used. If the IsActive field isn't specified, the default is true.",
-        "NextStep": ""
+        "Conditional": "A list of conditional branches associated with the intent's closing response. These branches are executed when the `nextStep` attribute is set to `EvalutateConditional` .",
+        "IsActive": "Specifies whether an intent's closing response is used. When this field is false, the closing response isn't sent to the user. If the `IsActive` field isn't specified, the default is true.",
+        "NextStep": "Specifies the next step that the bot executes after playing the intent's closing response."
       }
     },
     "AWS::Lex::Bot.IntentConfirmationSetting": {
       "attributes": {},
       "description": "Provides a prompt for making sure that the user is ready for the intent to be fulfilled.",
       "properties": {
-        "CodeHook": "",
-        "ConfirmationConditional": "",
-        "ConfirmationNextStep": "",
-        "ConfirmationResponse": "",
-        "DeclinationConditional": "",
-        "DeclinationNextStep": "",
-        "DeclinationResponse": "When the user answers \"no\" to the question defined in PromptSpecification, Amazon Lex responds with this response to acknowledge that the intent was canceled.",
-        "ElicitationCodeHook": "",
-        "FailureConditional": "",
-        "FailureNextStep": "",
-        "FailureResponse": "",
-        "IsActive": "Specifies whether the intent's confirmation is sent to the user. When this field is false, confirmation and declination responses aren't sent and processing continues as if the responses aren't present. If the active field isn't specified, the default is true.",
-        "PromptSpecification": "Prompts the user to confirm the intent. This question should have a yes or no answer."
+        "CodeHook": "The `DialogCodeHookInvocationSetting` object associated with intent's confirmation step. The dialog code hook is triggered based on these invocation settings when the confirmation next step or declination next step or failure next step is `InvokeDialogCodeHook` .",
+        "ConfirmationConditional": "A list of conditional branches to evaluate after the intent is closed.",
+        "ConfirmationNextStep": "Specifies the next step that the bot executes when the customer confirms the intent.",
+        "ConfirmationResponse": "Specifies a list of message groups that Amazon Lex uses to respond the user input.",
+        "DeclinationConditional": "A list of conditional branches to evaluate after the intent is declined.",
+        "DeclinationNextStep": "Specifies the next step that the bot executes when the customer declines the intent.",
+        "DeclinationResponse": "When the user answers \"no\" to the question defined in `promptSpecification` , Amazon Lex responds with this response to acknowledge that the intent was canceled.",
+        "ElicitationCodeHook": "The `DialogCodeHookInvocationSetting` used when the code hook is invoked during confirmation prompt retries.",
+        "FailureConditional": "Provides a list of conditional branches. Branches are evaluated in the order that they are entered in the list. The first branch with a condition that evaluates to true is executed. The last branch in the list is the default branch. The default branch should not have any condition expression. The default branch is executed if no other branch has a matching condition.",
+        "FailureNextStep": "The next step to take in the conversation if the confirmation step fails.",
+        "FailureResponse": "Specifies a list of message groups that Amazon Lex uses to respond the user input when the intent confirmation fails.",
+        "IsActive": "Specifies whether the intent's confirmation is sent to the user. When this field is false, confirmation and declination responses aren't sent. If the `IsActive` field isn't specified, the default is true.",
+        "PromptSpecification": "Prompts the user to confirm the intent. This question should have a yes or no answer.\n\nAmazon Lex uses this prompt to ensure that the user acknowledges that the intent is ready for fulfillment. For example, with the `OrderPizza` intent, you might want to confirm that the order is correct before placing it. For other intents, such as intents that simply respond to user questions, you might not need to ask the user for confirmation before providing the information."
       }
     },
     "AWS::Lex::Bot.IntentOverride": {
       "attributes": {},
-      "description": "",
+      "description": "Override settings to configure the intent state.",
       "properties": {
-        "Name": "",
-        "Slots": ""
+        "Name": "The name of the intent. Only required when you're switching intents.",
+        "Slots": "A map of all of the slot value overrides for the intent. The name of the slot maps to the value of the slot. Slots that are not included in the map aren't overridden."
       }
     },
     "AWS::Lex::Bot.KendraConfiguration": {
@@ -31241,7 +31337,7 @@
       "description": "Provides configuration information for the AMAZON.KendraSearchIntent intent. When you use this intent, Amazon Lex searches the specified Amazon Kendra index and returns documents from the index that match the user's utterance.",
       "properties": {
         "KendraIndex": "The Amazon Resource Name (ARN) of the Amazon Kendra index that you want the AMAZON.KendraSearchIntent intent to search. The index must be in the same account and Region as the Amazon Lex bot.",
-        "QueryFilterString": "A query filter that Amazon Lex sends to Amazon Kendra to filter the response from a query. The filter is in the format defined by Amazon Kendra.",
+        "QueryFilterString": "A query filter that Amazon Lex sends to Amazon Kendra to filter the response from a query. The filter is in the format defined by Amazon Kendra. For more information, see [Filtering queries](https://docs.aws.amazon.com/kendra/latest/dg/filtering.html) .",
         "QueryFilterStringEnabled": "Determines whether the AMAZON.KendraSearchIntent intent uses a custom query string to query the Amazon Kendra index."
       }
     },
@@ -31249,8 +31345,8 @@
       "attributes": {},
       "description": "Specifies a Lambda function that verifies requests to a bot or fulfills the user's request to a bot.",
       "properties": {
-        "CodeHookInterfaceVersion": "Specifies the version of the request-response that you want Amazon Lex to use to invoke your Lambda function.",
-        "LambdaArn": "Specifies the Amazon Resource Name (ARN) of the Lambda function."
+        "CodeHookInterfaceVersion": "The version of the request-response that you want Amazon Lex to use to invoke your Lambda function.",
+        "LambdaArn": "The Amazon Resource Name (ARN) of the Lambda function."
       }
     },
     "AWS::Lex::Bot.Message": {
@@ -31260,7 +31356,7 @@
         "CustomPayload": "A message in a custom format defined by the client application.",
         "ImageResponseCard": "A message that defines a response card that the client application can show to the user.",
         "PlainTextMessage": "A message in plain text format.",
-        "SSMLMessage": "A message in Speech Synthesis Markup Language (SSML) format."
+        "SSMLMessage": "A message in Speech Synthesis Markup Language (SSML)."
       }
     },
     "AWS::Lex::Bot.MessageGroup": {
@@ -31275,14 +31371,14 @@
       "attributes": {},
       "description": "Indicates whether a slot can return multiple values.",
       "properties": {
-        "AllowMultipleValues": "Indicates whether a slot can return multiple values. When true, the slot may return more than one value in a response. When false, the slot returns only a single value. If AllowMultipleValues is not set, the default value is false.\n\nMulti-value slots are only available in the en-US locale."
+        "AllowMultipleValues": "Indicates whether a slot can return multiple values. When `true` , the slot may return more than one value in a response. When `false` , the slot returns only a single value.\n\nMulti-value slots are only available in the en-US locale. If you set this value to `true` in any other locale, Amazon Lex throws a `ValidationException` .\n\nIf the `allowMutlipleValues` is not set, the default value is `false` ."
       }
     },
     "AWS::Lex::Bot.ObfuscationSetting": {
       "attributes": {},
       "description": "Determines whether Amazon Lex obscures slot values in conversation logs.",
       "properties": {
-        "ObfuscationSettingType": "Value that determines whether Amazon Lex obscures slot values in conversation logs. The default is to obscure the values."
+        "ObfuscationSettingType": "Value that determines whether Amazon Lex obscures slot values in conversation logs. The default is to obscure the values. The valid values are `None` and `DefaultObfuscation.`"
       }
     },
     "AWS::Lex::Bot.OutputContext": {
@@ -31303,42 +31399,42 @@
     },
     "AWS::Lex::Bot.PostDialogCodeHookInvocationSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies next steps to run after the dialog code hook finishes.",
       "properties": {
-        "FailureConditional": "",
-        "FailureNextStep": "",
-        "FailureResponse": "",
-        "SuccessConditional": "",
-        "SuccessNextStep": "",
-        "SuccessResponse": "",
-        "TimeoutConditional": "",
-        "TimeoutNextStep": "",
-        "TimeoutResponse": ""
+        "FailureConditional": "A list of conditional branches to evaluate after the dialog code hook throws an exception or returns with the `State` field of the `Intent` object set to `Failed` .",
+        "FailureNextStep": "Specifies the next step the bot runs after the dialog code hook throws an exception or returns with the `State` field of the `Intent` object set to `Failed` .",
+        "FailureResponse": "Specifies a list of message groups that Amazon Lex uses to respond the user input when the code hook fails.",
+        "SuccessConditional": "A list of conditional branches to evaluate after the dialog code hook finishes successfully.",
+        "SuccessNextStep": "Specifics the next step the bot runs after the dialog code hook finishes successfully.",
+        "SuccessResponse": "Specifies a list of message groups that Amazon Lex uses to respond when the code hook succeeds.",
+        "TimeoutConditional": "A list of conditional branches to evaluate if the code hook times out.",
+        "TimeoutNextStep": "Specifies the next step that the bot runs when the code hook times out.",
+        "TimeoutResponse": "Specifies a list of message groups that Amazon Lex uses to respond to the user input when the code hook times out."
       }
     },
     "AWS::Lex::Bot.PostFulfillmentStatusSpecification": {
       "attributes": {},
-      "description": "Provides a setting that determines whether the post-fulfillment response is sent to the user. For more information, see [Post-fulfillment response](https://docs.aws.amazon.com/lex/latest/dg/streaming-progress.html#progress-complete) in the *Amazon Lex developer guide* .",
+      "description": "Provides a setting that determines whether the post-fulfillment response is sent to the user. For more information, see [](https://docs.aws.amazon.com/lexv2/latest/dg/streaming-progress.html#progress-complete)",
       "properties": {
-        "FailureConditional": "",
-        "FailureNextStep": "",
+        "FailureConditional": "A list of conditional branches to evaluate after the fulfillment code hook throws an exception or returns with the `State` field of the `Intent` object set to `Failed` .",
+        "FailureNextStep": "Specifies the next step the bot runs after the fulfillment code hook throws an exception or returns with the `State` field of the `Intent` object set to `Failed` .",
         "FailureResponse": "Specifies a list of message groups that Amazon Lex uses to respond when fulfillment isn't successful.",
-        "SuccessConditional": "",
-        "SuccessNextStep": "",
+        "SuccessConditional": "A list of conditional branches to evaluate after the fulfillment code hook finishes successfully.",
+        "SuccessNextStep": "Specifies the next step in the conversation that Amazon Lex invokes when the fulfillment code hook completes successfully.",
         "SuccessResponse": "Specifies a list of message groups that Amazon Lex uses to respond when the fulfillment is successful.",
-        "TimeoutConditional": "",
-        "TimeoutNextStep": "",
+        "TimeoutConditional": "A list of conditional branches to evaluate if the fulfillment code hook times out.",
+        "TimeoutNextStep": "Specifies the next step that the bot runs when the fulfillment code hook times out.",
         "TimeoutResponse": "Specifies a list of message groups that Amazon Lex uses to respond when fulfillment isn't completed within the timeout period."
       }
     },
     "AWS::Lex::Bot.PromptAttemptSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies the settings on a prompt attempt.",
       "properties": {
-        "AllowInterrupt": "",
-        "AllowedInputTypes": "",
-        "AudioAndDTMFInputSpecification": "",
-        "TextInputSpecification": ""
+        "AllowInterrupt": "Indicates whether the user can interrupt a speech prompt attempt from the bot.",
+        "AllowedInputTypes": "Indicates the allowed input types of the prompt attempt.",
+        "AudioAndDTMFInputSpecification": "Specifies the settings on audio and DTMF input.",
+        "TextInputSpecification": "Specifies the settings on text input."
       }
     },
     "AWS::Lex::Bot.PromptSpecification": {
@@ -31346,27 +31442,27 @@
       "description": "Specifies a list of message groups that Amazon Lex sends to a user to elicit a response.",
       "properties": {
         "AllowInterrupt": "Indicates whether the user can interrupt a speech prompt from the bot.",
-        "MaxRetries": "The maximum number of times the bot tries to elicit a response from the user using this prompt",
-        "MessageGroupsList": "A collection of responses that Amazon Lex can send to the user. Amazon Lex chooses the actual response to send at runtime.",
-        "MessageSelectionStrategy": "",
-        "PromptAttemptsSpecification": ""
+        "MaxRetries": "The maximum number of times the bot tries to elicit a response from the user using this prompt.",
+        "MessageGroupsList": "A collection of messages that Amazon Lex can send to the user. Amazon Lex chooses the actual message to send at runtime.",
+        "MessageSelectionStrategy": "Indicates how a message is selected from a message group among retries.",
+        "PromptAttemptsSpecification": "Specifies the advanced settings on each attempt of the prompt."
       }
     },
     "AWS::Lex::Bot.ResponseSpecification": {
       "attributes": {},
-      "description": "Specifies a list of message groups that Amazon Lex uses to respond to user input.",
+      "description": "Specifies a list of message groups that Amazon Lex uses to respond the user input.",
       "properties": {
-        "AllowInterrupt": "Indicates whether the user can interrupt a speech response from Amazon Lex .",
+        "AllowInterrupt": "Indicates whether the user can interrupt a speech response from Amazon Lex.",
         "MessageGroupsList": "A collection of responses that Amazon Lex can send to the user. Amazon Lex chooses the actual response to send at runtime."
       }
     },
     "AWS::Lex::Bot.S3BucketLogDestination": {
       "attributes": {},
-      "description": "Specifies an Amazon S3 bucket for logging audio conversations.",
+      "description": "Specifies an Amazon S3 bucket for logging audio conversations",
       "properties": {
-        "KmsKeyArn": "Specifies the Amazon Resource Name (ARN) of an AWS Key Management Service key for encrypting audio log files stored in an Amazon S3 bucket.",
-        "LogPrefix": "Specifies the Amazon S3 prefix to assign to audio log files.",
-        "S3BucketArn": "Specifies the Amazon Resource Name (ARN) of the Amazon S3 bucket where audio files are stored."
+        "KmsKeyArn": "The Amazon Resource Name (ARN) of an AWS Key Management Service (KMS) key for encrypting audio log files stored in an Amazon S3 bucket.",
+        "LogPrefix": "The S3 prefix to assign to audio log files.",
+        "S3BucketArn": "The Amazon Resource Name (ARN) of an Amazon S3 bucket where audio log files are stored."
       }
     },
     "AWS::Lex::Bot.S3Location": {
@@ -31387,9 +31483,9 @@
     },
     "AWS::Lex::Bot.SampleUtterance": {
       "attributes": {},
-      "description": "A sample utterance that invokes and intent or responds to a slot elicitation prompt.",
+      "description": "A sample utterance that invokes an intent or respond to a slot elicitation prompt.",
       "properties": {
-        "Utterance": "The sample utterance that Amazon Lex uses to build its machine-learning model to recognize intents."
+        "Utterance": "A sample utterance that invokes an intent or respond to a slot elicitation prompt."
       }
     },
     "AWS::Lex::Bot.SampleValue": {
@@ -31401,43 +31497,43 @@
     },
     "AWS::Lex::Bot.SentimentAnalysisSettings": {
       "attributes": {},
-      "description": "",
+      "description": "Determines whether Amazon Lex will use Amazon Comprehend to detect the sentiment of user utterances.",
       "properties": {
-        "DetectSentiment": ""
+        "DetectSentiment": "Sets whether Amazon Lex uses Amazon Comprehend to detect the sentiment of user utterances."
       }
     },
     "AWS::Lex::Bot.SessionAttribute": {
       "attributes": {},
-      "description": "",
+      "description": "A key/value pair representing session-specific context information. It contains application information passed between Amazon Lex V2 and a client application.",
       "properties": {
-        "Key": "",
-        "Value": ""
+        "Key": "The name of the session attribute.",
+        "Value": "The session-specific context information for the session attribute."
       }
     },
     "AWS::Lex::Bot.Slot": {
       "attributes": {},
       "description": "Specifies the definition of a slot. Amazon Lex elicits slot values from uses to fulfill the user's intent.",
       "properties": {
-        "Description": "A description of the slot type.",
-        "MultipleValuesSetting": "Determines whether the slot can return multiple values to the application.",
-        "Name": "The name of the slot.",
+        "Description": "The description of the slot.",
+        "MultipleValuesSetting": "Indicates whether a slot can return multiple values.",
+        "Name": "The name given to the slot.",
         "ObfuscationSetting": "Determines whether the contents of the slot are obfuscated in Amazon CloudWatch Logs logs. Use obfuscated slots to protect information such as personally identifiable information (PII) in logs.",
         "SlotTypeName": "The name of the slot type that this slot is based on. The slot type defines the acceptable values for the slot.",
-        "ValueElicitationSetting": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- OriginalValue - Returns the value entered by the user, if the user value is similar to a slot value.\n- TopResolution - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the valueSelectionStrategy, the default is OriginalValue."
+        "ValueElicitationSetting": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- ORIGINAL_VALUE - Returns the value entered by the user, if the user value is similar to a slot value.\n- TOP_RESOLUTION - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the `valueSelectionStrategy` , the default is `ORIGINAL_VALUE` ."
       }
     },
     "AWS::Lex::Bot.SlotCaptureSetting": {
       "attributes": {},
-      "description": "",
+      "description": "Settings used when Amazon Lex successfully captures a slot value from a user.",
       "properties": {
-        "CaptureConditional": "",
-        "CaptureNextStep": "",
-        "CaptureResponse": "",
-        "CodeHook": "",
-        "ElicitationCodeHook": "",
-        "FailureConditional": "",
-        "FailureNextStep": "",
-        "FailureResponse": ""
+        "CaptureConditional": "A list of conditional branches to evaluate after the slot value is captured.",
+        "CaptureNextStep": "Specifies the next step that the bot runs when the slot value is captured before the code hook times out.",
+        "CaptureResponse": "Specifies a list of message groups that Amazon Lex uses to respond the user input.",
+        "CodeHook": "Code hook called after Amazon Lex successfully captures a slot value.",
+        "ElicitationCodeHook": "Code hook called when Amazon Lex doesn't capture a slot value.",
+        "FailureConditional": "A list of conditional branches to evaluate when the slot value isn't captured.",
+        "FailureNextStep": "Specifies the next step that the bot runs when the slot value code is not recognized.",
+        "FailureResponse": "Specifies a list of message groups that Amazon Lex uses to respond the user input when the slot fails to be captured."
       }
     },
     "AWS::Lex::Bot.SlotDefaultValue": {
@@ -31449,16 +31545,16 @@
     },
     "AWS::Lex::Bot.SlotDefaultValueSpecification": {
       "attributes": {},
-      "description": "Defines a list of values that Amazon Lex should use as the default value for a slot.",
+      "description": "The default value to use when a user doesn't provide a value for a slot.",
       "properties": {
         "DefaultValueList": "A list of default values. Amazon Lex chooses the default value to use in the order that they are presented in the list."
       }
     },
     "AWS::Lex::Bot.SlotPriority": {
       "attributes": {},
-      "description": "Sets the priority that Amazon Lex should use when eliciting slots values from a user.",
+      "description": "Sets the priority that Amazon Lex should use when eliciting slot values from a user.",
       "properties": {
-        "Priority": "The priority that Amazon Lex should apply to the slot.",
+        "Priority": "The priority that a slot should be elicited.",
         "SlotName": "The name of the slot."
       }
     },
@@ -31469,14 +31565,14 @@
         "Description": "A description of the slot type. Use the description to help identify the slot type in lists.",
         "ExternalSourceSetting": "Sets the type of external information used to create the slot type.",
         "Name": "The name of the slot type. A slot type name must be unique withing the account.",
-        "ParentSlotTypeSignature": "The built-in slot type used as a parent of this slot type. When you define a parent slot type, the new slot type has the configuration of the parent lot type.\n\nOnly AMAZON.AlphaNumeric is supported.",
+        "ParentSlotTypeSignature": "The built-in slot type used as a parent of this slot type. When you define a parent slot type, the new slot type has the configuration of the parent lot type.\n\nOnly `AMAZON.AlphaNumeric` is supported.",
         "SlotTypeValues": "A list of SlotTypeValue objects that defines the values that the slot type can take. Each value can have a list of synonyms, additional values that help train the machine learning model about the values that it resolves for the slot.",
-        "ValueSelectionSetting": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- OriginalValue - Returns the value entered by the user, if the user value is similar to a slot value.\n- TopResolution - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the valueSelectionStrategy, the default is OriginalValue."
+        "ValueSelectionSetting": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- `ORIGINAL_VALUE` - Returns the value entered by the user, if the user value is similar to the slot value.\n- `TOP_RESOLUTION` - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the `valueSelectionStrategy` , the default is `ORIGINAL_VALUE` ."
       }
     },
     "AWS::Lex::Bot.SlotTypeValue": {
       "attributes": {},
-      "description": "Each slot type can have a set of values. The `SlotTypeValue` represents a value that the slot type can take.",
+      "description": "Each slot type can have a set of values. Each `SlotTypeValue` represents a value that the slot type can take.",
       "properties": {
         "SampleValue": "The value of the slot type entry.",
         "Synonyms": "Additional values related to the slot type entry."
@@ -31484,54 +31580,54 @@
     },
     "AWS::Lex::Bot.SlotValue": {
       "attributes": {},
-      "description": "",
+      "description": "The value to set in a slot.",
       "properties": {
-        "InterpretedValue": ""
+        "InterpretedValue": "The value that Amazon Lex determines for the slot. The actual value depends on the setting of the value selection strategy for the bot. You can choose to use the value entered by the user, or you can have Amazon Lex choose the first value in the `resolvedValues` list."
       }
     },
     "AWS::Lex::Bot.SlotValueElicitationSetting": {
       "attributes": {},
-      "description": "Settings that you can use for eliciting a slot value.",
+      "description": "Specifies the elicitation setting details for constituent sub slots of a composite slot.",
       "properties": {
         "DefaultValueSpecification": "A list of default values for a slot. Default values are used when Amazon Lex hasn't determined a value for a slot. You can specify default values from context variables, session attributes, and defined values.",
         "PromptSpecification": "The prompt that Amazon Lex uses to elicit the slot value from the user.",
-        "SampleUtterances": "If you know a specific pattern that users might respond to an Amazon Lex request for a slot value, you can provide those utterances to improve accuracy. This is optional. In most cases Amazon Lex is capable of understanding user utterances.",
-        "SlotCaptureSetting": "",
+        "SampleUtterances": "If you know a specific pattern that users might respond to an Amazon Lex request for a slot value, you can provide those utterances to improve accuracy. This is optional. In most cases, Amazon Lex is capable of understanding user utterances.",
+        "SlotCaptureSetting": "Specifies the settings that Amazon Lex uses when a slot value is successfully entered by a user.",
         "SlotConstraint": "Specifies whether the slot is required or optional.",
         "WaitAndContinueSpecification": "Specifies the prompts that Amazon Lex uses while a bot is waiting for customer input."
       }
     },
     "AWS::Lex::Bot.SlotValueOverride": {
       "attributes": {},
-      "description": "",
+      "description": "The slot values that Amazon Lex uses when it sets slot values in a dialog step.",
       "properties": {
-        "Shape": "",
-        "Value": "",
-        "Values": ""
+        "Shape": "When the shape value is `List` , it indicates that the `values` field contains a list of slot values. When the value is `Scalar` , it indicates that the `value` field contains a single value.",
+        "Value": "The current value of the slot.",
+        "Values": "A list of one or more values that the user provided for the slot. For example, for a slot that elicits pizza toppings, the values might be \"pepperoni\" and \"pineapple.\""
       }
     },
     "AWS::Lex::Bot.SlotValueOverrideMap": {
       "attributes": {},
-      "description": "",
+      "description": "Maps a slot name to the [SlotValueOverride](https://docs.aws.amazon.com/lexv2/latest/APIReference/API_SlotValueOverride.html) object.",
       "properties": {
-        "SlotName": "",
-        "SlotValueOverride": ""
+        "SlotName": "The name of the slot.",
+        "SlotValueOverride": "The SlotValueOverride object to which the slot name will be mapped."
       }
     },
     "AWS::Lex::Bot.SlotValueRegexFilter": {
       "attributes": {},
       "description": "Provides a regular expression used to validate the value of a slot.",
       "properties": {
-        "Pattern": "A regular expression used to validate the value of a slot.\n\nUse a standard regular expression. Amazon Lex supports the following characters in the regular expression:\n\n- A-Z, a-z\n- 0-9\n- Unicode characters (\"\\u<Unicode>\")\n\nRepresent Unicode characters with four digits, for example \"]u0041\" or \"\\u005A\".\n\nThe following regular expression operators are not supported:\n\n- Infinite repeaters: *, +, or {x,} with no upper bound\n- Wild card (.)"
+        "Pattern": "A regular expression used to validate the value of a slot.\n\nUse a standard regular expression. Amazon Lex supports the following characters in the regular expression:\n\n- A-Z, a-z\n- 0-9\n- Unicode characters (\"\\u<Unicode>\")\n\nRepresent Unicode characters with four digits, for example \"\\u0041\" or \"\\u005A\".\n\nThe following regular expression operators are not supported:\n\n- Infinite repeaters: *, +, or {x,} with no upper bound.\n- Wild card (.)"
       }
     },
     "AWS::Lex::Bot.SlotValueSelectionSetting": {
       "attributes": {},
       "description": "Contains settings used by Amazon Lex to select a slot value.",
       "properties": {
-        "AdvancedRecognitionSetting": "Specifies settings that enable advanced recognition settings for slot values. You can use this to enable using slot values as a custom vocabulary for recognizing user utterances.",
+        "AdvancedRecognitionSetting": "Provides settings that enable advanced recognition settings for slot values.",
         "RegexFilter": "A regular expression used to validate the value of a slot.",
-        "ResolutionStrategy": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- OriginalValue - Returns the value entered by the user, if the user value is similar to a slot value.\n- TopResolution - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the valueSelectionStrategy, the default is OriginalValue."
+        "ResolutionStrategy": "Determines the slot resolution strategy that Amazon Lex uses to return slot type values. The field can be set to one of the following values:\n\n- `ORIGINAL_VALUE` - Returns the value entered by the user, if the user value is similar to the slot value.\n- `TOP_RESOLUTION` - If there is a resolution list for the slot, return the first value in the resolution list as the slot type value. If there is no resolution list, null is returned.\n\nIf you don't specify the `valueSelectionStrategy` , the default is `ORIGINAL_VALUE` ."
       }
     },
     "AWS::Lex::Bot.StillWaitingResponseSpecification": {
@@ -31540,7 +31636,7 @@
       "properties": {
         "AllowInterrupt": "Indicates that the user can interrupt the response by speaking while the message is being played.",
         "FrequencyInSeconds": "How often a message should be sent to the user. Minimum of 1 second, maximum of 5 minutes.",
-        "MessageGroupsList": "A collection of responses that Amazon Lex can send to the user. Amazon Lex chooses the actual response to send at runtime.",
+        "MessageGroupsList": "One or more message groups, each containing one or more messages, that define the prompts that Amazon Lex sends to the user.",
         "TimeoutInSeconds": "If Amazon Lex waits longer than this length of time for a response, it will stop sending messages."
       }
     },
@@ -31556,32 +31652,32 @@
     },
     "AWS::Lex::Bot.TextInputSpecification": {
       "attributes": {},
-      "description": "",
+      "description": "Specifies the text input specifications.",
       "properties": {
-        "StartTimeoutMs": ""
+        "StartTimeoutMs": "Time for which a bot waits before re-prompting a customer for text input."
       }
     },
     "AWS::Lex::Bot.TextLogDestination": {
       "attributes": {},
-      "description": "Specifies the Amazon CloudWatch Logs destination log group for conversation text logs.",
+      "description": "Defines the Amazon CloudWatch Logs destination log group for conversation text logs.",
       "properties": {
-        "CloudWatch": "Specifies the Amazon CloudWatch Logs log group where text and metadata logs are delivered."
+        "CloudWatch": "Defines the Amazon CloudWatch Logs log group where text and metadata logs are delivered."
       }
     },
     "AWS::Lex::Bot.TextLogSetting": {
       "attributes": {},
-      "description": "Specifies settings to enable conversation logs.",
+      "description": "Defines settings to enable text conversation logs.",
       "properties": {
         "Destination": "Specifies the Amazon CloudWatch Logs destination log group for conversation text logs.",
-        "Enabled": "Specifies whether conversation logs should be stored for an alias."
+        "Enabled": "Determines whether conversation logs should be stored for an alias."
       }
     },
     "AWS::Lex::Bot.VoiceSettings": {
       "attributes": {},
-      "description": "Identifies the Amazon Polly voice used for audio interaction with the user.",
+      "description": "Defines settings for using an Amazon Polly voice to communicate with a user.",
       "properties": {
-        "Engine": "",
-        "VoiceId": "The Amazon Polly voice used for voice interaction with the user."
+        "Engine": "Indicates the type of Amazon Polly voice that Amazon Lex should use for voice interaction with the user. For more information, see the [`engine` parameter of the `SynthesizeSpeech` operation](https://docs.aws.amazon.com/polly/latest/dg/API_SynthesizeSpeech.html#polly-SynthesizeSpeech-request-Engine) in the *Amazon Polly developer guide* .\n\nIf you do not specify a value, the default is `standard` .",
+        "VoiceId": "The identifier of the Amazon Polly voice to use."
       }
     },
     "AWS::Lex::Bot.WaitAndContinueSpecification": {
@@ -31589,7 +31685,7 @@
       "description": "Specifies the prompts that Amazon Lex uses while a bot is waiting for customer input.",
       "properties": {
         "ContinueResponse": "The response that Amazon Lex sends to indicate that the bot is ready to continue the conversation.",
-        "IsActive": "Specifies whether the bot will wait for a user to respond. When this field is false, wait and continue responses for a slot aren't used and the bot expects an appropriate response within the configured timeout. If the IsActive field isn't specified, the default is true.",
+        "IsActive": "Specifies whether the bot will wait for a user to respond. When this field is false, wait and continue responses for a slot aren't used. If the `IsActive` field isn't specified, the default is true.",
         "StillWaitingResponse": "A response that Amazon Lex sends periodically to the user to indicate that the bot is still waiting for input from the user.",
         "WaitingResponse": "The response that Amazon Lex sends to indicate that the bot is waiting for the conversation to continue."
       }
@@ -31602,7 +31698,7 @@
       },
       "description": "> Amazon Lex V2 is the only supported version in AWS CloudFormation . \n\nSpecifies an alias for the specified version of a bot. Use an alias to enable you to change the version of a bot without updating applications that use the bot.\n\nFor example, you can specify an alias called \"PROD\" that your applications use to call the Amazon Lex bot.",
       "properties": {
-        "BotAliasLocaleSettings": "Maps configuration information to a specific locale. You can use this parameter to specify a specific Lambda function to run different functions in different locales.",
+        "BotAliasLocaleSettings": "",
         "BotAliasName": "The name of the bot alias.",
         "BotAliasTags": "An array of key-value pairs to apply to this resource.\n\nYou can only add tags when you specify an alias.\n\nFor more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .",
         "BotId": "The unique identifier of the bot.",
@@ -31632,7 +31728,7 @@
       "description": "Specifies settings that are unique to a locale. For example, you can use different Lambda function depending on the bot's locale.",
       "properties": {
         "CodeHookSpecification": "Specifies the Lambda function that should be used in the locale.",
-        "Enabled": "Determines whether the locale is enabled for the bot. If the value is false, the locale isn't available for use."
+        "Enabled": "Determines whether the locale is enabled for the bot. If the value is `false` , the locale isn't available for use."
       }
     },
     "AWS::Lex::BotAlias.BotAliasLocaleSettingsItem": {
@@ -31648,7 +31744,7 @@
       "description": "The Amazon CloudWatch Logs log group where the text and metadata logs are delivered. The log group must exist before you enable logging.",
       "properties": {
         "CloudWatchLogGroupArn": "The Amazon Resource Name (ARN) of the log group where text and metadata logs are delivered.",
-        "LogPrefix": "The prefix of the log stream name within the log group that you specified."
+        "LogPrefix": "The prefix of the log stream name within the log group that you specified"
       }
     },
     "AWS::Lex::BotAlias.CodeHookSpecification": {
@@ -31678,16 +31774,16 @@
       "attributes": {},
       "description": "Specifies an Amazon S3 bucket for logging audio conversations",
       "properties": {
-        "KmsKeyArn": "The Amazon Resource Name (ARN) of an AWS Key Management Service key for encrypting audio log files stored in an S3 bucket.",
+        "KmsKeyArn": "The Amazon Resource Name (ARN) of an AWS Key Management Service (KMS) key for encrypting audio log files stored in an Amazon S3 bucket.",
         "LogPrefix": "The S3 prefix to assign to audio log files.",
         "S3BucketArn": "The Amazon Resource Name (ARN) of an Amazon S3 bucket where audio log files are stored."
       }
     },
     "AWS::Lex::BotAlias.SentimentAnalysisSettings": {
       "attributes": {},
-      "description": "",
+      "description": "Determines whether Amazon Lex will use Amazon Comprehend to detect the sentiment of user utterances.",
       "properties": {
-        "DetectSentiment": ""
+        "DetectSentiment": "Sets whether Amazon Lex uses Amazon Comprehend to detect the sentiment of user utterances."
       }
     },
     "AWS::Lex::BotAlias.TextLogDestination": {
@@ -31699,7 +31795,7 @@
     },
     "AWS::Lex::BotAlias.TextLogSetting": {
       "attributes": {},
-      "description": "Defines settings to enable conversation logs.",
+      "description": "Defines settings to enable text conversation logs.",
       "properties": {
         "Destination": "Defines the Amazon CloudWatch Logs destination log group for conversation text logs.",
         "Enabled": "Determines whether conversation logs should be stored for an alias."
@@ -36740,26 +36836,6 @@
         "Tags": "The list of key-value tags that changed for the segment."
       }
     },
-    "AWS::NetworkManager::TransitGatewayPeering": {
-      "attributes": {
-        "CoreNetworkArn": "The ARN of the core network.",
-        "CreatedAt": "The timestamp when the core network peering was created.",
-        "EdgeLocation": "The edge location for the peer.",
-        "OwnerAccountId": "The ID of the account owner.",
-        "PeeringId": "The ID of the peering.",
-        "PeeringType": "The peering type. This will be `TRANSIT_GATEWAY` .",
-        "Ref": "`Ref` returns the `peeringId` . For example: `peering-01234ab1234a12a12` .",
-        "ResourceArn": "The ARN of the resource peered to a core network.",
-        "State": "The current state of the peer. This can be `CREATING` | `FAILED` | `AVAILABLE` | `DELETING` .",
-        "TransitGatewayPeeringAttachmentId": "The ID of the peering attachment."
-      },
-      "description": "Creates a transit gateway peering connection.",
-      "properties": {
-        "CoreNetworkId": "The ID of the core network.",
-        "Tags": "The list of key-value tags associated with the peering.",
-        "TransitGatewayArn": "The ARN of the transit gateway."
-      }
-    },
     "AWS::NetworkManager::TransitGatewayRegistration": {
       "attributes": {
         "Ref": "`Ref` returns the ID of the global network and the ARN of the transit gateway. For example: `global-network-01231231231231231|arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc` ."
@@ -37038,6 +37114,185 @@
         "Tags": "An array of key-value pairs to apply to the sink.\n\nFor more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) ."
       }
     },
+    "AWS::Omics::AnnotationStore": {
+      "attributes": {
+        "CreationTime": "When the store was created.",
+        "Id": "The store's ID.",
+        "Ref": "`Ref` returns the details of this resource. For example:\n\n`{ \"Ref\": \"AnnotationStore.Id\" }` `Ref` returns the id for the annotation store.",
+        "Status": "The store's status.",
+        "StatusMessage": "The store's status message.",
+        "StoreArn": "The store's ARN.",
+        "StoreSizeBytes": "The store's size in bytes.",
+        "UpdateTime": "When the store was updated."
+      },
+      "description": "Creates an annotation store.",
+      "properties": {
+        "Description": "A description for the store.",
+        "Name": "The name of the Annotation Store.",
+        "Reference": "The genome reference for the store's annotations.",
+        "SseConfig": "The store's server-side encryption (SSE) settings.",
+        "StoreFormat": "The annotation file format of the store.",
+        "StoreOptions": "File parsing options for the annotation store.",
+        "Tags": "Tags for the store."
+      }
+    },
+    "AWS::Omics::AnnotationStore.ReferenceItem": {
+      "attributes": {},
+      "description": "A genome reference.",
+      "properties": {
+        "ReferenceArn": "The reference's ARN."
+      }
+    },
+    "AWS::Omics::AnnotationStore.SseConfig": {
+      "attributes": {},
+      "description": "Server-side encryption (SSE) settings for a store.",
+      "properties": {
+        "KeyArn": "An encryption key ARN.",
+        "Type": "The encryption type."
+      }
+    },
+    "AWS::Omics::AnnotationStore.StoreOptions": {
+      "attributes": {},
+      "description": "The store's file parsing options.",
+      "properties": {
+        "TsvStoreOptions": "Formatting options for a TSV file."
+      }
+    },
+    "AWS::Omics::AnnotationStore.TsvStoreOptions": {
+      "attributes": {},
+      "description": "The store's parsing options.",
+      "properties": {
+        "AnnotationType": "The store's annotation type.",
+        "FormatToHeader": "The store's header key to column name mapping.",
+        "Schema": "The schema of an annotation store."
+      }
+    },
+    "AWS::Omics::ReferenceStore": {
+      "attributes": {
+        "Arn": "",
+        "CreationTime": "When the store was created.",
+        "Ref": "`Ref` returns the details of this resource. For example:\n\n`{ \"Ref\": \"ReferenceStore.Arn\" }` `Ref` returns the arn for the reference store.",
+        "ReferenceStoreId": "The store's ID."
+      },
+      "description": "Creates a reference store.",
+      "properties": {
+        "Description": "A description for the store.",
+        "Name": "A name for the store.",
+        "SseConfig": "Server-side encryption (SSE) settings for the store.",
+        "Tags": "Tags for the store."
+      }
+    },
+    "AWS::Omics::ReferenceStore.SseConfig": {
+      "attributes": {},
+      "description": "Server-side encryption (SSE) settings for a store.",
+      "properties": {
+        "KeyArn": "An encryption key ARN.",
+        "Type": "The encryption type."
+      }
+    },
+    "AWS::Omics::RunGroup": {
+      "attributes": {
+        "Arn": "The run group's ARN.",
+        "CreationTime": "When the run group was created.",
+        "Id": "The run group's ID.",
+        "Ref": "`Ref` returns the details of this resource. For example:\n\n`{ \"Ref\": \"RunGroup.CreationTime\" }` `Ref` returns the timestamp for a run group."
+      },
+      "description": "Creates a run group.",
+      "properties": {
+        "MaxCpus": "The group's maximum CPU count setting.",
+        "MaxDuration": "The group's maximum duration setting in minutes.",
+        "MaxRuns": "The group's maximum concurrent run setting.",
+        "Name": "The group's name.",
+        "Tags": "Tags for the group."
+      }
+    },
+    "AWS::Omics::SequenceStore": {
+      "attributes": {
+        "Arn": "The store's ARN.",
+        "CreationTime": "When the store was created.",
+        "Ref": "`Ref` returns the details of this resource. For example:\n\n`{ \"Ref\": \"SequenceStore.CreationTime\" }` `Ref` returns the timestamp for when the sequence store was created.",
+        "SequenceStoreId": "The store's ID."
+      },
+      "description": "Creates a sequence store.",
+      "properties": {
+        "Description": "A description for the store.",
+        "Name": "A name for the store.",
+        "SseConfig": "Server-side encryption (SSE) settings for the store.",
+        "Tags": "Tags for the store."
+      }
+    },
+    "AWS::Omics::SequenceStore.SseConfig": {
+      "attributes": {},
+      "description": "Server-side encryption (SSE) settings for a store.",
+      "properties": {
+        "KeyArn": "An encryption key ARN.",
+        "Type": "The encryption type."
+      }
+    },
+    "AWS::Omics::VariantStore": {
+      "attributes": {
+        "CreationTime": "When the store was created.",
+        "Id": "The store's ID.",
+        "Ref": "`Ref` returns the details of this resource. For example:\n\n`{ \"Ref\": \"VariantStore.Status\" }`\n\nFor the Amazon Omics resource `VariantStore.Status` , `Ref` returns the status of the variant store.",
+        "Status": "The store's status.",
+        "StatusMessage": "The store's status message.",
+        "StoreArn": "The store's ARN.",
+        "StoreSizeBytes": "The store's size in bytes.",
+        "UpdateTime": "When the store was updated."
+      },
+      "description": "Create a store for variant data.",
+      "properties": {
+        "Description": "A description for the store.",
+        "Name": "A name for the store.",
+        "Reference": "The genome reference for the store's variants.",
+        "SseConfig": "Server-side encryption (SSE) settings for the store.",
+        "Tags": "Tags for the store."
+      }
+    },
+    "AWS::Omics::VariantStore.ReferenceItem": {
+      "attributes": {},
+      "description": "The read set's genome reference ARN.",
+      "properties": {
+        "ReferenceArn": "The reference's ARN."
+      }
+    },
+    "AWS::Omics::VariantStore.SseConfig": {
+      "attributes": {},
+      "description": "Server-side encryption (SSE) settings for a store.",
+      "properties": {
+        "KeyArn": "An encryption key ARN.",
+        "Type": "The encryption type."
+      }
+    },
+    "AWS::Omics::Workflow": {
+      "attributes": {
+        "Arn": "The ARN for the workflow.",
+        "CreationTime": "When the workflow was created.",
+        "Id": "The workflow's ID.",
+        "Ref": "`Ref` returns the details of this resource. For example:\n\n`{ \"Ref\": \"Workflow.Type\" }` `Ref` returns the type of workflow.",
+        "Status": "The workflow's status.",
+        "Type": "The workflow's type."
+      },
+      "description": "Creates a workflow.",
+      "properties": {
+        "DefinitionUri": "The URI of a definition for the workflow.",
+        "Description": "The parameter's description.",
+        "Engine": "An engine for the workflow.",
+        "Main": "The path of the main definition file for the workflow.",
+        "Name": "The workflow's name.",
+        "ParameterTemplate": "The workflow's parameter template.",
+        "StorageCapacity": "A storage capacity for the workflow in gigabytes.",
+        "Tags": "Tags for the workflow."
+      }
+    },
+    "AWS::Omics::Workflow.WorkflowParameter": {
+      "attributes": {},
+      "description": "A workflow parameter.",
+      "properties": {
+        "Description": "The parameter's description.",
+        "Optional": "Whether the parameter is optional."
+      }
+    },
     "AWS::OpenSearchServerless::AccessPolicy": {
       "attributes": {
         "Ref": "When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the name of the access policy. For more information about using the `Ref` function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) ."
@@ -37681,7 +37936,7 @@
         "Email": "The email address associated with the AWS account.\n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) for this parameter is a string of characters that represents a standard internet email address.",
         "ParentIds": "The unique identifier (ID) of the root or organizational unit (OU) that you want to create the new account in. If you don't specify this parameter, the `ParentId` defaults to the root ID.\n\nThis parameter only accepts a string array with one string value.\n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) for a parent ID string requires one of the following:\n\n- *Root* - A string that begins with \"r-\" followed by from 4 to 32 lowercase letters or digits.\n- *Organizational unit (OU)* - A string that begins with \"ou-\" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second \"-\" dash and from 8 to 32 additional lowercase letters or digits.",
         "RoleName": "The name of an IAM role that AWS Organizations automatically preconfigures in the new member account. This role trusts the management account, allowing users in the management account to assume the role, as permitted by the management account administrator. The role has administrator permissions in the new member account.\n\nIf you don't specify this parameter, the role name defaults to `OrganizationAccountAccessRole` .\n\nFor more information about how to use this role to access the member account, see the following links:\n\n- [Accessing and Administering the Member Accounts in Your Organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_create-cross-account-role) in the *AWS Organizations User Guide*\n- Steps 2 and 3 in [Tutorial: Delegate Access Across AWS accounts Using IAM Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html) in the *IAM User Guide*\n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) that is used to validate this parameter. The pattern can include uppercase letters, lowercase letters, digits with no spaces, and any of the following characters: =,.@-",
-        "Tags": "A list of tags that you want to attach to the newly created account. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to `null` . For more information about tagging, see [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html) in the AWS Organizations User Guide.\n\n> If any one of the tags is invalid or if you exceed the maximum allowed number of tags for an account, then the entire request fails and the account is not created."
+        "Tags": "A list of tags that you want to attach to the newly created account. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to `null` . For more information about tagging, see [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html) in the AWS Organizations User Guide.\n\n> If any one of the tags is not valid or if you exceed the maximum allowed number of tags for an account, then the entire request fails and the account is not created."
       }
     },
     "AWS::Organizations::OrganizationalUnit": {
@@ -37694,7 +37949,7 @@
       "properties": {
         "Name": "The friendly name of this OU.\n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) that is used to validate this parameter is a string of any of the characters in the ASCII character range.",
         "ParentId": "The unique identifier (ID) of the parent root or OU that you want to create the new OU in.\n\n> To update the `ParentId` parameter value, you must first remove all accounts attached to the organizational unit (OU). OUs can't be moved within the organization with accounts still attached. \n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) for a parent ID string requires one of the following:\n\n- *Root* - A string that begins with \"r-\" followed by from 4 to 32 lowercase letters or digits.\n- *Organizational unit (OU)* - A string that begins with \"ou-\" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second \"-\" dash and from 8 to 32 additional lowercase letters or digits.",
-        "Tags": "A list of tags that you want to attach to the newly created OU. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to `null` . For more information about tagging, see [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html) in the AWS Organizations User Guide.\n\n> If any one of the tags is invalid or if you exceed the allowed number of tags for an OU, then the entire request fails and the OU is not created."
+        "Tags": "A list of tags that you want to attach to the newly created OU. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to `null` . For more information about tagging, see [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html) in the AWS Organizations User Guide.\n\n> If any one of the tags is not valid or if you exceed the allowed number of tags for an OU, then the entire request fails and the OU is not created."
       }
     },
     "AWS::Organizations::Policy": {
@@ -37709,7 +37964,7 @@
         "Content": "The policy text content.",
         "Description": "Human readable description of the policy.",
         "Name": "Name of the policy.\n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) that is used to validate this parameter is a string of any of the characters in the ASCII character range.",
-        "Tags": "A list of tags that you want to attach to the newly created policy. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to `null` . For more information about tagging, see [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html) in the AWS Organizations User Guide.\n\n> If any one of the tags is invalid or if you exceed the allowed number of tags for a policy, then the entire request fails and the policy is not created.",
+        "Tags": "A list of tags that you want to attach to the newly created policy. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to `null` . For more information about tagging, see [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html) in the AWS Organizations User Guide.\n\n> If any one of the tags is not valid or if you exceed the allowed number of tags for a policy, then the entire request fails and the policy is not created.",
         "TargetIds": "List of unique identifiers (IDs) of the root, OU, or account that you want to attach the policy to. You can get the ID by calling the [ListRoots](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListRoots.html) , [ListOrganizationalUnitsForParent](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListOrganizationalUnitsForParent.html) , or [ListAccounts](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html) operations. If you don't specify this parameter, the policy is created but not attached to any organization resource.\n\nThe [regex pattern](https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) for a target ID string requires one of the following:\n\n- *Root* - A string that begins with \"r-\" followed by from 4 to 32 lowercase letters or digits.\n- *Account* - A string that consists of exactly 12 digits.\n- *Organizational unit (OU)* - A string that begins with \"ou-\" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second \"-\" dash and from 8 to 32 additional lowercase letters or digits.",
         "Type": "The type of policy to create."
       }
@@ -39243,7 +39498,7 @@
       "description": "The parameters for using an EventBridge event bus as a target.",
       "properties": {
         "DetailType": "A free-form string, with a maximum of 128 characters, used to decide what fields to expect in the event detail.",
-        "EndpointId": "The URL subdomain of the endpoint. For example, if the URL for Endpoint is https://abcde.veo.endpoints.event.amazonaws.com, then the EndpointId is `abcde.veo` .\n\n> When using Java, you must include `auth-crt` on the class path.",
+        "EndpointId": "The URL subdomain of the endpoint. For example, if the URL for Endpoint is https://abcde.veo.endpoints.event.amazonaws.com, then the EndpointId is `abcde.veo` .",
         "Resources": "AWS resources, identified by Amazon Resource Name (ARN), which the event primarily concerns. Any number, including zero, may be present.",
         "Source": "The source of the event.",
         "Time": "The time stamp of the event, per [RFC3339](https://docs.aws.amazon.com/https://www.rfc-editor.org/rfc/rfc3339.txt) . If no time stamp is provided, the time stamp of the [PutEvents](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html) call is used."
@@ -39411,7 +39666,7 @@
         "DataSetArns": "The ARNs of the datasets of the analysis.",
         "LastUpdatedTime": "The time that the analysis was last updated."
       },
-      "description": "Creates an analysis in Amazon QuickSight.",
+      "description": "Creates an analysis in Amazon QuickSight. Analyses can be created either from a template or from an `AnalysisDefinition` .",
       "properties": {
         "AnalysisId": "The ID for the analysis that you're creating. This ID displays in the URL of the analysis.",
         "AwsAccountId": "The ID of the AWS account where you are creating an analysis.",
@@ -39419,7 +39674,7 @@
         "Name": "A descriptive name for the analysis that you're creating. This name displays for the analysis in the Amazon QuickSight console.",
         "Parameters": "The parameter names and override values that you want to use. An analysis can have any parameter type, and some parameters might accept multiple values.",
         "Permissions": "A structure that describes the principals and the resource-level permissions on an analysis. You can use the `Permissions` structure to grant permissions by providing a list of AWS Identity and Access Management (IAM) action information for each principal listed by Amazon Resource Name (ARN).\n\nTo specify no permissions, omit `Permissions` .",
-        "SourceEntity": "A source entity to use for the analysis that you're creating. This metadata structure contains details that describe a source template and one or more datasets.",
+        "SourceEntity": "A source entity to use for the analysis that you're creating. This metadata structure contains details that describe a source template and one or more datasets.\n\nEither a `SourceEntity` or a `Definition` must be provided in order for the request to be valid.",
         "Tags": "Contains a map of the key-value pairs for the resource tag or tags assigned to the analysis.",
         "ThemeArn": "The ARN for the theme to apply to the analysis that you're creating. To see the theme in the Amazon QuickSight console, make sure that you have access to it."
       }
@@ -40230,12 +40485,12 @@
         "Version.ThemeArn": "",
         "Version.VersionNumber": ""
       },
-      "description": "Creates a template from an existing Amazon QuickSight analysis or template. You can use the resulting template to create a dashboard.\n\nA *template* is an entity in Amazon QuickSight that encapsulates the metadata required to create an analysis and that you can use to create s dashboard. A template adds a layer of abstraction by using placeholders to replace the dataset associated with the analysis. You can use templates to create dashboards by replacing dataset placeholders with datasets that follow the same schema that was used to create the source analysis and template.",
+      "description": "Creates a template either from a `TemplateDefinition` or from an existing Amazon QuickSight analysis or template. You can use the resulting template to create additional dashboards, templates, or analyses.\n\nA *template* is an entity in Amazon QuickSight that encapsulates the metadata required to create an analysis and that you can use to create s dashboard. A template adds a layer of abstraction by using placeholders to replace the dataset associated with the analysis. You can use templates to create dashboards by replacing dataset placeholders with datasets that follow the same schema that was used to create the source analysis and template.",
       "properties": {
         "AwsAccountId": "The ID for the AWS account that the group is in. You use the ID for the AWS account that contains your Amazon QuickSight account.",
         "Name": "A display name for the template.",
         "Permissions": "A list of resource permissions to be set on the template.",
-        "SourceEntity": "The entity that you are using as a source when you create the template. In `SourceEntity` , you specify the type of object you're using as source: `SourceTemplate` for a template or `SourceAnalysis` for an analysis. Both of these require an Amazon Resource Name (ARN). For `SourceTemplate` , specify the ARN of the source template. For `SourceAnalysis` , specify the ARN of the source analysis. The `SourceTemplate` ARN can contain any AWS account and any Amazon QuickSight-supported AWS Region .\n\nUse the `DataSetReferences` entity within `SourceTemplate` or `SourceAnalysis` to list the replacement datasets for the placeholders listed in the original. The schema in each dataset must match its placeholder.",
+        "SourceEntity": "The entity that you are using as a source when you create the template. In `SourceEntity` , you specify the type of object you're using as source: `SourceTemplate` for a template or `SourceAnalysis` for an analysis. Both of these require an Amazon Resource Name (ARN). For `SourceTemplate` , specify the ARN of the source template. For `SourceAnalysis` , specify the ARN of the source analysis. The `SourceTemplate` ARN can contain any AWS account and any Amazon QuickSight-supported AWS Region .\n\nUse the `DataSetReferences` entity within `SourceTemplate` or `SourceAnalysis` to list the replacement datasets for the placeholders listed in the original. The schema in each dataset must match its placeholder.\n\nEither a `SourceEntity` or a `Definition` must be provided in order for the request to be valid.",
         "Tags": "Contains a map of the key-value pairs for the resource tag or tags assigned to the resource.",
         "TemplateId": "An ID for the template that you want to create. This template is unique per AWS Region ; in each AWS account.",
         "VersionDescription": "A description of the current template version being created. This API operation creates the first version of the template. Every time `UpdateTemplate` is called, a new version is created. Each version of the template maintains a description of the version in the `VersionDescription` field."
@@ -40686,7 +40941,7 @@
         "CopyTagsToSnapshot": "A value that indicates whether to copy tags from the DB instance to snapshots of the DB instance. By default, tags are not copied.\n\n*Amazon Aurora*\n\nNot applicable. Copying tags to snapshots is managed by the DB cluster. Setting this value for an Aurora DB instance has no effect on the DB cluster setting.",
         "CustomIAMInstanceProfile": "The instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance. The instance profile must meet the following requirements:\n\n- The profile must exist in your account.\n- The profile must have an IAM role that Amazon EC2 has permissions to assume.\n- The instance profile name and the associated IAM role name must start with the prefix `AWSRDSCustom` .\n\nFor the list of permissions required for the IAM role, see [Configure IAM and your VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-setup-orcl.html#custom-setup-orcl.iam-vpc) in the *Amazon RDS User Guide* .\n\nThis setting is required for RDS Custom.",
         "DBClusterIdentifier": "The identifier of the DB cluster that the instance will belong to.",
-        "DBClusterSnapshotIdentifier": "The identifier for the RDS for MySQL Multi-AZ DB cluster snapshot to restore from.\n\nFor more information on Multi-AZ DB clusters, see [Multi-AZ deployments with two readable standby DB instances](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html) in the *Amazon RDS User Guide* .\n\nConstraints:\n\n- Must match the identifier of an existing Multi-AZ DB cluster snapshot.\n- Can't be specified when `DBSnapshotIdentifier` is specified.\n- Must be specified when `DBSnapshotIdentifier` isn't specified.\n- If you are restoring from a shared manual Multi-AZ DB cluster snapshot, the `DBClusterSnapshotIdentifier` must be the ARN of the shared snapshot.\n- Can't be the identifier of an Aurora DB cluster snapshot.\n- Can't be the identifier of an RDS for PostgreSQL Multi-AZ DB cluster snapshot.",
+        "DBClusterSnapshotIdentifier": "The identifier for the RDS for MySQL Multi-AZ DB cluster snapshot to restore from.\n\nFor more information on Multi-AZ DB clusters, see [Multi-AZ DB cluster deployments](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html) in the *Amazon RDS User Guide* .\n\nConstraints:\n\n- Must match the identifier of an existing Multi-AZ DB cluster snapshot.\n- Can't be specified when `DBSnapshotIdentifier` is specified.\n- Must be specified when `DBSnapshotIdentifier` isn't specified.\n- If you are restoring from a shared manual Multi-AZ DB cluster snapshot, the `DBClusterSnapshotIdentifier` must be the ARN of the shared snapshot.\n- Can't be the identifier of an Aurora DB cluster snapshot.\n- Can't be the identifier of an RDS for PostgreSQL Multi-AZ DB cluster snapshot.",
         "DBInstanceClass": "The compute and memory capacity of the DB instance, for example, `db.m4.large` . Not all DB instance classes are available in all AWS Regions, or for all database engines.\n\nFor the full list of DB instance classes, and availability for your engine, see [DB Instance Class](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html) in the *Amazon RDS User Guide.* For more information about DB instance class pricing and AWS Region support for DB instance classes, see [Amazon RDS Pricing](https://docs.aws.amazon.com/rds/pricing/) .",
         "DBInstanceIdentifier": "A name for the DB instance. If you specify a name, AWS CloudFormation converts it to lowercase. If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the DB instance. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .\n\nFor information about constraints that apply to DB instance identifiers, see [Naming constraints in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.Constraints) in the *Amazon RDS User Guide* .\n\n> If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.",
         "DBName": "The meaning of this parameter differs according to the database engine you use.\n\n> If you specify the `[DBSnapshotIdentifier](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-dbsnapshotidentifier)` property, this property only applies to RDS for Oracle. \n\n*Amazon Aurora*\n\nNot applicable. The database name is managed by the DB cluster.\n\n*MySQL*\n\nThe name of the database to create when the DB instance is created. If this parameter is not specified, no database is created in the DB instance.\n\nConstraints:\n\n- Must contain 1 to 64 letters or numbers.\n- Can't be a word reserved by the specified database engine\n\n*MariaDB*\n\nThe name of the database to create when the DB instance is created. If this parameter is not specified, no database is created in the DB instance.\n\nConstraints:\n\n- Must contain 1 to 64 letters or numbers.\n- Can't be a word reserved by the specified database engine\n\n*PostgreSQL*\n\nThe name of the database to create when the DB instance is created. If this parameter is not specified, the default `postgres` database is created in the DB instance.\n\nConstraints:\n\n- Must begin with a letter. Subsequent characters can be letters, underscores, or digits (0-9).\n- Must contain 1 to 63 characters.\n- Can't be a word reserved by the specified database engine\n\n*Oracle*\n\nThe Oracle System ID (SID) of the created DB instance. If you specify `null` , the default value `ORCL` is used. You can't specify the string NULL, or any other reserved word, for `DBName` .\n\nDefault: `ORCL`\n\nConstraints:\n\n- Can't be longer than 8 characters\n\n*SQL Server*\n\nNot applicable. Must be null.",
@@ -41098,7 +41353,7 @@
         "MaintenanceTrackName": "An optional parameter for the name of the maintenance track for the cluster. If you don't provide a maintenance track name, the cluster is assigned to the `current` track.",
         "ManualSnapshotRetentionPeriod": "The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots.\n\nThe value must be either -1 or an integer between 1 and 3,653.",
         "MasterUserPassword": "The password associated with the admin user account for the cluster that is being created.\n\nConstraints:\n\n- Must be between 8 and 64 characters in length.\n- Must contain at least one uppercase letter.\n- Must contain at least one lowercase letter.\n- Must contain one number.\n- Can be any printable ASCII character (ASCII code 33-126) except `'` (single quote), `\"` (double quote), `\\` , `/` , or `@` .",
-        "MasterUsername": "The user name associated with the admin user account for the cluster that is being created.\n\nConstraints:\n\n- Must be 1 - 128 alphanumeric characters. The user name can't be `PUBLIC` .\n- First character must be a letter.\n- Cannot be a reserved word. A list of reserved words can be found in [Reserved Words](https://docs.aws.amazon.com/redshift/latest/dg/r_pg_keywords.html) in the Amazon Redshift Database Developer Guide.",
+        "MasterUsername": "The user name associated with the admin user account for the cluster that is being created.\n\nConstraints:\n\n- Must be 1 - 128 alphanumeric characters or hyphens. The user name can't be `PUBLIC` .\n- Must contain only lowercase letters, numbers, underscore, plus sign, period (dot), at symbol (@), or hyphen.\n- The first character must be a letter.\n- Must not contain a colon (:) or a slash (/).\n- Cannot be a reserved word. A list of reserved words can be found in [Reserved Words](https://docs.aws.amazon.com/redshift/latest/dg/r_pg_keywords.html) in the Amazon Redshift Database Developer Guide.",
         "NodeType": "The node type to be provisioned for the cluster. For information about node types, go to [Working with Clusters](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#how-many-nodes) in the *Amazon Redshift Cluster Management Guide* .\n\nValid Values: `ds2.xlarge` | `ds2.8xlarge` | `dc1.large` | `dc1.8xlarge` | `dc2.large` | `dc2.8xlarge` | `ra3.xlplus` | `ra3.4xlarge` | `ra3.16xlarge`",
         "NumberOfNodes": "The number of compute nodes in the cluster. This parameter is required when the *ClusterType* parameter is specified as `multi-node` .\n\nFor information about determining how many nodes you need, go to [Working with Clusters](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#how-many-nodes) in the *Amazon Redshift Cluster Management Guide* .\n\nIf you don't specify this parameter, you get a single-node cluster. When requesting a multi-node cluster, you must specify the number of nodes that you want in the cluster.\n\nDefault: `1`\n\nConstraints: Value must be at least 1 and no more than 100.",
         "OwnerAccount": "The AWS account used to create or copy the snapshot. Required if you are restoring a snapshot you do not own, optional if you own the snapshot.",
@@ -41112,7 +41367,7 @@
         "SnapshotCopyGrantName": "The name of the snapshot copy grant.",
         "SnapshotCopyManual": "Indicates whether to apply the snapshot retention period to newly copied manual snapshots instead of automated snapshots.",
         "SnapshotCopyRetentionPeriod": "The number of days to retain automated snapshots in the destination AWS Region after they are copied from the source AWS Region .\n\nBy default, this only changes the retention period of copied automated snapshots.\n\nIf you decrease the retention period for automated snapshots that are copied to a destination AWS Region , Amazon Redshift deletes any existing automated snapshots that were copied to the destination AWS Region and that fall outside of the new retention period.\n\nConstraints: Must be at least 1 and no more than 35 for automated snapshots.\n\nIf you specify the `manual` option, only newly copied manual snapshots will have the new retention period.\n\nIf you specify the value of -1 newly copied manual snapshots are retained indefinitely.\n\nConstraints: The number of days must be either -1 or an integer between 1 and 3,653 for manual snapshots.",
-        "SnapshotIdentifier": "The name of the snapshot from which to create the new cluster. This parameter isn't case sensitive. You can specify this parameter or `snapshotArn` , but not both.\n\nExample: `my-snapshot-id`",
+        "SnapshotIdentifier": "The name of the snapshot from which to create the new cluster. This parameter isn't case sensitive. You must specify this parameter or `snapshotArn` , but not both.\n\nExample: `my-snapshot-id`",
         "Tags": "A list of tag instances.",
         "VpcSecurityGroupIds": "A list of Virtual Private Cloud (VPC) security groups to be associated with the cluster.\n\nDefault: The default VPC security group is associated with the cluster."
       }
@@ -41247,7 +41502,7 @@
       },
       "description": "Describes an endpoint authorization for authorizing Redshift-managed VPC endpoint access to a cluster across AWS accounts .",
       "properties": {
-        "Account": "The A AWS account ID of either the cluster owner (grantor) or grantee. If `Grantee` parameter is true, then the `Account` value is of the grantor.",
+        "Account": "The AWS account ID of either the cluster owner (grantor) or grantee. If `Grantee` parameter is true, then the `Account` value is of the grantor.",
         "ClusterIdentifier": "The cluster identifier.",
         "Force": "Indicates whether to force the revoke action. If true, the Redshift-managed VPC endpoints associated with the endpoint authorization are also deleted.",
         "VpcIds": "The virtual private cloud (VPC) identifiers to grant access to."
@@ -41983,42 +42238,42 @@
     "AWS::RolesAnywhere::CRL": {
       "attributes": {
         "CrlId": "The unique primary identifier of the Crl",
-        "Ref": "The name of the CRL."
+        "Ref": "`Ref` returns `CrlId` ."
       },
-      "description": "Creates a Crl.",
+      "description": "The state of the certificate revocation list (CRL) after a read or write operation.",
       "properties": {
-        "CrlData": "x509 v3 Certificate Revocation List to revoke auth for corresponding certificates presented in CreateSession operations",
-        "Enabled": "The enabled status of the resource.",
-        "Name": "The customer specified name of the resource.",
-        "Tags": "A list of Tags.",
+        "CrlData": "The revocation record for a certificate, following the x509 v3 standard.",
+        "Enabled": "Indicates whether the certificate revocation list (CRL) is enabled.",
+        "Name": "The name of the certificate revocation list (CRL).",
+        "Tags": "A list of tags to attach to the CRL.",
         "TrustAnchorArn": "The ARN of the TrustAnchor the certificate revocation list (CRL) will provide revocation for."
       }
     },
     "AWS::RolesAnywhere::Profile": {
       "attributes": {
-        "ProfileArn": "",
+        "ProfileArn": "The ARN of the profile.",
         "ProfileId": "The unique primary identifier of the Profile",
-        "Ref": "The name of the Profile"
+        "Ref": "`Ref` returns `ProfileId` ."
       },
-      "description": "Creates a Profile.",
+      "description": "Creates a *profile* , a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.\n\n*Required permissions:* `rolesanywhere:CreateProfile` .",
       "properties": {
-        "DurationSeconds": "The number of seconds vended session credentials will be valid for",
-        "Enabled": "The enabled status of the resource.",
-        "ManagedPolicyArns": "A list of managed policy ARNs. Managed policies identified by this list will be applied to the vended session credentials.",
-        "Name": "The customer specified name of the resource.",
-        "RequireInstanceProperties": "Specifies whether instance properties are required in CreateSession requests with this profile.",
-        "RoleArns": "A list of IAM role ARNs that can be assumed when this profile is specified in a CreateSession request.",
-        "SessionPolicy": "A session policy that will applied to the trust boundary of the vended session credentials.",
-        "Tags": "A list of Tags."
+        "DurationSeconds": "Sets the maximum number of seconds that vended temporary credentials through [CreateSession](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html) will be valid for, between 900 and 3600.",
+        "Enabled": "Indicates whether the profile is enabled.",
+        "ManagedPolicyArns": "A list of managed policy ARNs that apply to the vended session credentials.",
+        "Name": "The name of the profile.",
+        "RequireInstanceProperties": "Specifies whether instance properties are required in temporary credential requests with this profile.",
+        "RoleArns": "A list of IAM role ARNs. During `CreateSession` , if a matching role ARN is provided, the properties in this profile will be applied to the intersection session policy.",
+        "SessionPolicy": "A session policy that applies to the trust boundary of the vended session credentials.",
+        "Tags": "A list of tags to attach to the profile."
       }
     },
     "AWS::RolesAnywhere::TrustAnchor": {
       "attributes": {
         "Ref": "`Ref` returns `TrustAnchorId` .",
         "TrustAnchorArn": "The ARN of the trust anchor.",
-        "TrustAnchorId": ""
+        "TrustAnchorId": "The unique primary identifier of the TrustAnchor"
       },
-      "description": "Creates a TrustAnchor.",
+      "description": "The state of the trust anchor after a read or write operation.",
       "properties": {
         "Enabled": "Indicates whether the trust anchor is enabled.",
         "Name": "The name of the trust anchor.",
@@ -42028,15 +42283,15 @@
     },
     "AWS::RolesAnywhere::TrustAnchor.Source": {
       "attributes": {},
-      "description": "Object representing the TrustAnchor type and its related certificate data.",
+      "description": "The trust anchor type and its related certificate data.",
       "properties": {
-        "SourceData": "A union object representing the data field of the TrustAnchor depending on its type",
-        "SourceType": "The type of the TrustAnchor."
+        "SourceData": "The data field of the trust anchor depending on its type.",
+        "SourceType": "The type of the trust anchor."
       }
     },
     "AWS::RolesAnywhere::TrustAnchor.SourceData": {
       "attributes": {},
-      "description": "A union object representing the data field of the TrustAnchor depending on its type",
+      "description": "The data field of the trust anchor depending on its type.",
       "properties": {
         "AcmPcaArn": "The root certificate of the AWS Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type `AWS_ACM_PCA` .",
         "X509CertificateData": "The PEM-encoded data for the certificate anchor. Included for trust anchors of type `CERTIFICATE_BUNDLE` ."
@@ -45090,7 +45345,7 @@
         "SingleSignOnManagedApplicationInstanceId": "The IAM Identity Center managed application instance ID.",
         "Url": "The URL for the Domain."
       },
-      "description": "Creates a `Domain` used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An AWS account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other.\n\n*EFS storage*\n\nWhen a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.\n\nSageMaker uses the AWS Key Management Service ( AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed key by default. For more control, you can specify a customer managed key. For more information, see [Protect Data at Rest Using Encryption](https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html) .\n\n*VPC configuration*\n\nAll SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the `AppNetworkAccessType` parameter. `AppNetworkAccessType` corresponds to the network access type that you choose when you onboard to Studio. The following options are available:\n\n- `PublicInternetOnly` - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.\n- `VpcOnly` - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.\n\nWhen internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.\n\n> NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully. \n\nFor more information, see [Connect SageMaker Studio Notebooks to Resources in a VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-notebooks-and-internet-access.html) .",
+      "description": "Creates a `Domain` used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. Users within a domain can share notebook files and other artifacts with each other.\n\n*EFS storage*\n\nWhen a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.\n\nSageMaker uses the AWS Key Management Service ( AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed key by default. For more control, you can specify a customer managed key. For more information, see [Protect Data at Rest Using Encryption](https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html) .\n\n*VPC configuration*\n\nAll SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the `AppNetworkAccessType` parameter. `AppNetworkAccessType` corresponds to the network access type that you choose when you onboard to Studio. The following options are available:\n\n- `PublicInternetOnly` - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.\n- `VpcOnly` - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.\n\nWhen internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.\n\n> NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully. \n\nFor more information, see [Connect SageMaker Studio Notebooks to Resources in a VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-notebooks-and-internet-access.html) .",
       "properties": {
         "AppNetworkAccessType": "Specifies the VPC used for non-EFS traffic. The default value is `PublicInternetOnly` .\n\n- `PublicInternetOnly` - Non-EFS traffic is through a VPC managed by Amazon SageMaker , which allows direct internet access\n- `VpcOnly` - All Studio traffic is through the specified VPC and subnets\n\n*Valid Values* : `PublicInternetOnly | VpcOnly`",
         "AppSecurityGroupManagement": "The entity that creates and manages the required security groups for inter-app communication in `VpcOnly` mode. Required when `CreateDomain.AppNetworkAccessType` is `VpcOnly` and `DomainSettings.RStudioServerProDomainSettings.DomainExecutionRoleArn` is provided.",
@@ -45489,7 +45744,7 @@
         "DataCatalogConfig": "The meta data of the Glue table that is autogenerated when an `OfflineStore` is created.",
         "DisableGlueTableCreation": "Set to `True` to disable the automatic creation of an AWS Glue table when configuring an `OfflineStore` .",
         "S3StorageConfig": "The Amazon Simple Storage (Amazon S3) location of `OfflineStore` .",
-        "TableFormat": "Format for the offline store table. Supported formats are Glue (Default) and [Apache Iceberg](https://docs.aws.amazon.com/https://iceberg.apache.org/) ."
+        "TableFormat": ""
       }
     },
     "AWS::SageMaker::FeatureGroup.OnlineStoreConfig": {
@@ -45504,7 +45759,7 @@
       "attributes": {},
       "description": "The security configuration for `OnlineStore` .",
       "properties": {
-        "KmsKeyId": "The ID of the AWS Key Management Service ( AWS KMS) key that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.\n\nThe caller (either IAM user or IAM role) of `CreateFeatureGroup` must have below permissions to the `OnlineStore` `KmsKeyId` :\n\n- `\"kms:Encrypt\"`\n- `\"kms:Decrypt\"`\n- `\"kms:DescribeKey\"`\n- `\"kms:CreateGrant\"`\n- `\"kms:RetireGrant\"`\n- `\"kms:ReEncryptFrom\"`\n- `\"kms:ReEncryptTo\"`\n- `\"kms:GenerateDataKey\"`\n- `\"kms:ListAliases\"`\n- `\"kms:ListGrants\"`\n- `\"kms:RevokeGrant\"`\n\nThe caller (either IAM user or IAM role) to all DataPlane operations ( `PutRecord` , `GetRecord` , `DeleteRecord` ) must have the following permissions to the `KmsKeyId` :\n\n- `\"kms:Decrypt\"`"
+        "KmsKeyId": "The ID of the AWS Key Management Service ( AWS KMS) key that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.\n\nThe caller (either IAM user or IAM role) of `CreateFeatureGroup` must have below permissions to the `OnlineStore` `KmsKeyId` :\n\n- `\"kms:Encrypt\"`\n- `\"kms:Decrypt\"`\n- `\"kms:DescribeKey\"`\n- `\"kms:CreateGrant\"`\n- `\"kms:RetireGrant\"`\n- `\"kms:ReEncryptFrom\"`\n- `\"kms:ReEncryptTo\"`\n- `\"kms:GenerateDataKey\"`\n- `\"kms:ListAliases\"`\n- `\"kms:ListGrants\"`\n- `\"kms:RevokeGrant\"`\n\nThe caller (either user or IAM role) to all DataPlane operations ( `PutRecord` , `GetRecord` , `DeleteRecord` ) must have the following permissions to the `KmsKeyId` :\n\n- `\"kms:Decrypt\"`"
       }
     },
     "AWS::SageMaker::FeatureGroup.S3StorageConfig": {
@@ -45570,7 +45825,7 @@
         "ImageConfig": "Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For information about storing containers in a private Docker registry, see [Use a Private Docker Registry for Real-Time Inference Containers](https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-containers-inference-private.html)",
         "InferenceSpecificationName": "The inference specification name in the model package version.",
         "Mode": "Whether the container hosts a single model or multiple models.",
-        "ModelDataUrl": "The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see [Common Parameters](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-algo-docker-registry-paths.html) .\n\n> The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating. \n\nIf you provide a value for this parameter, SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see [Activating and Deactivating AWS STS in an AWS Region](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) in the *AWS Identity and Access Management User Guide* .\n\n> If you use a built-in algorithm to create a model, SageMaker requires that you provide a S3 path to the model artifacts in `ModelDataUrl` .",
+        "ModelDataUrl": "The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see [Common Parameters](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-algo-docker-registry-paths.html) .\n\n> The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating. \n\nIf you provide a value for this parameter, SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your AWS account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see [Activating and Deactivating AWS STS in an AWS Region](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) in the *AWS Identity and Access Management User Guide* .\n\n> If you use a built-in algorithm to create a model, SageMaker requires that you provide a S3 path to the model artifacts in `ModelDataUrl` .",
         "ModelPackageName": "The name or Amazon Resource Name (ARN) of the model package to use to create the model.",
         "MultiModelConfig": "Specifies additional configuration for multi-model endpoints."
       }
@@ -45794,6 +46049,174 @@
         "Subnets": "The ID of the subnets in the VPC to which you want to connect your training job or model. For information about the availability of specific instance types, see [Supported Instance Types and Availability Zones](https://docs.aws.amazon.com/sagemaker/latest/dg/instance-types-az.html) ."
       }
     },
+    "AWS::SageMaker::ModelCard": {
+      "attributes": {
+        "ModelCardArn": "The Amazon Resource Number (ARN) of the model card. For example, `arn:aws:sagemaker:us-west-2:012345678901:modelcard/examplemodelcard` .",
+        "Ref": "`Ref` returns the model card name.\n\nFor more information about using the Ref function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) ."
+      },
+      "description": "Creates an Amazon SageMaker Model Card.\n\nFor information about how to use model cards, see [Amazon SageMaker Model Card](https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html) .",
+      "properties": {
+        "Content": "The content of the model card. Content uses the [model card JSON schema](https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html#model-cards-json-schema) .",
+        "ModelCardName": "The unique name of the model card.",
+        "ModelCardStatus": "The approval status of the model card within your organization. Different organizations might have different criteria for model card review and approval.\n\n- `Draft` : The model card is a work in progress.\n- `PendingReview` : The model card is pending review.\n- `Approved` : The model card is approved.\n- `Archived` : The model card is archived. No more updates should be made to the model card, but it can still be exported.",
+        "SecurityConfig": "The security configuration used to protect model card data.",
+        "Tags": "Key-value pairs used to manage metadata for the model card."
+      }
+    },
+    "AWS::SageMaker::ModelCard.AdditionalInformation": {
+      "attributes": {},
+      "description": "Additional information about the model.",
+      "properties": {
+        "CaveatsAndRecommendations": "Caveats and recommendations for those who might use this model in their applications.",
+        "CustomDetails": "Any additional information to document about the model.",
+        "EthicalConsiderations": "Any ethical considerations documented by the model card author."
+      }
+    },
+    "AWS::SageMaker::ModelCard.BusinessDetails": {
+      "attributes": {},
+      "description": "Information about how the model supports business goals.",
+      "properties": {
+        "BusinessProblem": "The specific business problem that the model is trying to solve.",
+        "BusinessStakeholders": "The relevant stakeholders for the model.",
+        "LineOfBusiness": "The broader business need that the model is serving."
+      }
+    },
+    "AWS::SageMaker::ModelCard.Content": {
+      "attributes": {},
+      "description": "The content of the model card. It follows the [model card json schema](https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html#model-cards-json-schema) .",
+      "properties": {
+        "AdditionalInformation": "Additional information about the model.",
+        "BusinessDetails": "Information about how the model supports business goals.",
+        "EvaluationDetails": "An overview about the model's evaluation.",
+        "IntendedUses": "The intended usage of the model.",
+        "ModelOverview": "An overview about the model",
+        "TrainingDetails": "An overview about model training."
+      }
+    },
+    "AWS::SageMaker::ModelCard.EvaluationDetail": {
+      "attributes": {},
+      "description": "The evaluation details of the model.",
+      "properties": {
+        "Datasets": "The location of the datasets used to evaluate the model.",
+        "EvaluationJobArn": "The Amazon Resource Name (ARN) of the evaluation job.",
+        "EvaluationObservation": "Any observations made during the model evaluation.",
+        "Metadata": "Additional attributes associated with the evaluation results.",
+        "MetricGroups": "An evaluation Metric Group object.",
+        "Name": "The evaluation job name."
+      }
+    },
+    "AWS::SageMaker::ModelCard.Function": {
+      "attributes": {},
+      "description": "Function details.",
+      "properties": {
+        "Condition": "An optional description of any conditions of your objective function metric.",
+        "Facet": "The metric of the model's objective function. For example, *loss* or *rmse* . The following list shows examples of the values that you can specify for the metric:\n\n- `ACCURACY`\n- `AUC`\n- `LOSS`\n- `MAE`\n- `RMSE`",
+        "Function": "The optimization direction of the model's objective function. You must specify one of the following values:\n\n- `Maximize`\n- `Minimize`"
+      }
+    },
+    "AWS::SageMaker::ModelCard.InferenceEnvironment": {
+      "attributes": {},
+      "description": "An overview of a model's inference environment.",
+      "properties": {
+        "ContainerImage": "The container used to run the inference environment."
+      }
+    },
+    "AWS::SageMaker::ModelCard.IntendedUses": {
+      "attributes": {},
+      "description": "The intended uses of a model.",
+      "properties": {
+        "ExplanationsForRiskRating": "An explanation of why your organization categorizes the model with its risk rating.",
+        "FactorsAffectingModelEfficiency": "Factors affecting model efficacy.",
+        "IntendedUses": "The intended use cases for the model.",
+        "PurposeOfModel": "The general purpose of the model.",
+        "RiskRating": "Your organization's risk rating. You can specify one the following values as the risk rating:\n\n- High\n- Medium\n- Low\n- Unknown"
+      }
+    },
+    "AWS::SageMaker::ModelCard.MetricGroup": {
+      "attributes": {},
+      "description": "A group of metric data that you use to initialize a metric group object.",
+      "properties": {
+        "MetricData": "A list of metric objects. The `MetricDataItems` list can have one of the following values:\n\n- `bar_chart_metric`\n- `matrix_metric`\n- `simple_metric`\n- `linear_graph_metric`\n\nFor more information about the metric schema, see the definition section of the [model card JSON schema](https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html#model-cards-json-schema) .",
+        "Name": "The metric group name."
+      }
+    },
+    "AWS::SageMaker::ModelCard.ModelOverview": {
+      "attributes": {},
+      "description": "An overview about the model.",
+      "properties": {
+        "AlgorithmType": "The algorithm used to solve the problem.",
+        "InferenceEnvironment": "An overview about model inference.",
+        "ModelArtifact": "The location of the model artifact.",
+        "ModelCreator": "The creator of the model.",
+        "ModelDescription": "A description of the model.",
+        "ModelId": "The SageMaker Model ARN or non- SageMaker Model ID.",
+        "ModelName": "The name of the model.",
+        "ModelOwner": "The owner of the model.",
+        "ModelVersion": "The version of the model.",
+        "ProblemType": "The problem being solved with the model."
+      }
+    },
+    "AWS::SageMaker::ModelCard.ObjectiveFunction": {
+      "attributes": {},
+      "description": "The function that is optimized during model training.",
+      "properties": {
+        "Function": "A function object that details optimization direction, metric, and additional descriptions.",
+        "Notes": "Notes about the object function, including other considerations for possible objective functions."
+      }
+    },
+    "AWS::SageMaker::ModelCard.SecurityConfig": {
+      "attributes": {},
+      "description": "The security configuration used to protect model card data.",
+      "properties": {
+        "KmsKeyId": "A AWS Key Management Service [key ID](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id) used to encrypt a model card."
+      }
+    },
+    "AWS::SageMaker::ModelCard.TrainingDetails": {
+      "attributes": {},
+      "description": "The training details of the model",
+      "properties": {
+        "ObjectiveFunction": "The function that is optimized during model training.",
+        "TrainingJobDetails": "Details about any associated training jobs.",
+        "TrainingObservations": "Any observations about training."
+      }
+    },
+    "AWS::SageMaker::ModelCard.TrainingEnvironment": {
+      "attributes": {},
+      "description": "SageMaker training image.",
+      "properties": {
+        "ContainerImage": "SageMaker inference image URI."
+      }
+    },
+    "AWS::SageMaker::ModelCard.TrainingHyperParameter": {
+      "attributes": {},
+      "description": "A hyper parameter that was configured in training the model.",
+      "properties": {
+        "Name": "The name of the hyper parameter.",
+        "Value": "The value specified for the hyper parameter."
+      }
+    },
+    "AWS::SageMaker::ModelCard.TrainingJobDetails": {
+      "attributes": {},
+      "description": "The overview of a training job.",
+      "properties": {
+        "HyperParameters": "The hyper parameters used in the training job.",
+        "TrainingArn": "The SageMaker training job Amazon Resource Name (ARN)",
+        "TrainingDatasets": "The location of the datasets used to train the model.",
+        "TrainingEnvironment": "The SageMaker training job image URI.",
+        "TrainingMetrics": "The SageMaker training job results.",
+        "UserProvidedHyperParameters": "Additional hyper parameters that you've specified when training the model.",
+        "UserProvidedTrainingMetrics": "Custom training job results."
+      }
+    },
+    "AWS::SageMaker::ModelCard.TrainingMetric": {
+      "attributes": {},
+      "description": "A result from a SageMaker training job.",
+      "properties": {
+        "Name": "The name of the result from the SageMaker training job.",
+        "Notes": "Any additional notes describing the result of the training job.",
+        "Value": "The value of a result from the SageMaker training job."
+      }
+    },
     "AWS::SageMaker::ModelExplainabilityJobDefinition": {
       "attributes": {
         "CreationTime": "The time when the job definition was created.",
@@ -47133,18 +47556,18 @@
       "attributes": {
         "Ref": "When you pass the logical ID of an `AWS::SecretsManager::RotationSchedule` resource to the intrinsic `Ref` function, the function returns the ARN of the secret being configured, such as:\n\n*arn:aws:secretsmanager: us-west-2* : *123456789012* :secret: *my-path/my-secret-name* - *1a2b3c*\n\nYou can use the ARN to reference a secret you create in one part of the stack template from within the definition of another resource later, in the same template. You typically do this when you define the [AWS::SecretsManager::SecretTargetAttachment](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html) resource type.\n\nFor more information about using the `Ref` function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) ."
       },
-      "description": "Sets the rotation schedule and Lambda rotation function for a secret. For more information, see [How rotation works](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) . For the rotation function, you have two options:\n\n- You can create a new rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) by using `HostedRotationLambda` .\n- You can choose an existing rotation function by using `RotationLambdaARN` .\n\nFor Amazon RDS , Amazon Redshift , Amazon DocumentDB secrets, if you define both the secret and the database or service in the AWS CloudFormation template, then you need to define the [AWS::SecretsManager::SecretTargetAttachment](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html) resource to populate the secret with the connection details of the database or service before you attempt to configure rotation.",
+      "description": "Sets the rotation schedule and Lambda rotation function for a secret. For more information, see [How rotation works](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) .\n\nFor Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .\n\nFor the rotation function, you have two options:\n\n- You can create a new rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) by using `HostedRotationLambda` .\n- You can choose an existing rotation function by using `RotationLambdaARN` .\n\nFor database secrets, if you define both the secret and the database or service in the AWS CloudFormation template, then you need to define the [AWS::SecretsManager::SecretTargetAttachment](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html) resource to populate the secret with the connection details of the database or service before you attempt to configure rotation.",
       "properties": {
-        "HostedRotationLambda": "Creates a new Lambda rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) . To use a rotation function that already exists, specify `RotationLambdaARN` instead.",
+        "HostedRotationLambda": "Creates a new Lambda rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) . To use a rotation function that already exists, specify `RotationLambdaARN` instead.\n\nFor Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .",
         "RotateImmediatelyOnUpdate": "Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in `RotationRules` .\n\nIf you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the [`testSecret` step](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) of the Lambda rotation function. The test creates an `AWSPENDING` version of the secret and then removes it.\n\nIf you don't specify this value, then by default, Secrets Manager rotates the secret immediately.\n\nRotation is an asynchronous process. For more information, see [How rotation works](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) .",
-        "RotationLambdaARN": "The ARN of an existing Lambda rotation function. To specify a rotation function that is also defined in this template, use the [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) function.\n\nTo create a new rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) , specify `HostedRotationLambda` instead.",
+        "RotationLambdaARN": "The ARN of an existing Lambda rotation function. To specify a rotation function that is also defined in this template, use the [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) function.\n\nFor Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .\n\nTo create a new rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) , specify `HostedRotationLambda` instead.",
         "RotationRules": "A structure that defines the rotation configuration for this secret.",
         "SecretId": "The ARN or name of the secret to rotate.\n\nTo reference a secret also created in this template, use the [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) function with the secret's logical ID."
       }
     },
     "AWS::SecretsManager::RotationSchedule.HostedRotationLambda": {
       "attributes": {},
-      "description": "Creates a new Lambda rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) .\n\nYou must specify `Transform: AWS::SecretsManager-2020-07-23` at the beginning of the CloudFormation template.",
+      "description": "Creates a new Lambda rotation function based on one of the [Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html) .\n\nYou must specify `Transform: AWS::SecretsManager-2020-07-23` at the beginning of the CloudFormation template.\n\nFor Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .",
       "properties": {
         "ExcludeCharacters": "A string of the characters that you don't want in the password.",
         "KmsKeyArn": "The ARN of the KMS key that Secrets Manager uses to encrypt the secret. If you don't specify this value, then Secrets Manager uses the key `aws/secretsmanager` . If `aws/secretsmanager` doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.",
@@ -47171,14 +47594,14 @@
       "attributes": {
         "Ref": "When you pass the logical ID of an `AWS::SecretsManager::Secret` resource to the intrinsic `Ref` function, the function returns the ARN of the secret configured such as:\n\n`arn:aws:secretsmanager:us-west-2:123456789012:secret:my-path/my-secret-name-1a2b3c`\n\nIf you know the ARN of a secret, you can reference a secret you created in one part of the stack template from within the definition of another resource in the same template. You typically use the `Ref` function with the [AWS::SecretsManager::SecretTargetAttachment](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html) resource type to get references to both the secret and its associated database.\n\nFor more information about using the `Ref` function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) ."
       },
-      "description": "Creates a new secret. A *secret* can be a password, a set of credentials such as a user name and password, an OAuth token, or other secret information that you store in an encrypted form in Secrets Manager.\n\nTo retrieve a secret in a CloudFormation template, use a *dynamic reference* . For more information, see [Retrieve a secret in an AWS CloudFormation resource](https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html) .\n\nA common scenario is to first create a secret with `GenerateSecretString` , which generates a password, and then use a dynamic reference to retrieve the username and password from the secret to use as credentials for a new database. Follow these steps, as shown in the examples below:\n\n- Define the secret without referencing the service or database. You can't reference the service or database because it doesn't exist yet. The secret must contain a username and password.\n- Next, define the service or database. Include the reference to the secret to use stored credentials to define the database admin user and password.\n- Finally, define a `SecretTargetAttachment` resource type to finish configuring the secret with the required database engine type and the connection details of the service or database. The rotation function requires the details, if you attach one later by defining a [AWS::SecretsManager::RotationSchedule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-rotationschedule.html) resource type.\n\nFor information about creating a secret in the console, see [Create a secret](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html) . For information about creating a secret using the CLI or SDK, see [CreateSecret](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html) .\n\nFor information about retrieving a secret in code, see [Retrieve secrets from Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html) .\n\n> Do not create a dynamic reference using a backslash `(\\)` as the final value. AWS CloudFormation cannot resolve those references, which causes a resource failure.",
+      "description": "Creates a new secret. A *secret* can be a password, a set of credentials such as a user name and password, an OAuth token, or other secret information that you store in an encrypted form in Secrets Manager.\n\nFor Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .\n\nTo retrieve a secret in a CloudFormation template, use a *dynamic reference* . For more information, see [Retrieve a secret in an AWS CloudFormation resource](https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html) .\n\nA common scenario is to first create a secret with `GenerateSecretString` , which generates a password, and then use a dynamic reference to retrieve the username and password from the secret to use as credentials for a new database. Follow these steps, as shown in the examples below:\n\n- Define the secret without referencing the service or database. You can't reference the service or database because it doesn't exist yet. The secret must contain a username and password.\n- Next, define the service or database. Include the reference to the secret to use stored credentials to define the database admin user and password.\n- Finally, define a `SecretTargetAttachment` resource type to finish configuring the secret with the required database engine type and the connection details of the service or database. The rotation function requires the details, if you attach one later by defining a [AWS::SecretsManager::RotationSchedule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-rotationschedule.html) resource type.\n\nFor information about creating a secret in the console, see [Create a secret](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html) . For information about creating a secret using the CLI or SDK, see [CreateSecret](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html) .\n\nFor information about retrieving a secret in code, see [Retrieve secrets from Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html) .\n\n> Do not create a dynamic reference using a backslash `(\\)` as the final value. AWS CloudFormation cannot resolve those references, which causes a resource failure.",
       "properties": {
         "Description": "The description of the secret.",
-        "GenerateSecretString": "A structure that specifies how to generate a password to encrypt and store in the secret. To include a specific string in the secret, use `SecretString` instead. If you omit both `GenerateSecretString` and `SecretString` , you create an empty secret.\n\nWe recommend that you specify the maximum length and include every character type that the system you are generating a password for can support.",
+        "GenerateSecretString": "A structure that specifies how to generate a password to encrypt and store in the secret. To include a specific string in the secret, use `SecretString` instead. If you omit both `GenerateSecretString` and `SecretString` , you create an empty secret. When you make a change to this property, a new secret version is created.\n\nWe recommend that you specify the maximum length and include every character type that the system you are generating a password for can support.",
         "KmsKeyId": "The ARN, key ID, or alias of the AWS KMS key that Secrets Manager uses to encrypt the secret value in the secret. An alias is always prefixed by `alias/` , for example `alias/aws/secretsmanager` . For more information, see [About aliases](https://docs.aws.amazon.com/kms/latest/developerguide/alias-about.html) .\n\nTo use a AWS KMS key in a different account, use the key ARN or the alias ARN.\n\nIf you don't specify this value, then Secrets Manager uses the key `aws/secretsmanager` . If that key doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.\n\nIf the secret is in a different AWS account from the credentials calling the API, then you can't use `aws/secretsmanager` to encrypt the secret, and you must create and use a customer managed AWS KMS key.",
         "Name": "The name of the new secret.\n\nThe secret name can contain ASCII letters, numbers, and the following characters: /_+=.@-\n\nDo not end your secret name with a hyphen followed by six characters. If you do so, you risk confusion and unexpected results when searching for a secret by partial ARN. Secrets Manager automatically adds a hyphen and six random characters after the secret name at the end of the ARN.",
         "ReplicaRegions": "A custom type that specifies a `Region` and the `KmsKeyId` for a replica secret.",
-        "SecretString": "The text to encrypt and store in the secret. We recommend you use a JSON structure of key/value pairs for your secret value. To generate a random password, use `GenerateSecretString` instead. If you omit both `GenerateSecretString` and `SecretString` , you create an empty secret.",
+        "SecretString": "The text to encrypt and store in the secret. We recommend you use a JSON structure of key/value pairs for your secret value. To generate a random password, use `GenerateSecretString` instead. If you omit both `GenerateSecretString` and `SecretString` , you create an empty secret. When you make a change to this property, a new secret version is created.",
         "Tags": "A list of tags to attach to the secret. Each tag is a key and value pair of strings in a JSON text string, for example:\n\n`[{\"Key\":\"CostCenter\",\"Value\":\"12345\"},{\"Key\":\"environment\",\"Value\":\"production\"}]`\n\nSecrets Manager tag key names are case sensitive. A tag with the key \"ABC\" is a different tag from one with key \"abc\".\n\nIf you check tags in permissions policies as part of your security strategy, then adding or removing a tag can change permissions. If the completion of this operation would result in you losing your permissions for this secret, then Secrets Manager blocks the operation and returns an `Access Denied` error. For more information, see [Control access to secrets using tags](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html#tag-secrets-abac) and [Limit access to identities with tags that match secrets' tags](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html#auth-and-access_tags2) .\n\nFor information about how to format a JSON parameter for the various command line tool environments, see [Using JSON for Parameters](https://docs.aws.amazon.com/cli/latest/userguide/cli-using-param.html#cli-using-param-json) . If your command-line tool or SDK requires quotation marks around the parameter, you should use single quotes to avoid confusion with the double quotes required in the JSON text.\n\nThe following restrictions apply to tags:\n\n- Maximum number of tags per secret: 50\n- Maximum key length: 127 Unicode characters in UTF-8\n- Maximum value length: 255 Unicode characters in UTF-8\n- Tag keys and values are case sensitive.\n- Do not use the `aws:` prefix in your tag names or values because AWS reserves it for AWS use. You can't edit or delete tag names or values with this prefix. Tags with this prefix do not count against your tags per secret limit.\n- If you use your tagging schema across multiple services and resources, other services might have restrictions on allowed characters. Generally allowed characters: letters, spaces, and numbers representable in UTF-8, plus the following special characters: + - = . _ : / @."
       }
     },
@@ -47210,7 +47633,7 @@
       "attributes": {
         "Ref": "When you pass the logical ID of an `AWS::SecretsManager::SecretTargetAttachment` resource to the intrinsic `Ref` function, the function returns the ARN of the secret, such as:\n\n`arn:aws:secretsmanager:us-west-2:123456789012:secret:my-path/my-secret-name-1a2b3c`\n\nYou can use the ARN to reference a secret you created in one part of the stack template from within the definition of another resource from a different part of the same template.\n\nFor more information about using the `Ref` function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) ."
       },
-      "description": "The `AWS::SecretsManager::SecretTargetAttachment` resource completes the final link between a Secrets Manager secret and the associated database by adding the database connection information to the secret JSON. If you want to turn on automatic rotation for a database credential secret, the secret must contain the database connection information. For more information, see [JSON structure of Secrets Manager database credential secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html) .",
+      "description": "The `AWS::SecretsManager::SecretTargetAttachment` resource completes the final link between a Secrets Manager secret and the associated database by adding the database connection information to the secret JSON. If you want to turn on automatic rotation for a database credential secret, the secret must contain the database connection information. For more information, see [JSON structure of Secrets Manager database credential secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html) .\n\nFor Amazon RDS master user credentials, see [AWS::RDS::DBCluster MasterUserSecret](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-masterusersecret.html) .",
       "properties": {
         "SecretId": "The ARN or name of the secret. To reference a secret also created in this template, use the see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) function with the secret's logical ID.",
         "TargetId": "The ID of the database or cluster.",
@@ -47264,7 +47687,7 @@
       "properties": {
         "Description": "The description of the provisioning artifact, including how it differs from the previous provisioning artifact.",
         "DisableTemplateValidation": "If set to true, AWS Service Catalog stops validating the specified provisioning artifact even if it is invalid.",
-        "Info": "Specify the template source with one of the following options, but not both. Keys accepted: [ `LoadTemplateFromURL` , `ImportFromPhysicalId` ]\n\nThe URL of the AWS CloudFormation template in Amazon S3 or GitHub in JSON format. Specify the URL in JSON format as follows:\n\n`\"LoadTemplateFromURL\": \"https://s3.amazonaws.com/cf-templates-ozkq9d3hgiq2-us-east-1/...\"`\n\n`ImportFromPhysicalId` : The physical id of the resource that contains the template. Currently only supports AWS CloudFormation stack arn. Specify the physical id in JSON format as follows: `ImportFromPhysicalId: “arn:aws:cloudformation:[us-east-1]:[accountId]:stack/[StackName]/[resourceId]`",
+        "Info": "Specify the template source with one of the following options, but not both. Keys accepted: [ `LoadTemplateFromURL` , `ImportFromPhysicalId` ]\n\nThe URL of the AWS CloudFormation template in Amazon S3 in JSON format. Specify the URL in JSON format as follows:\n\n`\"LoadTemplateFromURL\": \"https://s3.amazonaws.com/cf-templates-ozkq9d3hgiq2-us-east-1/...\"`\n\n`ImportFromPhysicalId` : The physical id of the resource that contains the template. Currently only supports AWS CloudFormation stack arn. Specify the physical id in JSON format as follows: `ImportFromPhysicalId: “arn:aws:cloudformation:[us-east-1]:[accountId]:stack/[StackName]/[resourceId]`",
         "Name": "The name of the provisioning artifact (for example, v1 v2beta). No spaces are allowed."
       }
     },
@@ -47283,7 +47706,7 @@
         "PathId": "The path identifier of the product. This value is optional if the product has a default path, and required if the product has more than one path. To list the paths for a product, use [ListLaunchPaths](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListLaunchPaths.html) .\n\n> You must provide the name or ID, but not both.",
         "PathName": "The name of the path. This value is optional if the product has a default path, and required if the product has more than one path. To list the paths for a product, use [ListLaunchPaths](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListLaunchPaths.html) .\n\n> You must provide the name or ID, but not both.",
         "ProductId": "The product identifier.\n\n> You must specify either the ID or the name of the product, but not both.",
-        "ProductName": "A user-friendly name for the provisioned product. This value must be unique for the AWS account and cannot be updated after the product is provisioned.\n\nEach time a stack is created or updated, if `ProductName` is provided it will successfully resolve to `ProductId` as long as only one product exists in the account or Region with that `ProductName` .\n\n> You must specify either the name or the ID of the product, but not both.",
+        "ProductName": "The name of the Service Catalog product.\n\nEach time a stack is created or updated, if `ProductName` is provided it will successfully resolve to `ProductId` as long as only one product exists in the account or Region with that `ProductName` .\n\n> You must specify either the name or the ID of the product, but not both.",
         "ProvisionedProductName": "A user-friendly name for the provisioned product. This value must be unique for the AWS account and cannot be updated after the product is provisioned.",
         "ProvisioningArtifactId": "The identifier of the provisioning artifact (also known as a version).\n\n> You must specify either the ID or the name of the provisioning artifact, but not both.",
         "ProvisioningArtifactName": "The name of the provisioning artifact (also known as a version) for the product. This name must be unique for the product.\n\n> You must specify either the name or the ID of the provisioning artifact, but not both. You must also specify either the name or the ID of the product, but not both.",
@@ -47371,12 +47794,12 @@
       "attributes": {
         "Ref": "`Ref` returns a unique identifier for the association."
       },
-      "description": "Associates the specified principal ARN with the specified portfolio.",
+      "description": "Associates the specified principal ARN with the specified portfolio.\n\nIf you share the portfolio with principal name sharing enabled, the `PrincipalARN` association is included in the share.\n\nThe `PortfolioID` , `PrincipalARN` , and `PrincipalType` parameters are required.\n\nYou can associate a maximum of 10 Principals with a portfolio using `PrincipalType` as `IAM_PATTERN`\n\n> When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is *not* an Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through Service Catalog, they may be able to guess the user. If this potential escalation path is a concern, then Service Catalog recommends using `PrincipalType` as `IAM` . With this configuration, the `PrincipalARN` must already exist in the recipient account before it can be associated.",
       "properties": {
         "AcceptLanguage": "The language code.\n\n- `en` - English (default)\n- `jp` - Japanese\n- `zh` - Chinese",
         "PortfolioId": "The portfolio identifier.",
-        "PrincipalARN": "The ARN of the principal (IAM user, role, or group).",
-        "PrincipalType": "The principal type. The supported value is `IAM` ."
+        "PrincipalARN": "The ARN of the principal (IAM user, role, or group). This field allows an ARN with no `accountID` if `PrincipalType` is `IAM_PATTERN` .\n\nYou can associate multiple `IAM` patterns even if the account has no principal with that name. This is useful in Principal Name Sharing if you want to share a principal without creating it in the account that owns the portfolio.",
+        "PrincipalType": "The principal type. The supported value is `IAM` if you use a fully defined ARN, or `IAM_PATTERN` if you use an ARN with no `accountID` ."
       }
     },
     "AWS::ServiceCatalog::PortfolioProductAssociation": {
@@ -47718,6 +48141,26 @@
         "Value": "The numerical value of the time unit for signature validity."
       }
     },
+    "AWS::SimSpaceWeaver::Simulation": {
+      "attributes": {
+        "DescribePayload": "The JSON blob that the [DescribeSimulation](https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_DescribeSimulation.html) action returns.",
+        "Ref": "`Ref` returns the name of the `Simulation` . For example, `MyTestSimulation_22-12-15_12_00_00` ."
+      },
+      "description": "Use the `AWS::SimSpaceWeaver::Simulation` resource to specify a simulation that AWS CloudFormation starts in the AWS Cloud , in your AWS account . In the resource properties section of your template, provide the name of an existing IAM role configured with the proper permissions, and the name of an existing Amazon S3 bucket. Your account must have permissions to read the Amazon S3 bucket. The Amazon S3 bucket must contain a valid schema. The schema must refer to simulation assets that are already uploaded to the AWS Cloud . For more information, see the [detailed tutorial](https://docs.aws.amazon.com/simspaceweaver/latest/userguide/getting-started_detailed.html) in the *AWS SimSpace Weaver User Guide* .",
+      "properties": {
+        "Name": "The name of the simulation.",
+        "RoleArn": "The Amazon Resource Name (ARN) of the AWS Identity and Access Management ( IAM ) role that the simulation assumes to perform actions. For more information about ARNs, see [Amazon Resource Names (ARNs)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in the *AWS General Reference* . For more information about IAM roles, see [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the *AWS Identity and Access Management User Guide* .",
+        "SchemaS3Location": "The location of the simulation schema in Amazon Simple Storage Service ( Amazon S3 ). For more information about Amazon S3 , see the [*Amazon Simple Storage Service User Guide*](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) ."
+      }
+    },
+    "AWS::SimSpaceWeaver::Simulation.S3Location": {
+      "attributes": {},
+      "description": "A location in Amazon Simple Storage Service ( Amazon S3 ) where SimSpace Weaver stores simulation data, such as your app .zip files and schema file. For more information about Amazon S3 , see the [*Amazon Simple Storage Service User Guide*](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) .",
+      "properties": {
+        "BucketName": "The name of an Amazon S3 bucket. For more information about buckets, see [Creating, configuring, and working with Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html) in the *Amazon Simple Storage Service User Guide* .",
+        "ObjectKey": "The key name of an object in Amazon S3 . For more information about Amazon S3 objects and object keys, see [Uploading, downloading, and working with objects in Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/uploading-downloading-objects.html) in the *Amazon Simple Storage Service User Guide* ."
+      }
+    },
     "AWS::StepFunctions::Activity": {
       "attributes": {
         "Arn": "",
@@ -48294,7 +48737,7 @@
         "Arn": "The Amazon Resource Name associated with the user, in the form `arn:aws:transfer:region: *account-id* :user/ *server-id* / *username*` .\n\nAn example of a user ARN is: `arn:aws:transfer:us-east-1:123456789012:user/user1` .",
         "Ref": "`Ref` returns the username, such as `transfer_user` .",
         "ServerId": "The ID of the server to which the user is attached.\n\nAn example `ServerId` is `s-01234567890abcdef` .",
-        "UserName": "A unique string that identifies a user account associated with a server.\n\nAn example `UserName` is `transfer-user-1` ."
+        "UserName": "A unique string that identifies a Transfer Family user account associated with a server.\n\nAn example `UserName` is `transfer-user-1` ."
       },
       "description": "The `AWS::Transfer::User` resource creates a user and associates them with an existing server. You can only create and associate users with servers that have the `IdentityProviderType` set to `SERVICE_MANAGED` . Using parameters for `CreateUser` , you can specify the user name, set the home directory, store the user's public key, and assign the user's AWS Identity and Access Management (IAM) role. You can also optionally add a session policy, and assign metadata with tags that can be used to group and search for users.",
       "properties": {
@@ -48329,7 +48772,7 @@
     },
     "AWS::Transfer::User.SshPublicKey": {
       "attributes": {},
-      "description": "Provides information about the public Secure Shell (SSH) key that is associated with a user account for the specific file transfer protocol-enabled server (as identified by `ServerId` ). The information returned includes the date the key was imported, the public key contents, and the public key ID. A user can store more than one SSH public key associated with their user name on a specific server.\n\n*SshPublicKeyBody*\n\nSpecifies the content of the SSH public key as specified by the `PublicKeyId` .\n\nAWS Transfer Family accepts RSA, ECDSA, and ED25519 keys.\n\nType: String\n\nLength Constraints: Maximum length of 2048.\n\nRequired: Yes",
+      "description": "Provides information about the public Secure Shell (SSH) key that is associated with a Transfer Family user account for the specific file transfer protocol-enabled server (as identified by `ServerId` ). The information returned includes the date the key was imported, the public key contents, and the public key ID. A user can store more than one SSH public key associated with their user name on a specific server.\n\n*SshPublicKeyBody*\n\nSpecifies the content of the SSH public key as specified by the `PublicKeyId` .\n\nAWS Transfer Family accepts RSA, ECDSA, and ED25519 keys.\n\nType: String\n\nLength Constraints: Maximum length of 2048.\n\nRequired: Yes",
       "properties": {}
     },
     "AWS::Transfer::Workflow": {
@@ -49265,7 +49708,7 @@
     },
     "AWS::WAFv2::RuleGroup.RateBasedStatement": {
       "attributes": {},
-      "description": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specified the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
+      "description": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specifies the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
       "properties": {
         "AggregateKeyType": "Setting that indicates how to aggregate the request counts. The options are the following:\n\n- IP - Aggregate the request counts on the IP address from the web request origin.\n- FORWARDED_IP - Aggregate the request counts on the first IP address in an HTTP header. If you use this, configure the `ForwardedIPConfig` , to specify the header to use.",
         "ForwardedIPConfig": "The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.\n\n> If the specified header isn't present in the request, AWS WAF doesn't apply the rule to the web request at all. \n\nThis is required if `AggregateKeyType` is set to `FORWARDED_IP` .",
@@ -49360,7 +49803,7 @@
         "LabelMatchStatement": "A rule statement to match against labels that have been added to the web request by rules that have already run in the web ACL.\n\nThe label match statement provides the label or namespace string to search for. The label string can represent a part or all of the fully qualified label name that had been added to the web request. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label. If you do not provide the fully qualified name in your label match string, AWS WAF performs the search for labels that were added in the same context as the label match statement.",
         "NotStatement": "A logical rule statement used to negate the results of another rule statement. You provide one `Statement` within the `NotStatement` .",
         "OrStatement": "A logical rule statement used to combine other rule statements with OR logic. You provide more than one `Statement` within the `OrStatement` .",
-        "RateBasedStatement": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specified the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
+        "RateBasedStatement": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specifies the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
         "RegexMatchStatement": "A rule statement used to search web request components for a match against a single regular expression.",
         "RegexPatternSetReferenceStatement": "A rule statement used to search web request components for matches with regular expressions. To use this, create a `RegexPatternSet` that specifies the expressions that you want to detect, then use the ARN of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.\n\nEach regex pattern set rule statement references a regex pattern set. You create and maintain the set independent of your rules. This allows you to use the single set in multiple rules. When you update the referenced set, AWS WAF automatically updates all rules that reference it.",
         "SizeConstraintStatement": "A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). For example, you can use a size constraint statement to look for query strings that are longer than 100 bytes.\n\nIf you configure AWS WAF to inspect the request body, AWS WAF inspects only the first 8192 bytes (8 KB). If the request body for your web requests never exceeds 8192 bytes, you could use a size constraint statement to block requests that have a request body greater than 8192 bytes.\n\nIf you choose URI for the value of Part of the request to filter on, the slash (/) in the URI counts as one character. For example, the URI `/logo.jpg` is nine characters long.",
@@ -49724,7 +50167,7 @@
     },
     "AWS::WAFv2::WebACL.RateBasedStatement": {
       "attributes": {},
-      "description": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specified the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
+      "description": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specifies the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
       "properties": {
         "AggregateKeyType": "Setting that indicates how to aggregate the request counts. The options are the following:\n\n- IP - Aggregate the request counts on the IP address from the web request origin.\n- FORWARDED_IP - Aggregate the request counts on the first IP address in an HTTP header. If you use this, configure the `ForwardedIPConfig` , to specify the header to use.",
         "ForwardedIPConfig": "The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.\n\n> If the specified header isn't present in the request, AWS WAF doesn't apply the rule to the web request at all. \n\nThis is required if `AggregateKeyType` is set to `FORWARDED_IP` .",
@@ -49838,7 +50281,7 @@
         "ManagedRuleGroupStatement": "A rule statement used to run the rules that are defined in a managed rule group. To use this, provide the vendor name and the name of the rule group in this statement.\n\nYou cannot nest a `ManagedRuleGroupStatement` , for example for use inside a `NotStatement` or `OrStatement` . It can only be referenced as a top-level statement within a rule.",
         "NotStatement": "A logical rule statement used to negate the results of another rule statement. You provide one `Statement` within the `NotStatement` .",
         "OrStatement": "A logical rule statement used to combine other rule statements with OR logic. You provide more than one `Statement` within the `OrStatement` .",
-        "RateBasedStatement": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specified the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
+        "RateBasedStatement": "A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.\n\nAWS WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by AWS WAF . If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by AWS WAF .\n\nWhen the rule action triggers, AWS WAF blocks additional requests from the IP address until the request rate falls below the limit.\n\nYou can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:\n\n- An IP match statement with an IP set that specifies the address 192.0.2.44.\n- A string match statement that searches in the User-Agent header for the string BadBot.\n\nIn this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.\n\nYou cannot nest a `RateBasedStatement` inside another statement, for example inside a `NotStatement` or `OrStatement` . You can define a `RateBasedStatement` inside a web ACL and inside a rule group.",
         "RegexMatchStatement": "A rule statement used to search web request components for a match against a single regular expression.",
         "RegexPatternSetReferenceStatement": "A rule statement used to search web request components for matches with regular expressions. To use this, create a `RegexPatternSet` that specifies the expressions that you want to detect, then use the ARN of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.\n\nEach regex pattern set rule statement references a regex pattern set. You create and maintain the set independent of your rules. This allows you to use the single set in multiple rules. When you update the referenced set, AWS WAF automatically updates all rules that reference it.",
         "RuleGroupReferenceStatement": "A rule statement used to run the rules that are defined in a `RuleGroup` . To use this, create a rule group with your rules, then provide the ARN of the rule group in this statement.\n\nYou cannot nest a `RuleGroupReferenceStatement` , for example for use inside a `NotStatement` or `OrStatement` . You can only use a rule group reference statement at the top level inside a web ACL.",