cdk-common 2.0.424 → 2.0.425
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.jsii +9 -3
- package/API.md +5 -0
- package/lib/main.js +1 -1
- package/lib/managed-policies.d.ts +1 -0
- package/lib/managed-policies.js +2 -1
- package/node_modules/@aws-cdk/assert/lib/assertion.js +1 -1
- package/node_modules/@aws-cdk/assert/lib/assertions/count-resources.js +2 -2
- package/node_modules/@aws-cdk/assert/lib/assertions/have-resource.js +2 -2
- package/node_modules/@aws-cdk/assert/package.json +8 -8
- package/node_modules/@aws-cdk/cfnspec/build-tools/build.js +1 -1
- package/node_modules/@aws-cdk/cfnspec/build-tools/massage-spec.js +2 -2
- package/node_modules/@aws-cdk/cfnspec/lib/schema/property.d.ts +2 -1
- package/node_modules/@aws-cdk/cfnspec/lib/schema/property.js +4 -2
- package/node_modules/@aws-cdk/cfnspec/lib/schema/resource-type.d.ts +1 -0
- package/node_modules/@aws-cdk/cfnspec/lib/schema/resource-type.js +1 -1
- package/node_modules/@aws-cdk/cfnspec/package.json +3 -3
- package/node_modules/@aws-cdk/cfnspec/spec/cfn-docs.json +136 -103
- package/node_modules/@aws-cdk/cloudformation-diff/lib/diff/types.js +2 -2
- package/node_modules/@aws-cdk/cloudformation-diff/lib/format.js +2 -2
- package/node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.d.ts +2 -2
- package/node_modules/@aws-cdk/cloudformation-diff/lib/iam/iam-changes.js +3 -3
- package/node_modules/@aws-cdk/cloudformation-diff/lib/network/security-group-changes.d.ts +1 -1
- package/node_modules/@aws-cdk/cloudformation-diff/lib/network/security-group-changes.js +2 -2
- package/node_modules/@aws-cdk/cloudformation-diff/package.json +4 -4
- package/node_modules/@types/concat-stream/node_modules/@types/node/README.md +1 -1
- package/node_modules/@types/concat-stream/node_modules/@types/node/net.d.ts +6 -0
- package/node_modules/@types/concat-stream/node_modules/@types/node/package.json +2 -2
- package/node_modules/@types/concat-stream/node_modules/@types/node/timers.d.ts +7 -0
- package/node_modules/@types/concat-stream/node_modules/@types/node/ts4.8/net.d.ts +6 -0
- package/node_modules/@types/form-data/node_modules/@types/node/README.md +1 -1
- package/node_modules/@types/form-data/node_modules/@types/node/net.d.ts +6 -0
- package/node_modules/@types/form-data/node_modules/@types/node/package.json +2 -2
- package/node_modules/@types/form-data/node_modules/@types/node/timers.d.ts +7 -0
- package/node_modules/@types/form-data/node_modules/@types/node/ts4.8/net.d.ts +6 -0
- package/package.json +3 -3
|
@@ -1036,7 +1036,7 @@
|
|
|
1036
1036
|
"Id": "The ID for the account. For example: `abc123` .",
|
|
1037
1037
|
"Ref": "`Ref` returns the ID of the resource, such as `mysta-accou-01234b567890example` ."
|
|
1038
1038
|
},
|
|
1039
|
-
"description": "The `AWS::ApiGateway::Account` resource specifies the IAM role that Amazon API Gateway uses to write API logs to Amazon CloudWatch Logs.\n\n> If an API Gateway resource has never been created in your AWS account , you must add a dependency on another API Gateway resource, such as an [AWS::ApiGateway::RestApi](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html) or [AWS::ApiGateway::ApiKey](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-apikey.html) resource.\n> \n> If an API Gateway resource has been created in your AWS account , no dependency is required (even if the resource was deleted).",
|
|
1039
|
+
"description": "The `AWS::ApiGateway::Account` resource specifies the IAM role that Amazon API Gateway uses to write API logs to Amazon CloudWatch Logs. To avoid overwriting other roles, you should only have one `AWS::ApiGateway::Account` resource per region per account.\n\n> If an API Gateway resource has never been created in your AWS account , you must add a dependency on another API Gateway resource, such as an [AWS::ApiGateway::RestApi](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html) or [AWS::ApiGateway::ApiKey](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-apikey.html) resource.\n> \n> If an API Gateway resource has been created in your AWS account , no dependency is required (even if the resource was deleted).",
|
|
1040
1040
|
"properties": {
|
|
1041
1041
|
"CloudWatchRoleArn": "The ARN of an Amazon CloudWatch role for the current Account."
|
|
1042
1042
|
}
|
|
@@ -1370,7 +1370,7 @@
|
|
|
1370
1370
|
"AWS::ApiGateway::RestApi": {
|
|
1371
1371
|
"attributes": {
|
|
1372
1372
|
"Ref": "`Ref` returns the `RestApi` ID, such as `a1bcdef2gh` .",
|
|
1373
|
-
"RestApiId": "",
|
|
1373
|
+
"RestApiId": "The string identifier of the associated RestApi.",
|
|
1374
1374
|
"RootResourceId": "The root resource ID for a `RestApi` resource, such as `a0bc123d4e` ."
|
|
1375
1375
|
},
|
|
1376
1376
|
"description": "The `AWS::ApiGateway::RestApi` resource creates a REST API. For more information, see [restapi:create](https://docs.aws.amazon.com/apigateway/latest/api/API_CreateRestApi.html) in the *Amazon API Gateway REST API Reference* .\n\n> On January 1, 2016, the Swagger Specification was donated to the [OpenAPI initiative](https://docs.aws.amazon.com/https://www.openapis.org/) , becoming the foundation of the OpenAPI Specification.",
|
|
@@ -1521,7 +1521,8 @@
|
|
|
1521
1521
|
},
|
|
1522
1522
|
"AWS::ApiGateway::VpcLink": {
|
|
1523
1523
|
"attributes": {
|
|
1524
|
-
"Ref": "`Ref` returns the ID of the `VpcLink` ."
|
|
1524
|
+
"Ref": "`Ref` returns the ID of the `VpcLink` .",
|
|
1525
|
+
"VpcLinkId": ""
|
|
1525
1526
|
},
|
|
1526
1527
|
"description": "The `AWS::ApiGateway::VpcLink` resource creates an API Gateway VPC link for a REST API to access resources in an Amazon Virtual Private Cloud (VPC). For more information, see [vpclink:create](https://docs.aws.amazon.com/apigateway/latest/api/API_CreateVpcLink.html) in the `Amazon API Gateway REST API Reference` .",
|
|
1527
1528
|
"properties": {
|
|
@@ -1833,8 +1834,7 @@
|
|
|
1833
1834
|
},
|
|
1834
1835
|
"AWS::ApiGatewayV2::RouteResponse": {
|
|
1835
1836
|
"attributes": {
|
|
1836
|
-
"Ref": "`Ref` returns the Route Response resource ID, such as `abc123` ."
|
|
1837
|
-
"RouteResponseId": ""
|
|
1837
|
+
"Ref": "`Ref` returns the Route Response resource ID, such as `abc123` ."
|
|
1838
1838
|
},
|
|
1839
1839
|
"description": "The `AWS::ApiGatewayV2::RouteResponse` resource creates a route response for a WebSocket API. For more information, see [Set up Route Responses for a WebSocket API in API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-route-response.html) in the *API Gateway Developer Guide* .",
|
|
1840
1840
|
"properties": {
|
|
@@ -1846,6 +1846,13 @@
|
|
|
1846
1846
|
"RouteResponseKey": "The route response key."
|
|
1847
1847
|
}
|
|
1848
1848
|
},
|
|
1849
|
+
"AWS::ApiGatewayV2::RouteResponse.ParameterConstraints": {
|
|
1850
|
+
"attributes": {},
|
|
1851
|
+
"description": "Specifies whether the parameter is required.",
|
|
1852
|
+
"properties": {
|
|
1853
|
+
"Required": "Specifies whether the parameter is required."
|
|
1854
|
+
}
|
|
1855
|
+
},
|
|
1849
1856
|
"AWS::ApiGatewayV2::Stage": {
|
|
1850
1857
|
"attributes": {
|
|
1851
1858
|
"Ref": "`Ref` returns the stage name, such as `MyTestStage` ."
|
|
@@ -2037,7 +2044,8 @@
|
|
|
2037
2044
|
"Content": "The content of the configuration or the configuration data.",
|
|
2038
2045
|
"ContentType": "A standard MIME type describing the format of the configuration content. For more information, see [Content-Type](https://docs.aws.amazon.com/https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17) .",
|
|
2039
2046
|
"Description": "A description of the configuration.",
|
|
2040
|
-
"LatestVersionNumber": "An optional locking token used to prevent race conditions from overwriting configuration updates when creating a new version. To ensure your data is not overwritten when creating multiple hosted configuration versions in rapid succession, specify the version number of the latest hosted configuration version."
|
|
2047
|
+
"LatestVersionNumber": "An optional locking token used to prevent race conditions from overwriting configuration updates when creating a new version. To ensure your data is not overwritten when creating multiple hosted configuration versions in rapid succession, specify the version number of the latest hosted configuration version.",
|
|
2048
|
+
"VersionLabel": "A user-defined label for an AWS AppConfig hosted configuration version."
|
|
2041
2049
|
}
|
|
2042
2050
|
},
|
|
2043
2051
|
"AWS::AppFlow::Connector": {
|
|
@@ -2050,7 +2058,7 @@
|
|
|
2050
2058
|
"ConnectorLabel": "The label used for registering the connector.",
|
|
2051
2059
|
"ConnectorProvisioningConfig": "The configuration required for registering the connector.",
|
|
2052
2060
|
"ConnectorProvisioningType": "The provisioning type used to register the connector.",
|
|
2053
|
-
"Description": "A description
|
|
2061
|
+
"Description": "A description about the connector runtime setting."
|
|
2054
2062
|
}
|
|
2055
2063
|
},
|
|
2056
2064
|
"AWS::AppFlow::Connector.ConnectorProvisioningConfig": {
|
|
@@ -2341,13 +2349,13 @@
|
|
|
2341
2349
|
"properties": {
|
|
2342
2350
|
"BucketName": "A name for the associated Amazon S3 bucket.",
|
|
2343
2351
|
"BucketPrefix": "The object key for the destination bucket in which Amazon AppFlow places the files.",
|
|
2344
|
-
"ClusterIdentifier": "
|
|
2345
|
-
"DataApiRoleArn": "
|
|
2346
|
-
"DatabaseName": "
|
|
2352
|
+
"ClusterIdentifier": "",
|
|
2353
|
+
"DataApiRoleArn": "",
|
|
2354
|
+
"DatabaseName": "",
|
|
2347
2355
|
"DatabaseUrl": "The JDBC URL of the Amazon Redshift cluster.",
|
|
2348
|
-
"IsRedshiftServerless": "
|
|
2356
|
+
"IsRedshiftServerless": "",
|
|
2349
2357
|
"RoleArn": "The Amazon Resource Name (ARN) of IAM role that grants Amazon Redshift read-only access to Amazon S3. For more information, and for the polices that you attach to this role, see [Allow Amazon Redshift to access your Amazon AppFlow data in Amazon S3](https://docs.aws.amazon.com/appflow/latest/userguide/security_iam_service-role-policies.html#redshift-access-s3) .",
|
|
2350
|
-
"WorkgroupName": "
|
|
2358
|
+
"WorkgroupName": ""
|
|
2351
2359
|
}
|
|
2352
2360
|
},
|
|
2353
2361
|
"AWS::AppFlow::ConnectorProfile.SAPODataConnectorProfileCredentials": {
|
|
@@ -2511,7 +2519,7 @@
|
|
|
2511
2519
|
"description": "The aggregation settings that you can use to customize the output format of your flow data.",
|
|
2512
2520
|
"properties": {
|
|
2513
2521
|
"AggregationType": "Specifies whether Amazon AppFlow aggregates the flow records into a single file, or leave them unaggregated.",
|
|
2514
|
-
"TargetFileSize": "
|
|
2522
|
+
"TargetFileSize": ""
|
|
2515
2523
|
}
|
|
2516
2524
|
},
|
|
2517
2525
|
"AWS::AppFlow::Flow.AmplitudeSourceProperties": {
|
|
@@ -2675,9 +2683,9 @@
|
|
|
2675
2683
|
},
|
|
2676
2684
|
"AWS::AppFlow::Flow.MetadataCatalogConfig": {
|
|
2677
2685
|
"attributes": {},
|
|
2678
|
-
"description": "
|
|
2686
|
+
"description": "",
|
|
2679
2687
|
"properties": {
|
|
2680
|
-
"GlueDataCatalog": "
|
|
2688
|
+
"GlueDataCatalog": ""
|
|
2681
2689
|
}
|
|
2682
2690
|
},
|
|
2683
2691
|
"AWS::AppFlow::Flow.PardotSourceProperties": {
|
|
@@ -2691,7 +2699,7 @@
|
|
|
2691
2699
|
"attributes": {},
|
|
2692
2700
|
"description": "Specifies elements that Amazon AppFlow includes in the file and folder names in the flow destination.",
|
|
2693
2701
|
"properties": {
|
|
2694
|
-
"PathPrefixHierarchy": "
|
|
2702
|
+
"PathPrefixHierarchy": "",
|
|
2695
2703
|
"PrefixFormat": "Determines the level of granularity for the date and time that's included in the prefix.",
|
|
2696
2704
|
"PrefixType": "Determines the format of the prefix, and whether it applies to the file name, file path, or both."
|
|
2697
2705
|
}
|
|
@@ -2854,7 +2862,7 @@
|
|
|
2854
2862
|
"properties": {
|
|
2855
2863
|
"ApiVersion": "The API version of the connector when it's used as a source in the flow.",
|
|
2856
2864
|
"ConnectorProfileName": "The name of the connector profile. This name must be unique for each connector profile in the AWS account .",
|
|
2857
|
-
"ConnectorType": "The type of
|
|
2865
|
+
"ConnectorType": "The type of connector, such as Salesforce, Amplitude, and so on.",
|
|
2858
2866
|
"IncrementalPullConfig": "Defines the configuration for a scheduled incremental data pull. If a valid configuration is provided, the fields specified in the configuration are used when querying for the incremental data pull.",
|
|
2859
2867
|
"SourceConnectorProperties": "Specifies the information that is required to query a particular source connector."
|
|
2860
2868
|
}
|
|
@@ -7738,55 +7746,55 @@
|
|
|
7738
7746
|
"LastModifiedTime": "The date and time when the cache policy was last modified.",
|
|
7739
7747
|
"Ref": "`Ref` returns the cache policy ID. For example: `2766f7b2-75c5-41c6-8f06-bf4303a2f2f5` ."
|
|
7740
7748
|
},
|
|
7741
|
-
"description": "A cache policy.\n\nWhen it's attached to a cache behavior, the cache policy determines the following:\n\n- The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.\n- The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.\n\nThe headers, cookies, and query strings that are included in the cache key are
|
|
7749
|
+
"description": "A cache policy.\n\nWhen it's attached to a cache behavior, the cache policy determines the following:\n\n- The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.\n- The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.\n\nThe headers, cookies, and query strings that are included in the cache key are also included in requests that CloudFront sends to the origin. CloudFront sends a request when it can't find a valid object in its cache that matches the request's cache key. If you want to send values to the origin but *not* include them in the cache key, use `OriginRequestPolicy` .",
|
|
7742
7750
|
"properties": {
|
|
7743
7751
|
"CachePolicyConfig": "The cache policy configuration."
|
|
7744
7752
|
}
|
|
7745
7753
|
},
|
|
7746
7754
|
"AWS::CloudFront::CachePolicy.CachePolicyConfig": {
|
|
7747
7755
|
"attributes": {},
|
|
7748
|
-
"description": "A cache policy configuration.\n\nThis configuration determines the following:\n\n- The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.\n- The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.\n\nThe headers, cookies, and query strings that are included in the cache key are
|
|
7756
|
+
"description": "A cache policy configuration.\n\nThis configuration determines the following:\n\n- The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.\n- The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.\n\nThe headers, cookies, and query strings that are included in the cache key are also included in requests that CloudFront sends to the origin. CloudFront sends a request when it can't find a valid object in its cache that matches the request's cache key. If you want to send values to the origin but *not* include them in the cache key, use `OriginRequestPolicy` .",
|
|
7749
7757
|
"properties": {
|
|
7750
7758
|
"Comment": "A comment to describe the cache policy. The comment cannot be longer than 128 characters.",
|
|
7751
7759
|
"DefaultTTL": "The default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated. CloudFront uses this value as the object's time to live (TTL) only when the origin does *not* send `Cache-Control` or `Expires` headers with the object. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .\n\nThe default value for this field is 86400 seconds (one day). If the value of `MinTTL` is more than 86400 seconds, then the default value for this field is the same as the value of `MinTTL` .",
|
|
7752
7760
|
"MaxTTL": "The maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated. CloudFront uses this value only when the origin sends `Cache-Control` or `Expires` headers with the object. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .\n\nThe default value for this field is 31536000 seconds (one year). If the value of `MinTTL` or `DefaultTTL` is more than 31536000 seconds, then the default value for this field is the same as the value of `DefaultTTL` .",
|
|
7753
7761
|
"MinTTL": "The minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .",
|
|
7754
7762
|
"Name": "A unique name to identify the cache policy.",
|
|
7755
|
-
"ParametersInCacheKeyAndForwardedToOrigin": "The HTTP headers, cookies, and URL query strings to include in the cache key. The values included in the cache key are
|
|
7763
|
+
"ParametersInCacheKeyAndForwardedToOrigin": "The HTTP headers, cookies, and URL query strings to include in the cache key. The values included in the cache key are also included in requests that CloudFront sends to the origin."
|
|
7756
7764
|
}
|
|
7757
7765
|
},
|
|
7758
7766
|
"AWS::CloudFront::CachePolicy.CookiesConfig": {
|
|
7759
7767
|
"attributes": {},
|
|
7760
|
-
"description": "An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and
|
|
7768
|
+
"description": "An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7761
7769
|
"properties": {
|
|
7762
|
-
"CookieBehavior": "Determines whether any cookies in viewer requests are included in the cache key and
|
|
7770
|
+
"CookieBehavior": "Determines whether any cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – No cookies in viewer requests are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to `none` , any cookies that are listed in an `OriginRequestPolicy` *are* included in origin requests.\n- `whitelist` – Only the cookies in viewer requests that are listed in the `CookieNames` type are included in the cache key and in requests that CloudFront sends to the origin.\n- `allExcept` – All cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin, **except** for those that are listed in the `CookieNames` type, which are not included.\n- `all` – All cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7763
7771
|
"Cookies": "Contains a list of cookie names."
|
|
7764
7772
|
}
|
|
7765
7773
|
},
|
|
7766
7774
|
"AWS::CloudFront::CachePolicy.HeadersConfig": {
|
|
7767
7775
|
"attributes": {},
|
|
7768
|
-
"description": "An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and
|
|
7776
|
+
"description": "An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7769
7777
|
"properties": {
|
|
7770
|
-
"HeaderBehavior": "Determines whether any HTTP headers are included in the cache key and
|
|
7778
|
+
"HeaderBehavior": "Determines whether any HTTP headers are included in the cache key and in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – No HTTP headers are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to `none` , any headers that are listed in an `OriginRequestPolicy` *are* included in origin requests.\n- `whitelist` – Only the HTTP headers that are listed in the `Headers` type are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7771
7779
|
"Headers": "Contains a list of HTTP header names."
|
|
7772
7780
|
}
|
|
7773
7781
|
},
|
|
7774
7782
|
"AWS::CloudFront::CachePolicy.ParametersInCacheKeyAndForwardedToOrigin": {
|
|
7775
7783
|
"attributes": {},
|
|
7776
|
-
"description": "This object determines the values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.\n\nThe headers, cookies, and query strings that are included in the cache key are
|
|
7784
|
+
"description": "This object determines the values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.\n\nThe headers, cookies, and query strings that are included in the cache key are also included in requests that CloudFront sends to the origin. CloudFront sends a request when it can't find an object in its cache that matches the request's cache key. If you want to send values to the origin but *not* include them in the cache key, use `OriginRequestPolicy` .",
|
|
7777
7785
|
"properties": {
|
|
7778
|
-
"CookiesConfig": "An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and
|
|
7786
|
+
"CookiesConfig": "An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7779
7787
|
"EnableAcceptEncodingBrotli": "A flag that can affect whether the `Accept-Encoding` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.\n\nThis field is related to the `EnableAcceptEncodingGzip` field. If one or both of these fields is `true` *and* the viewer request includes the `Accept-Encoding` header, then CloudFront does the following:\n\n- Normalizes the value of the viewer's `Accept-Encoding` header\n- Includes the normalized header in the cache key\n- Includes the normalized header in the request to the origin, if a request is necessary\n\nFor more information, see [Compression support](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects) in the *Amazon CloudFront Developer Guide* .\n\nIf you set this value to `true` , and this cache behavior also has an origin request policy attached, do not include the `Accept-Encoding` header in the origin request policy. CloudFront always includes the `Accept-Encoding` header in origin requests when the value of this field is `true` , so including this header in an origin request policy has no effect.\n\nIf both of these fields are `false` , then CloudFront treats the `Accept-Encoding` header the same as any other HTTP header in the viewer request. By default, it's not included in the cache key and it's not included in origin requests. In this case, you can manually add `Accept-Encoding` to the headers whitelist like any other HTTP header.",
|
|
7780
7788
|
"EnableAcceptEncodingGzip": "A flag that can affect whether the `Accept-Encoding` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.\n\nThis field is related to the `EnableAcceptEncodingBrotli` field. If one or both of these fields is `true` *and* the viewer request includes the `Accept-Encoding` header, then CloudFront does the following:\n\n- Normalizes the value of the viewer's `Accept-Encoding` header\n- Includes the normalized header in the cache key\n- Includes the normalized header in the request to the origin, if a request is necessary\n\nFor more information, see [Compression support](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects) in the *Amazon CloudFront Developer Guide* .\n\nIf you set this value to `true` , and this cache behavior also has an origin request policy attached, do not include the `Accept-Encoding` header in the origin request policy. CloudFront always includes the `Accept-Encoding` header in origin requests when the value of this field is `true` , so including this header in an origin request policy has no effect.\n\nIf both of these fields are `false` , then CloudFront treats the `Accept-Encoding` header the same as any other HTTP header in the viewer request. By default, it's not included in the cache key and it's not included in origin requests. In this case, you can manually add `Accept-Encoding` to the headers whitelist like any other HTTP header.",
|
|
7781
|
-
"HeadersConfig": "An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and
|
|
7782
|
-
"QueryStringsConfig": "An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and
|
|
7789
|
+
"HeadersConfig": "An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7790
|
+
"QueryStringsConfig": "An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and in requests that CloudFront sends to the origin."
|
|
7783
7791
|
}
|
|
7784
7792
|
},
|
|
7785
7793
|
"AWS::CloudFront::CachePolicy.QueryStringsConfig": {
|
|
7786
7794
|
"attributes": {},
|
|
7787
|
-
"description": "An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and
|
|
7795
|
+
"description": "An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7788
7796
|
"properties": {
|
|
7789
|
-
"QueryStringBehavior": "Determines whether any URL query strings in viewer requests are included in the cache key and
|
|
7797
|
+
"QueryStringBehavior": "Determines whether any URL query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – No query strings in viewer requests are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to `none` , any query strings that are listed in an `OriginRequestPolicy` *are* included in origin requests.\n- `whitelist` – Only the query strings in viewer requests that are listed in the `QueryStringNames` type are included in the cache key and in requests that CloudFront sends to the origin.\n- `allExcept` – All query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin, **except** those that are listed in the `QueryStringNames` type, which are not included.\n- `all` – All query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.",
|
|
7790
7798
|
"QueryStrings": "Contains a list of query string names."
|
|
7791
7799
|
}
|
|
7792
7800
|
},
|
|
@@ -8257,7 +8265,7 @@
|
|
|
8257
8265
|
"attributes": {},
|
|
8258
8266
|
"description": "An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in requests that CloudFront sends to the origin.",
|
|
8259
8267
|
"properties": {
|
|
8260
|
-
"CookieBehavior": "Determines whether cookies in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` –
|
|
8268
|
+
"CookieBehavior": "Determines whether cookies in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – No cookies in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any cookies that are listed in a `CachePolicy` *are* included in origin requests.\n- `whitelist` – Only the cookies in viewer requests that are listed in the `CookieNames` type are included in requests that CloudFront sends to the origin.\n- `all` – All cookies in viewer requests are included in requests that CloudFront sends to the origin.\n- `allExcept` – All cookies in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the `CookieNames` type, which are not included.",
|
|
8261
8269
|
"Cookies": "Contains a list of cookie names."
|
|
8262
8270
|
}
|
|
8263
8271
|
},
|
|
@@ -8265,7 +8273,7 @@
|
|
|
8265
8273
|
"attributes": {},
|
|
8266
8274
|
"description": "An object that determines whether any HTTP headers (and if so, which headers) are included in requests that CloudFront sends to the origin.",
|
|
8267
8275
|
"properties": {
|
|
8268
|
-
"HeaderBehavior": "Determines whether any HTTP headers are included in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – HTTP headers are
|
|
8276
|
+
"HeaderBehavior": "Determines whether any HTTP headers are included in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – No HTTP headers in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any headers that are listed in a `CachePolicy` *are* included in origin requests.\n- `whitelist` – Only the HTTP headers that are listed in the `Headers` type are included in requests that CloudFront sends to the origin.\n- `allViewer` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin.\n- `allViewerAndWhitelistCloudFront` – All HTTP headers in viewer requests and the additional CloudFront headers that are listed in the `Headers` type are included in requests that CloudFront sends to the origin. The additional headers are added by CloudFront.\n- `allExcept` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the `Headers` type, which are not included.",
|
|
8269
8277
|
"Headers": "Contains a list of HTTP header names."
|
|
8270
8278
|
}
|
|
8271
8279
|
},
|
|
@@ -8284,7 +8292,7 @@
|
|
|
8284
8292
|
"attributes": {},
|
|
8285
8293
|
"description": "An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in requests that CloudFront sends to the origin.",
|
|
8286
8294
|
"properties": {
|
|
8287
|
-
"QueryStringBehavior": "Determines whether any URL query strings in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` –
|
|
8295
|
+
"QueryStringBehavior": "Determines whether any URL query strings in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:\n\n- `none` – No query strings in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any query strings that are listed in a `CachePolicy` *are* included in origin requests.\n- `whitelist` – Only the query strings in viewer requests that are listed in the `QueryStringNames` type are included in requests that CloudFront sends to the origin.\n- `all` – All query strings in viewer requests are included in requests that CloudFront sends to the origin.\n- `allExcept` – All query strings in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the `QueryStringNames` type, which are not included.",
|
|
8288
8296
|
"QueryStrings": "Contains a list of query string names."
|
|
8289
8297
|
}
|
|
8290
8298
|
},
|
|
@@ -8556,26 +8564,16 @@
|
|
|
8556
8564
|
"AWS::CloudTrail::Channel": {
|
|
8557
8565
|
"attributes": {
|
|
8558
8566
|
"ChannelArn": "`Ref` returns the ARN of the CloudTrail channel, such as `arn:aws:cloudtrail:us-east-2:123456789012:channel/01234567890` .",
|
|
8559
|
-
"Channels": "`Ref` returns the names of CloudTrail channels.",
|
|
8560
8567
|
"Ref": "When the logical ID of this resource is provided to the Ref intrinsic function, `Ref` returns the resource name."
|
|
8561
8568
|
},
|
|
8562
8569
|
"description": "Contains information about a returned CloudTrail channel.",
|
|
8563
8570
|
"properties": {
|
|
8564
|
-
"Channel": "Contains information about a returned CloudTrail channel.",
|
|
8565
8571
|
"Destinations": "One or more event data stores to which events arriving through a channel will be logged.",
|
|
8566
8572
|
"Name": "The name of the channel.",
|
|
8567
8573
|
"Source": "The name of the partner or external event source. You cannot change this name after you create the channel. A maximum of one channel is allowed per source.\n\nA source can be either `Custom` for all valid non- AWS events, or the name of a partner event source. For information about the source names for available partners, see [Additional information about integration partners](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store-integration.html#cloudtrail-lake-partner-information) in the CloudTrail User Guide.",
|
|
8568
8574
|
"Tags": "A list of tags."
|
|
8569
8575
|
}
|
|
8570
8576
|
},
|
|
8571
|
-
"AWS::CloudTrail::Channel.Channel": {
|
|
8572
|
-
"attributes": {},
|
|
8573
|
-
"description": "Contains information about a returned CloudTrail channel.",
|
|
8574
|
-
"properties": {
|
|
8575
|
-
"ChannelArn": "The Amazon Resource Name (ARN) of a channel.",
|
|
8576
|
-
"Name": "The name of the CloudTrail channel. For service-linked channels, the name is `aws-service-channel/service-name/custom-suffix` where `service-name` represents the name of the AWS service that created the channel and `custom-suffix` represents the suffix created by the AWS service."
|
|
8577
|
-
}
|
|
8578
|
-
},
|
|
8579
8577
|
"AWS::CloudTrail::Channel.Destination": {
|
|
8580
8578
|
"attributes": {},
|
|
8581
8579
|
"description": "Contains information about the destination receiving events.",
|
|
@@ -8618,7 +8616,7 @@
|
|
|
8618
8616
|
"properties": {
|
|
8619
8617
|
"EndsWith": "An operator that includes events that match the last few characters of the event record field specified as the value of `Field` .",
|
|
8620
8618
|
"Equals": "An operator that includes events that match the exact value of the event record field specified as the value of `Field` . This is the only valid operator that you can use with the `readOnly` , `eventCategory` , and `resources.type` fields.",
|
|
8621
|
-
"Field": "A field in a CloudTrail event record on which to filter events to be logged. For event data stores for AWS Config configuration items, Audit Manager evidence, or non- AWS events, the field is used only for selecting events as filtering is not supported.\n\nFor CloudTrail event records, supported fields include `readOnly` , `eventCategory` , `eventSource` (for management events), `eventName` , `resources.type` , and `resources.ARN` .\n\nFor event data stores for AWS Config configuration items, Audit Manager evidence, or non- AWS events, the only supported field is `eventCategory` .\n\n- *`readOnly`* - Optional. Can be set to `Equals` a value of `true` or `false` . If you do not add this field, CloudTrail logs both `read` and `write` events. A value of `true` logs only `read` events. A value of `false` logs only `write` events.\n- *`eventSource`* - For filtering management events only. This can be set only to `NotEquals` `kms.amazonaws.com` .\n- *`eventName`* - Can use any operator. You can use it to filter in or filter out any data event logged to CloudTrail, such as `PutBucket` or `GetSnapshotBlock` . You can have multiple values for this field, separated by commas.\n- *`eventCategory`* - This is required and must be set to `Equals` .\n\n- For CloudTrail event records, the value must be `Management` or `Data` .\n- For AWS Config configuration items, the value must be `ConfigurationItem` .\n- For Audit Manager evidence, the value must be `Evidence` .\n- For non- AWS events, the value must be `ActivityAuditLog` .\n- *`resources.type`* - This field is required for CloudTrail data events. `resources.type` can only use the `Equals` operator, and the value can be one of the following:\n\n- `AWS::DynamoDB::Table`\n- `AWS::Lambda::Function`\n- `AWS::S3::Object`\n- `AWS::CloudTrail::Channel`\n- `AWS::Cognito::IdentityPool`\n- `AWS::DynamoDB::Stream`\n- `AWS::EC2::Snapshot`\n- `AWS::FinSpace::Environment`\n- `AWS::Glue::Table`\n- `AWS::KendraRanking::ExecutionPlan`\n- `AWS::ManagedBlockchain::Node`\n- `AWS::SageMaker::ExperimentTrialComponent`\n- `AWS::SageMaker::FeatureGroup`\n- `AWS::S3::AccessPoint`\n- `AWS::S3ObjectLambda::AccessPoint`\n- `AWS::S3Outposts::Object`\n\nYou can have only one `resources.type` field per selector. To log data events on more than one resource type, add another selector.\n- *`resources.ARN`* - You can use any operator with `resources.ARN` , but if you use `Equals` or `NotEquals` , the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type. For example, if resources.type equals `AWS::S3::Object` , the ARN must be in one of the following formats. To log all data events for all objects in a specific S3 bucket, use the `StartsWith` operator, and include only the bucket ARN as the matching value.\n\nThe trailing slash is intentional; do not exclude it. Replace the text between less than and greater than symbols (<>) with resource-specific information.\n\n- `arn:<partition>:s3:::<bucket_name>/`\n- `arn:<partition>:s3:::<bucket_name>/<object_path>/`\n\nWhen resources.type equals `AWS::DynamoDB::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>`\n\nWhen resources.type equals `AWS::Lambda::Function` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:lambda:<region>:<account_ID>:function:<function_name>`\n\nWhen resources.type equals `AWS::CloudTrail::Channel` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:cloudtrail:<region>:<account_ID>:channel/<channel_UUID>`\n\nWhen resources.type equals `AWS::Cognito::IdentityPool` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:cognito-identity:<region>:<account_ID>:identitypool/<identity_pool_ID>`\n\nWhen `resources.type` equals `AWS::DynamoDB::Stream` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>/stream/<date_time>`\n\nWhen `resources.type` equals `AWS::EC2::Snapshot` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:ec2:<region>::snapshot/<snapshot_ID>`\n\nWhen `resources.type` equals `AWS::FinSpace::Environment` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:finspace:<region>:<account_ID>:environment/<environment_ID>`\n\nWhen `resources.type` equals `AWS::Glue::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:glue:<region>:<account_ID>:table/<database_name>/<table_name>`\n\nWhen `resources.type` equals `AWS::KendraRanking::ExecutionPlan` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:kendra-ranking:<region>:<account_ID>:table/<rescore-execution-plan>/<rescore_execution_plan_ID>`\n\nWhen `resources.type` equals `AWS::ManagedBlockchain::Node` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:managedblockchain:<region>:<account_ID>:nodes/<node_ID>`\n\nWhen `resources.type` equals `AWS::SageMaker::ExperimentTrialComponent` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:experiment-trial-component/<experiment_trial_component_name>`\n\nWhen `resources.type` equals `AWS::SageMaker::FeatureGroup` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:feature-group/<feature_group_name>`\n\nWhen `resources.type` equals `AWS::S3::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in one of the following formats. To log events on all objects in an S3 access point, we recommend that you use only the access point ARN, don’t include the object path, and use the `StartsWith` or `NotStartsWith` operators.\n\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>`\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>/object/<object_path>`\n\nWhen `resources.type` equals `AWS::S3ObjectLambda::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-object-lambda:<region>:<account_ID>:accesspoint/<access_point_name>`\n\nWhen `resources.type` equals `AWS::S3Outposts::Object` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-outposts:<region>:<account_ID>:<object_path>`",
|
|
8619
|
+
"Field": "A field in a CloudTrail event record on which to filter events to be logged. For event data stores for AWS Config configuration items, Audit Manager evidence, or non- AWS events, the field is used only for selecting events as filtering is not supported.\n\nFor CloudTrail event records, supported fields include `readOnly` , `eventCategory` , `eventSource` (for management events), `eventName` , `resources.type` , and `resources.ARN` .\n\nFor event data stores for AWS Config configuration items, Audit Manager evidence, or non- AWS events, the only supported field is `eventCategory` .\n\n- *`readOnly`* - Optional. Can be set to `Equals` a value of `true` or `false` . If you do not add this field, CloudTrail logs both `read` and `write` events. A value of `true` logs only `read` events. A value of `false` logs only `write` events.\n- *`eventSource`* - For filtering management events only. This can be set only to `NotEquals` `kms.amazonaws.com` .\n- *`eventName`* - Can use any operator. You can use it to filter in or filter out any data event logged to CloudTrail, such as `PutBucket` or `GetSnapshotBlock` . You can have multiple values for this field, separated by commas.\n- *`eventCategory`* - This is required and must be set to `Equals` .\n\n- For CloudTrail event records, the value must be `Management` or `Data` .\n- For AWS Config configuration items, the value must be `ConfigurationItem` .\n- For Audit Manager evidence, the value must be `Evidence` .\n- For non- AWS events, the value must be `ActivityAuditLog` .\n- *`resources.type`* - This field is required for CloudTrail data events. `resources.type` can only use the `Equals` operator, and the value can be one of the following:\n\n- `AWS::DynamoDB::Table`\n- `AWS::Lambda::Function`\n- `AWS::S3::Object`\n- `AWS::CloudTrail::Channel`\n- `AWS::Cognito::IdentityPool`\n- `AWS::DynamoDB::Stream`\n- `AWS::EC2::InstanceConnectEndpoint`\n- `AWS::EC2::Snapshot`\n- `AWS::FinSpace::Environment`\n- `AWS::Glue::Table`\n- `AWS::KendraRanking::ExecutionPlan`\n- `AWS::ManagedBlockchain::Node`\n- `AWS::SageMaker::ExperimentTrialComponent`\n- `AWS::SageMaker::FeatureGroup`\n- `AWS::S3::AccessPoint`\n- `AWS::S3ObjectLambda::AccessPoint`\n- `AWS::S3Outposts::Object`\n\nYou can have only one `resources.type` field per selector. To log data events on more than one resource type, add another selector.\n- *`resources.ARN`* - You can use any operator with `resources.ARN` , but if you use `Equals` or `NotEquals` , the value must exactly match the ARN of a valid resource of the type you've specified in the template as the value of resources.type. For example, if resources.type equals `AWS::S3::Object` , the ARN must be in one of the following formats. To log all data events for all objects in a specific S3 bucket, use the `StartsWith` operator, and include only the bucket ARN as the matching value.\n\nThe trailing slash is intentional; do not exclude it. Replace the text between less than and greater than symbols (<>) with resource-specific information.\n\n- `arn:<partition>:s3:::<bucket_name>/`\n- `arn:<partition>:s3:::<bucket_name>/<object_path>/`\n\nWhen resources.type equals `AWS::DynamoDB::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>`\n\nWhen resources.type equals `AWS::Lambda::Function` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:lambda:<region>:<account_ID>:function:<function_name>`\n\nWhen resources.type equals `AWS::CloudTrail::Channel` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:cloudtrail:<region>:<account_ID>:channel/<channel_UUID>`\n\nWhen resources.type equals `AWS::Cognito::IdentityPool` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:cognito-identity:<region>:<account_ID>:identitypool/<identity_pool_ID>`\n\nWhen `resources.type` equals `AWS::DynamoDB::Stream` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:dynamodb:<region>:<account_ID>:table/<table_name>/stream/<date_time>`\n\nWhen `resources.type` equals `AWS::EC2::InstanceConnectEndpoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:ec2:<region>::instance-connect-endpoint/<instance_connect_endpoint_ID>`\n\nWhen `resources.type` equals `AWS::EC2::Snapshot` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:ec2:<region>::snapshot/<snapshot_ID>`\n\nWhen `resources.type` equals `AWS::FinSpace::Environment` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:finspace:<region>:<account_ID>:environment/<environment_ID>`\n\nWhen `resources.type` equals `AWS::Glue::Table` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:glue:<region>:<account_ID>:table/<database_name>/<table_name>`\n\nWhen `resources.type` equals `AWS::KendraRanking::ExecutionPlan` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:kendra-ranking:<region>:<account_ID>:table/<rescore-execution-plan>/<rescore_execution_plan_ID>`\n\nWhen `resources.type` equals `AWS::ManagedBlockchain::Node` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:managedblockchain:<region>:<account_ID>:nodes/<node_ID>`\n\nWhen `resources.type` equals `AWS::SageMaker::ExperimentTrialComponent` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:experiment-trial-component/<experiment_trial_component_name>`\n\nWhen `resources.type` equals `AWS::SageMaker::FeatureGroup` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:sagemaker:<region>:<account_ID>:feature-group/<feature_group_name>`\n\nWhen `resources.type` equals `AWS::S3::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in one of the following formats. To log events on all objects in an S3 access point, we recommend that you use only the access point ARN, don’t include the object path, and use the `StartsWith` or `NotStartsWith` operators.\n\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>`\n- `arn:<partition>:s3:<region>:<account_ID>:accesspoint/<access_point_name>/object/<object_path>`\n\nWhen `resources.type` equals `AWS::S3ObjectLambda::AccessPoint` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-object-lambda:<region>:<account_ID>:accesspoint/<access_point_name>`\n\nWhen `resources.type` equals `AWS::S3Outposts::Object` , and the operator is set to `Equals` or `NotEquals` , the ARN must be in the following format:\n\n- `arn:<partition>:s3-outposts:<region>:<account_ID>:<object_path>`",
|
|
8622
8620
|
"NotEndsWith": "An operator that excludes events that match the last few characters of the event record field specified as the value of `Field` .",
|
|
8623
8621
|
"NotEquals": "An operator that excludes events that match the exact value of the event record field specified as the value of `Field` .",
|
|
8624
8622
|
"NotStartsWith": "An operator that excludes events that match the first few characters of the event record field specified as the value of `Field` .",
|
|
@@ -8648,7 +8646,7 @@
|
|
|
8648
8646
|
"EnableLogFileValidation": "Specifies whether log file validation is enabled. The default is false.\n\n> When you disable log file integrity validation, the chain of digest files is broken after one hour. CloudTrail does not create digest files for log files that were delivered during a period in which log file integrity validation was disabled. For example, if you enable log file integrity validation at noon on January 1, disable it at noon on January 2, and re-enable it at noon on January 10, digest files will not be created for the log files delivered from noon on January 2 to noon on January 10. The same applies whenever you stop CloudTrail logging or delete a trail.",
|
|
8649
8647
|
"EventSelectors": "Use event selectors to further specify the management and data event settings for your trail. By default, trails created without specific event selectors will be configured to log all read and write management events, and no data events. When an event occurs in your account, CloudTrail evaluates the event selector for all trails. For each trail, if the event matches any event selector, the trail processes and logs the event. If the event doesn't match any event selector, the trail doesn't log the event.\n\nYou can configure up to five event selectors for a trail.",
|
|
8650
8648
|
"IncludeGlobalServiceEvents": "Specifies whether the trail is publishing events from global services such as IAM to the log files.",
|
|
8651
|
-
"InsightSelectors": "A JSON string that contains the insight types you want to log on a trail. `ApiCallRateInsight` and `ApiErrorRateInsight` are valid
|
|
8649
|
+
"InsightSelectors": "A JSON string that contains the insight types you want to log on a trail. `ApiCallRateInsight` and `ApiErrorRateInsight` are valid Insight types.\n\nThe `ApiCallRateInsight` Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume.\n\nThe `ApiErrorRateInsight` Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful.",
|
|
8652
8650
|
"IsLogging": "Whether the CloudTrail trail is currently logging AWS API calls.",
|
|
8653
8651
|
"IsMultiRegionTrail": "Specifies whether the trail applies only to the current region or to all regions. The default is false. If the trail exists only in the current region and this value is set to true, shadow trails (replications of the trail) will be created in the other regions. If the trail exists in all regions and this value is set to false, the trail will remain in the region where it was created, and its shadow trails in other regions will be deleted. As a best practice, consider using trails that log events in all regions.",
|
|
8654
8652
|
"IsOrganizationTrail": "Specifies whether the trail is applied to all accounts in an organization in AWS Organizations , or only for the current AWS account . The default is false, and cannot be true unless the call is made on behalf of an AWS account that is the management account or delegated administrator account for an organization in AWS Organizations . If the trail is not an organization trail and this is set to `true` , the trail will be created in all AWS accounts that belong to the organization. If the trail is an organization trail and this is set to `false` , the trail will remain in the current AWS account but be deleted from all member accounts in the organization.",
|
|
@@ -8680,9 +8678,9 @@
|
|
|
8680
8678
|
},
|
|
8681
8679
|
"AWS::CloudTrail::Trail.InsightSelector": {
|
|
8682
8680
|
"attributes": {},
|
|
8683
|
-
"description": "A JSON string that contains a list of
|
|
8681
|
+
"description": "A JSON string that contains a list of Insights types that are logged on a trail.",
|
|
8684
8682
|
"properties": {
|
|
8685
|
-
"InsightType": "The type of
|
|
8683
|
+
"InsightType": "The type of Insights events to log on a trail. `ApiCallRateInsight` and `ApiErrorRateInsight` are valid Insight types.\n\nThe `ApiCallRateInsight` Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume.\n\nThe `ApiErrorRateInsight` Insights type analyzes management API calls that result in error codes. The error is shown if the API call is unsuccessful."
|
|
8686
8684
|
}
|
|
8687
8685
|
},
|
|
8688
8686
|
"AWS::CloudWatch::Alarm": {
|
|
@@ -10532,7 +10530,7 @@
|
|
|
10532
10530
|
"properties": {
|
|
10533
10531
|
"AllSupported": "Specifies whether AWS Config records configuration changes for every supported type of regional resource.\n\nIf you set this option to `true` , when AWS Config adds support for a new type of regional resource, it starts recording resources of that type automatically.\n\nIf you set this option to `true` , you cannot enumerate a list of `resourceTypes` .",
|
|
10534
10532
|
"IncludeGlobalResourceTypes": "Specifies whether AWS Config includes all supported types of global resources (for example, IAM resources) with the resources that it records.\n\nBefore you can set this option to `true` , you must set the `AllSupported` option to `true` .\n\nIf you set this option to `true` , when AWS Config adds support for a new type of global resource, it starts recording resources of that type automatically.\n\nThe configuration details for any global resource are the same in all regions. To prevent duplicate configuration items, you should consider customizing AWS Config in only one region to record global resources.",
|
|
10535
|
-
"ResourceTypes": "A comma-separated list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, `AWS::EC2::Instance` or `AWS::CloudTrail::Trail` ).\n\nTo record all configuration changes, you must set the `AllSupported` option to `false` .\n\nIf you set
|
|
10533
|
+
"ResourceTypes": "A comma-separated list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, `AWS::EC2::Instance` or `AWS::CloudTrail::Trail` ).\n\nTo record all configuration changes, you must set the `AllSupported` option to `false` .\n\nIf you set the `AllSupported` option to false and populate the `ResourceTypes` option with values, when AWS Config adds support for a new type of resource, it will not record resources of that type unless you manually add that type to your recording group.\n\nFor a list of valid `resourceTypes` values, see the *resourceType Value* column in [Supported AWS Resource Types](https://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html#supported-resources) ."
|
|
10536
10534
|
}
|
|
10537
10535
|
},
|
|
10538
10536
|
"AWS::Config::ConformancePack": {
|
|
@@ -10863,7 +10861,7 @@
|
|
|
10863
10861
|
"description": "The encryption configuration.",
|
|
10864
10862
|
"properties": {
|
|
10865
10863
|
"EncryptionType": "The type of encryption.",
|
|
10866
|
-
"KeyId": "The full ARN of the encryption key.\n\n> Be sure to provide the full ARN of the encryption key, not just the ID."
|
|
10864
|
+
"KeyId": "The full ARN of the encryption key.\n\n> Be sure to provide the full ARN of the encryption key, not just the ID.\n> \n> Amazon Connect supports only KMS keys with the default key spec of [`SYMMETRIC_DEFAULT`](https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-symmetric-default) ."
|
|
10867
10865
|
}
|
|
10868
10866
|
},
|
|
10869
10867
|
"AWS::Connect::InstanceStorageConfig.KinesisFirehoseConfig": {
|
|
@@ -12117,7 +12115,7 @@
|
|
|
12117
12115
|
"ReplicationInstancePrivateIpAddresses": "One or more private IP addresses for the replication instance.",
|
|
12118
12116
|
"ReplicationInstancePublicIpAddresses": "One or more public IP addresses for the replication instance."
|
|
12119
12117
|
},
|
|
12120
|
-
"description": "The `AWS::DMS::ReplicationInstance` resource creates an AWS DMS replication instance.",
|
|
12118
|
+
"description": "The `AWS::DMS::ReplicationInstance` resource creates an AWS DMS replication instance. To create a ReplicationInstance, you need permissions to create instances. You'll need similar permissions to terminate instances when you delete stacks with instances.",
|
|
12121
12119
|
"properties": {
|
|
12122
12120
|
"AllocatedStorage": "The amount of storage (in gigabytes) to be initially allocated for the replication instance.",
|
|
12123
12121
|
"AllowMajorVersionUpgrade": "Indicates that major version upgrades are allowed. Changing this parameter does not result in an outage, and the change is asynchronously applied as soon as possible.\n\nThis parameter must be set to `true` when specifying a value for the `EngineVersion` parameter that is a different major version than the replication instance's current version.",
|
|
@@ -12948,7 +12946,7 @@
|
|
|
12948
12946
|
"attributes": {},
|
|
12949
12947
|
"description": "Specifies the version of the Server Message Block (SMB) protocol that AWS DataSync uses to access an SMB file server.",
|
|
12950
12948
|
"properties": {
|
|
12951
|
-
"Version": "By default, DataSync automatically chooses an SMB protocol version based on negotiation with your SMB file server. You also can configure DataSync to use a specific SMB version, but we recommend doing this only if DataSync has trouble negotiating with the SMB file server automatically.\n\nThese are the following options for configuring the SMB version:\n\n- `AUTOMATIC` (default): DataSync and the SMB file server negotiate
|
|
12949
|
+
"Version": "By default, DataSync automatically chooses an SMB protocol version based on negotiation with your SMB file server. You also can configure DataSync to use a specific SMB version, but we recommend doing this only if DataSync has trouble negotiating with the SMB file server automatically.\n\nThese are the following options for configuring the SMB version:\n\n- `AUTOMATIC` (default): DataSync and the SMB file server negotiate the highest version of SMB that they mutually support between 2.1 and 3.1.1.\n\nThis is the recommended option. If you instead choose a specific version that your file server doesn't support, you may get an `Operation Not Supported` error.\n- `SMB3` : Restricts the protocol negotiation to only SMB version 3.0.2.\n- `SMB2` : Restricts the protocol negotiation to only SMB version 2.1.\n- `SMB2_0` : Restricts the protocol negotiation to only SMB version 2.0.\n- `SMB1` : Restricts the protocol negotiation to only SMB version 1.0.\n\n> The `SMB1` option isn't available when [creating an Amazon FSx for NetApp ONTAP location](https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxOntap.html) ."
|
|
12952
12950
|
}
|
|
12953
12951
|
},
|
|
12954
12952
|
"AWS::DataSync::LocationFSxOpenZFS": {
|
|
@@ -13136,7 +13134,7 @@
|
|
|
13136
13134
|
"attributes": {},
|
|
13137
13135
|
"description": "Specifies the version of the SMB protocol that DataSync uses to access your SMB file server.",
|
|
13138
13136
|
"properties": {
|
|
13139
|
-
"Version": "By default, DataSync automatically chooses an SMB protocol version based on negotiation with your SMB file server. You also can configure DataSync to use a specific SMB version, but we recommend doing this only if DataSync has trouble negotiating with the SMB file server automatically.\n\nThese are the following options for configuring the SMB version:\n\n- `AUTOMATIC` (default): DataSync and the SMB file server negotiate
|
|
13137
|
+
"Version": "By default, DataSync automatically chooses an SMB protocol version based on negotiation with your SMB file server. You also can configure DataSync to use a specific SMB version, but we recommend doing this only if DataSync has trouble negotiating with the SMB file server automatically.\n\nThese are the following options for configuring the SMB version:\n\n- `AUTOMATIC` (default): DataSync and the SMB file server negotiate the highest version of SMB that they mutually support between 2.1 and 3.1.1.\n\nThis is the recommended option. If you instead choose a specific version that your file server doesn't support, you may get an `Operation Not Supported` error.\n- `SMB3` : Restricts the protocol negotiation to only SMB version 3.0.2.\n- `SMB2` : Restricts the protocol negotiation to only SMB version 2.1.\n- `SMB2_0` : Restricts the protocol negotiation to only SMB version 2.0.\n- `SMB1` : Restricts the protocol negotiation to only SMB version 1.0.\n\n> The `SMB1` option isn't available when [creating an Amazon FSx for NetApp ONTAP location](https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxOntap.html) ."
|
|
13140
13138
|
}
|
|
13141
13139
|
},
|
|
13142
13140
|
"AWS::DataSync::Task": {
|
|
@@ -13224,7 +13222,7 @@
|
|
|
13224
13222
|
"Id": "The ID of the notification channel.",
|
|
13225
13223
|
"Ref": "When the logical ID of this resource is provided to the `Ref` intrinsic function, `Ref` returns Amazon Resource Name (ARN) of the `NotificationChannel` . For more information about using the `Ref` function, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) ."
|
|
13226
13224
|
},
|
|
13227
|
-
"description": "Adds a notification channel to DevOps Guru. A notification channel is used to notify you about important DevOps Guru events, such as when an insight is generated.\n\nIf you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. DevOps Guru only supports standard SNS topics. For more information, see [Permissions for
|
|
13225
|
+
"description": "Adds a notification channel to DevOps Guru. A notification channel is used to notify you about important DevOps Guru events, such as when an insight is generated.\n\nIf you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to send it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. DevOps Guru only supports standard SNS topics. For more information, see [Permissions for Amazon SNS topics](https://docs.aws.amazon.com/devops-guru/latest/userguide/sns-required-permissions.html) .\n\nIf you use an Amazon SNS topic that is encrypted by an AWS Key Management Service customer-managed key (CMK), then you must add permissions to the CMK. For more information, see [Permissions for AWS KMS–encrypted Amazon SNS topics](https://docs.aws.amazon.com/devops-guru/latest/userguide/sns-kms-permissions.html) .",
|
|
13228
13226
|
"properties": {
|
|
13229
13227
|
"Config": "A `NotificationChannelConfig` object that contains information about configured notification channels."
|
|
13230
13228
|
}
|
|
@@ -13234,7 +13232,7 @@
|
|
|
13234
13232
|
"description": "Information about notification channels you have configured with DevOps Guru. The one supported notification channel is Amazon Simple Notification Service (Amazon SNS).",
|
|
13235
13233
|
"properties": {
|
|
13236
13234
|
"Filters": "The filter configurations for the Amazon SNS notification topic you use with DevOps Guru. If you do not provide filter configurations, the default configurations are to receive notifications for all message types of `High` or `Medium` severity.",
|
|
13237
|
-
"Sns": "Information about a notification channel configured in DevOps Guru to send notifications when insights are created.\n\nIf you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. DevOps Guru only supports standard SNS topics. For more information, see [Permissions for
|
|
13235
|
+
"Sns": "Information about a notification channel configured in DevOps Guru to send notifications when insights are created.\n\nIf you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to send it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. DevOps Guru only supports standard SNS topics. For more information, see [Permissions for Amazon SNS topics](https://docs.aws.amazon.com/devops-guru/latest/userguide/sns-required-permissions.html) .\n\nIf you use an Amazon SNS topic that is encrypted by an AWS Key Management Service customer-managed key (CMK), then you must add permissions to the CMK. For more information, see [Permissions for AWS KMS–encrypted Amazon SNS topics](https://docs.aws.amazon.com/devops-guru/latest/userguide/sns-kms-permissions.html) ."
|
|
13238
13236
|
}
|
|
13239
13237
|
},
|
|
13240
13238
|
"AWS::DevOpsGuru::NotificationChannel.NotificationFilterConfig": {
|
|
@@ -13247,7 +13245,7 @@
|
|
|
13247
13245
|
},
|
|
13248
13246
|
"AWS::DevOpsGuru::NotificationChannel.SnsChannelConfig": {
|
|
13249
13247
|
"attributes": {},
|
|
13250
|
-
"description": "Contains the Amazon Resource Name (ARN) of an Amazon Simple Notification Service topic.\n\nIf you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. DevOps Guru only supports standard SNS topics. For more information, see [Permissions for
|
|
13248
|
+
"description": "Contains the Amazon Resource Name (ARN) of an Amazon Simple Notification Service topic.\n\nIf you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to send it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. DevOps Guru only supports standard SNS topics. For more information, see [Permissions for Amazon SNS topics](https://docs.aws.amazon.com/devops-guru/latest/userguide/sns-required-permissions.html) .\n\nIf you use an Amazon SNS topic that is encrypted by an AWS Key Management Service customer-managed key (CMK), then you must add permissions to the CMK. For more information, see [Permissions for AWS KMS–encrypted Amazon SNS topics](https://docs.aws.amazon.com/devops-guru/latest/userguide/sns-kms-permissions.html) .",
|
|
13251
13249
|
"properties": {
|
|
13252
13250
|
"TopicArn": "The Amazon Resource Name (ARN) of an Amazon Simple Notification Service topic."
|
|
13253
13251
|
}
|
|
@@ -14185,7 +14183,7 @@
|
|
|
14185
14183
|
"properties": {
|
|
14186
14184
|
"AvailabilityZone": "The Availability Zone in which to launch the instances.",
|
|
14187
14185
|
"InstanceRequirements": "The attributes for the instance types. When you specify instance attributes, Amazon EC2 will identify instance types with those attributes.\n\n> If you specify `InstanceRequirements` , you can't specify `InstanceType` .",
|
|
14188
|
-
"InstanceType": "The instance type.\n\n> If you specify `InstanceType` , you can't specify `InstanceRequirements` .",
|
|
14186
|
+
"InstanceType": "The instance type.\n\n`mac1.metal` is not supported as a launch template override.\n\n> If you specify `InstanceType` , you can't specify `InstanceRequirements` .",
|
|
14189
14187
|
"MaxPrice": "The maximum price per unit hour that you are willing to pay for a Spot Instance. We do not recommend using this parameter because it can lead to increased interruptions. If you do not specify this parameter, you will pay the current Spot price.\n\n> If you specify a maximum price, your instances will be interrupted more frequently than if you do not specify this parameter.",
|
|
14190
14188
|
"Placement": "The location where the instance launched, if applicable.",
|
|
14191
14189
|
"Priority": "The priority for the launch template override. The highest priority is launched first.\n\nIf the On-Demand `AllocationStrategy` is set to `prioritized` , EC2 Fleet uses priority to determine which launch template override to use first in fulfilling On-Demand capacity.\n\nIf the Spot `AllocationStrategy` is set to `capacity-optimized-prioritized` , EC2 Fleet uses priority on a best-effort basis to determine which launch template override to use in fulfilling Spot capacity, but optimizes for capacity first.\n\nValid values are whole numbers starting at `0` . The lower the number, the higher the priority. If no number is set, the launch template override has the lowest priority. You can set the same priority for different launch template overrides.",
|
|
@@ -16675,7 +16673,8 @@
|
|
|
16675
16673
|
},
|
|
16676
16674
|
"AWS::EC2::VPCEndpointService": {
|
|
16677
16675
|
"attributes": {
|
|
16678
|
-
"Ref": "`Ref` returns the ID of the VPC endpoint service configuration."
|
|
16676
|
+
"Ref": "`Ref` returns the ID of the VPC endpoint service configuration.",
|
|
16677
|
+
"ServiceId": ""
|
|
16679
16678
|
},
|
|
16680
16679
|
"description": "Creates a VPC endpoint service configuration to which service consumers ( AWS accounts, users, and IAM roles) can connect.\n\nTo create an endpoint service configuration, you must first create one of the following for your service:\n\n- A [Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) . Service consumers connect to your service using an interface endpoint.\n- A [Gateway Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/introduction.html) . Service consumers connect to your service using a Gateway Load Balancer endpoint.\n\nFor more information, see the [AWS PrivateLink User Guide](https://docs.aws.amazon.com/vpc/latest/privatelink/) .",
|
|
16681
16680
|
"properties": {
|
|
@@ -17751,7 +17750,7 @@
|
|
|
17751
17750
|
"EncryptionConfigKeyArn": "Amazon Resource Name (ARN) or alias of the customer master key (CMK).",
|
|
17752
17751
|
"Endpoint": "The endpoint for your Kubernetes API server, such as `https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com` .",
|
|
17753
17752
|
"Id": "The ID of your local Amazon EKS cluster on an AWS Outpost. This property isn't available for an Amazon EKS cluster on the AWS cloud.",
|
|
17754
|
-
"KubernetesNetworkConfig.ServiceIpv6Cidr": "The CIDR block that Kubernetes Service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specified `ipv6` for *ipFamily* when you created the cluster. Kubernetes assigns Service addresses from the unique local address range ( `fc00::/7` ) because you can't specify a custom IPv6 CIDR block when you create the cluster.",
|
|
17753
|
+
"KubernetesNetworkConfig.ServiceIpv6Cidr": "The CIDR block that Kubernetes Service IP addresses are assigned from if you created a `1.21` or later cluster with version `>1.10.1` or later of the Amazon VPC CNI add-on and specified `ipv6` for *ipFamily* when you created the cluster. Kubernetes assigns Service addresses from the unique local address range ( `fc00::/7` ) because you can't specify a custom `IPv6` CIDR block when you create the cluster.",
|
|
17755
17754
|
"OpenIdConnectIssuerUrl": "The issuer URL for the OIDC identity provider.",
|
|
17756
17755
|
"Ref": "`Ref` returns the resource name. For example:\n\n`{ \"Ref\": \"myCluster\" }`\n\nFor the Amazon EKS cluster `myCluster` , `Ref` returns the name of the cluster."
|
|
17757
17756
|
},
|
|
@@ -17764,7 +17763,7 @@
|
|
|
17764
17763
|
"OutpostConfig": "An object representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This object isn't available for clusters on the AWS cloud.",
|
|
17765
17764
|
"ResourcesVpcConfig": "The VPC configuration that's used by the cluster control plane. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) and [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html) in the *Amazon EKS User Guide* . You must specify at least two subnets. You can specify up to five security groups, but we recommend that you use a dedicated security group for your cluster control plane.\n\n> Updates require replacement of the `SecurityGroupIds` and `SubnetIds` sub-properties.",
|
|
17766
17765
|
"RoleArn": "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. For more information, see [Amazon EKS Service IAM Role](https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html) in the **Amazon EKS User Guide** .",
|
|
17767
|
-
"Tags": "The metadata that you apply to the cluster to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Cluster tags don't propagate to any other resources associated with the cluster.\n\n> You must have the `eks:TagResource` and `eks:UntagResource` permissions
|
|
17766
|
+
"Tags": "The metadata that you apply to the cluster to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Cluster tags don't propagate to any other resources associated with the cluster.\n\n> You must have the `eks:TagResource` and `eks:UntagResource` permissions for your [IAM principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html) to manage the AWS CloudFormation stack. If you don't have these permissions, there might be unexpected behavior with stack-level tags propagating to the resource during resource creation and update.",
|
|
17768
17767
|
"Version": "The desired Kubernetes version for your cluster. If you don't specify a value here, the default version available in Amazon EKS is used.\n\n> The default version might not be the latest version available."
|
|
17769
17768
|
}
|
|
17770
17769
|
},
|
|
@@ -17777,7 +17776,7 @@
|
|
|
17777
17776
|
},
|
|
17778
17777
|
"AWS::EKS::Cluster.ControlPlanePlacement": {
|
|
17779
17778
|
"attributes": {},
|
|
17780
|
-
"description": "The placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost. For more information, see [Capacity considerations](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-capacity-considerations.html) in the
|
|
17779
|
+
"description": "The placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost. For more information, see [Capacity considerations](https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-capacity-considerations.html) in the Amazon EKS User Guide.",
|
|
17781
17780
|
"properties": {
|
|
17782
17781
|
"GroupName": "The name of the placement group for the Kubernetes control plane instances."
|
|
17783
17782
|
}
|
|
@@ -17826,7 +17825,7 @@
|
|
|
17826
17825
|
"attributes": {},
|
|
17827
17826
|
"description": "Identifies the AWS Key Management Service ( AWS KMS ) key used to encrypt the secrets.",
|
|
17828
17827
|
"properties": {
|
|
17829
|
-
"KeyArn": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric
|
|
17828
|
+
"KeyArn": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric and created in the same AWS Region as the cluster. If the KMS key was created in a different account, the [IAM principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html) must have access to the KMS key. For more information, see [Allowing users in other accounts to use a KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html) in the *AWS Key Management Service Developer Guide* ."
|
|
17830
17829
|
}
|
|
17831
17830
|
},
|
|
17832
17831
|
"AWS::EKS::Cluster.ResourcesVpcConfig": {
|
|
@@ -19613,7 +19612,7 @@
|
|
|
19613
19612
|
"HealthCheckPort": "The port the load balancer uses when performing health checks on targets. If the protocol is HTTP, HTTPS, TCP, TLS, UDP, or TCP_UDP, the default is `traffic-port` , which is the port on which each target receives traffic from the load balancer. If the protocol is GENEVE, the default is port 80.",
|
|
19614
19613
|
"HealthCheckProtocol": "The protocol the load balancer uses when performing health checks on targets. For Application Load Balancers, the default is HTTP. For Network Load Balancers and Gateway Load Balancers, the default is TCP. The TCP protocol is not supported for health checks if the protocol of the target group is HTTP or HTTPS. The GENEVE, TLS, UDP, and TCP_UDP protocols are not supported for health checks.",
|
|
19615
19614
|
"HealthCheckTimeoutSeconds": "The amount of time, in seconds, during which no response from a target means a failed health check. The range is 2–120 seconds. For target groups with a protocol of HTTP, the default is 6 seconds. For target groups with a protocol of TCP, TLS or HTTPS, the default is 10 seconds. For target groups with a protocol of GENEVE, the default is 5 seconds. If the target type is `lambda` , the default is 30 seconds.",
|
|
19616
|
-
"HealthyThresholdCount": "The number of consecutive health check successes required before considering a target healthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 5. For target groups with a protocol of GENEVE, the default is
|
|
19615
|
+
"HealthyThresholdCount": "The number of consecutive health check successes required before considering a target healthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 5. For target groups with a protocol of GENEVE, the default is 3. If the target type is `lambda` , the default is 5.",
|
|
19617
19616
|
"IpAddressType": "The type of IP address used for this target group. The possible values are `ipv4` and `ipv6` . This is an optional parameter. If not specified, the IP address type defaults to `ipv4` .",
|
|
19618
19617
|
"Matcher": "[HTTP/HTTPS health checks] The HTTP or gRPC codes to use when checking for a successful response from a target. For target groups with a protocol of TCP, TCP_UDP, UDP or TLS the range is 200-599. For target groups with a protocol of HTTP or HTTPS, the range is 200-499. For target groups with a protocol of GENEVE, the range is 200-399.",
|
|
19619
19618
|
"Name": "The name of the target group.\n\nThis name must be unique per region per account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen.",
|
|
@@ -19624,7 +19623,7 @@
|
|
|
19624
19623
|
"TargetGroupAttributes": "The attributes.",
|
|
19625
19624
|
"TargetType": "The type of target that you must specify when registering targets with this target group. You can't specify targets for a target group using more than one target type.\n\n- `instance` - Register targets by instance ID. This is the default value.\n- `ip` - Register targets by IP address. You can specify IP addresses from the subnets of the virtual private cloud (VPC) for the target group, the RFC 1918 range (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), and the RFC 6598 range (100.64.0.0/10). You can't specify publicly routable IP addresses.\n- `lambda` - Register a single Lambda function as a target.\n- `alb` - Register a single Application Load Balancer as a target.",
|
|
19626
19625
|
"Targets": "The targets.",
|
|
19627
|
-
"UnhealthyThresholdCount": "The number of consecutive health check failures required before considering a target unhealthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 2. For target groups with a protocol of GENEVE, the default is
|
|
19626
|
+
"UnhealthyThresholdCount": "The number of consecutive health check failures required before considering a target unhealthy. The range is 2-10. If the target group protocol is TCP, TCP_UDP, UDP, TLS, HTTP or HTTPS, the default is 2. For target groups with a protocol of GENEVE, the default is 3. If the target type is `lambda` , the default is 5.",
|
|
19628
19627
|
"VpcId": "The identifier of the virtual private cloud (VPC). If the target is a Lambda function, this parameter does not apply. Otherwise, this parameter is required."
|
|
19629
19628
|
}
|
|
19630
19629
|
},
|
|
@@ -23458,7 +23457,7 @@
|
|
|
23458
23457
|
"DeploymentId": "The ID of the deployment.",
|
|
23459
23458
|
"Ref": "`Ref` returns the `DeploymentId` ."
|
|
23460
23459
|
},
|
|
23461
|
-
"description": "Creates a continuous deployment for a target, which is a AWS IoT Greengrass core device or group of core devices. When you add a new core device to a group of core devices that has a deployment, AWS IoT Greengrass deploys that group's deployment to the new device.\n\nYou can define one deployment for each target. When you create a new deployment for a target that has an existing deployment, you replace the previous deployment. AWS IoT Greengrass applies the new deployment to the target devices.\n\nYou can only add, update, or delete up to 10 deployments at a time to a single target.\n\nEvery deployment has a revision number that indicates how many deployment revisions you define for a target. Use this operation to create a new revision of an existing deployment. This operation returns the revision number of the new deployment when you create it.\n\nFor more information, see the [Create deployments](https://docs.aws.amazon.com/greengrass/v2/
|
|
23460
|
+
"description": "Creates a continuous deployment for a target, which is a AWS IoT Greengrass core device or group of core devices. When you add a new core device to a group of core devices that has a deployment, AWS IoT Greengrass deploys that group's deployment to the new device.\n\nYou can define one deployment for each target. When you create a new deployment for a target that has an existing deployment, you replace the previous deployment. AWS IoT Greengrass applies the new deployment to the target devices.\n\nYou can only add, update, or delete up to 10 deployments at a time to a single target.\n\nEvery deployment has a revision number that indicates how many deployment revisions you define for a target. Use this operation to create a new revision of an existing deployment. This operation returns the revision number of the new deployment when you create it.\n\nFor more information, see the [Create deployments](https://docs.aws.amazon.com/greengrass/v2/developerguide/create-deployments.html) in the *AWS IoT Greengrass V2 Developer Guide* .\n\n> Deployment resources are deleted when you delete stacks. To keep the deployments in a stack, you must specify `\"DeletionPolicy\": \"Retain\"` on each deployment resource in the stack template that you want to keep. For more information, see [DeletionPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html) .\n> \n> You can only delete up to 10 deployment resources at a time. If you delete more than 10 resources, you receive an error.",
|
|
23462
23461
|
"properties": {
|
|
23463
23462
|
"Components": "The components to deploy. This is a dictionary, where each key is the name of a component, and each key's value is the version and configuration to deploy for that component.",
|
|
23464
23463
|
"DeploymentName": "The name of the deployment.",
|
|
@@ -23498,13 +23497,13 @@
|
|
|
23498
23497
|
"attributes": {},
|
|
23499
23498
|
"description": "Contains information about a deployment's policy that defines when components are safe to update.\n\nEach component on a device can report whether or not it's ready to update. After a component and its dependencies are ready, they can apply the update in the deployment. You can configure whether or not the deployment notifies components of an update and waits for a response. You specify the amount of time each component has to respond to the update notification.",
|
|
23500
23499
|
"properties": {
|
|
23501
|
-
"Action": "Whether or not to notify components and wait for components to become safe to update. Choose from the following options:\n\n- `NOTIFY_COMPONENTS` – The deployment notifies each component before it stops and updates that component. Components can use the [SubscribeToComponentUpdates](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-subscribetocomponentupdates) IPC operation to receive these notifications. Then, components can respond with the [DeferComponentUpdate](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-defercomponentupdate) IPC operation. For more information, see the [Create deployments](https://docs.aws.amazon.com/greengrass/v2/
|
|
23500
|
+
"Action": "Whether or not to notify components and wait for components to become safe to update. Choose from the following options:\n\n- `NOTIFY_COMPONENTS` – The deployment notifies each component before it stops and updates that component. Components can use the [SubscribeToComponentUpdates](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-subscribetocomponentupdates) IPC operation to receive these notifications. Then, components can respond with the [DeferComponentUpdate](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-defercomponentupdate) IPC operation. For more information, see the [Create deployments](https://docs.aws.amazon.com/greengrass/v2/developerguide/create-deployments.html) in the *AWS IoT Greengrass V2 Developer Guide* .\n- `SKIP_NOTIFY_COMPONENTS` – The deployment doesn't notify components or wait for them to be safe to update.\n\nDefault: `NOTIFY_COMPONENTS`",
|
|
23502
23501
|
"TimeoutInSeconds": "The amount of time in seconds that each component on a device has to report that it's safe to update. If the component waits for longer than this timeout, then the deployment proceeds on the device.\n\nDefault: `60`"
|
|
23503
23502
|
}
|
|
23504
23503
|
},
|
|
23505
23504
|
"AWS::GreengrassV2::Deployment.DeploymentConfigurationValidationPolicy": {
|
|
23506
23505
|
"attributes": {},
|
|
23507
|
-
"description": "Contains information about how long a component on a core device can validate its configuration updates before it times out. Components can use the [SubscribeToValidateConfigurationUpdates](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-subscribetovalidateconfigurationupdates) IPC operation to receive notifications when a deployment specifies a configuration update. Then, components can respond with the [SendConfigurationValidityReport](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-sendconfigurationvalidityreport) IPC operation. For more information, see the [Create deployments](https://docs.aws.amazon.com/greengrass/v2/
|
|
23506
|
+
"description": "Contains information about how long a component on a core device can validate its configuration updates before it times out. Components can use the [SubscribeToValidateConfigurationUpdates](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-subscribetovalidateconfigurationupdates) IPC operation to receive notifications when a deployment specifies a configuration update. Then, components can respond with the [SendConfigurationValidityReport](https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-operation-sendconfigurationvalidityreport) IPC operation. For more information, see the [Create deployments](https://docs.aws.amazon.com/greengrass/v2/developerguide/create-deployments.html) in the *AWS IoT Greengrass V2 Developer Guide* .",
|
|
23508
23507
|
"properties": {
|
|
23509
23508
|
"TimeoutInSeconds": "The amount of time in seconds that a component can validate its configuration updates. If the validation time exceeds this timeout, then the deployment proceeds for the device.\n\nDefault: `30`"
|
|
23510
23509
|
}
|
|
@@ -23860,7 +23859,7 @@
|
|
|
23860
23859
|
"description": "The `AWS::GuardDuty::Filter` resource specifies a new filter defined by the provided `findingCriteria` .",
|
|
23861
23860
|
"properties": {
|
|
23862
23861
|
"Action": "Specifies the action that is to be applied to the findings that match the filter.",
|
|
23863
|
-
"Description": "The description of the filter. Valid special characters
|
|
23862
|
+
"Description": "The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( `{ }` , `[ ]` , and `( )` ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.",
|
|
23864
23863
|
"DetectorId": "The ID of the detector belonging to the GuardDuty account that you want to create a filter for.",
|
|
23865
23864
|
"FindingCriteria": "Represents the criteria to be used in the filter for querying findings.",
|
|
23866
23865
|
"Name": "The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.",
|
|
@@ -30661,7 +30660,7 @@
|
|
|
30661
30660
|
},
|
|
30662
30661
|
"description": "The `AWS::Lambda::EventInvokeConfig` resource configures options for [asynchronous invocation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html) on a version or an alias.\n\nBy default, Lambda retries an asynchronous invocation twice if the function returns an error. It retains events in a queue for up to six hours. When an event fails all processing attempts or stays in the asynchronous invocation queue for too long, Lambda discards it.",
|
|
30663
30662
|
"properties": {
|
|
30664
|
-
"DestinationConfig": "A destination for events after they have been sent to a function for processing.\n\n**Destinations** - *Function* - The Amazon Resource Name (ARN) of a Lambda function.\n- *Queue* - The ARN of
|
|
30663
|
+
"DestinationConfig": "A destination for events after they have been sent to a function for processing.\n\n**Destinations** - *Function* - The Amazon Resource Name (ARN) of a Lambda function.\n- *Queue* - The ARN of a standard SQS queue.\n- *Topic* - The ARN of a standard SNS topic.\n- *Event Bus* - The ARN of an Amazon EventBridge event bus.",
|
|
30665
30664
|
"FunctionName": "The name of the Lambda function.\n\n*Minimum* : `1`\n\n*Maximum* : `64`\n\n*Pattern* : `([a-zA-Z0-9-_]+)`",
|
|
30666
30665
|
"MaximumEventAgeInSeconds": "The maximum age of a request that Lambda sends to a function for processing.",
|
|
30667
30666
|
"MaximumRetryAttempts": "The maximum number of times to retry when the function returns an error.",
|
|
@@ -30698,11 +30697,11 @@
|
|
|
30698
30697
|
"description": "The `AWS::Lambda::EventSourceMapping` resource creates a mapping between an event source and an AWS Lambda function. Lambda reads items from the event source and triggers the function.\n\nFor details about each event source type, see the following topics. In particular, each of the topics describes the required and optional parameters for the specific event source.\n\n- [Configuring a Dynamo DB stream as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html#services-dynamodb-eventsourcemapping)\n- [Configuring a Kinesis stream as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html#services-kinesis-eventsourcemapping)\n- [Configuring an SQS queue as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-eventsource)\n- [Configuring an MQ broker as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-mq.html#services-mq-eventsourcemapping)\n- [Configuring MSK as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html)\n- [Configuring Self-Managed Apache Kafka as an event source](https://docs.aws.amazon.com/lambda/latest/dg/kafka-smaa.html)",
|
|
30699
30698
|
"properties": {
|
|
30700
30699
|
"AmazonManagedKafkaEventSourceConfig": "Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.",
|
|
30701
|
-
"BatchSize": "The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).\n\n- *Amazon Kinesis* – Default 100. Max 10,000.\n- *Amazon DynamoDB Streams* – Default 100. Max 10,000.\n- *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10.\n- *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000.\n- *Self-managed Apache Kafka* – Default 100. Max 10,000.\n- *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000.",
|
|
30700
|
+
"BatchSize": "The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).\n\n- *Amazon Kinesis* – Default 100. Max 10,000.\n- *Amazon DynamoDB Streams* – Default 100. Max 10,000.\n- *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10.\n- *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000.\n- *Self-managed Apache Kafka* – Default 100. Max 10,000.\n- *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000.\n- *DocumentDB* – Default 100. Max 10,000.",
|
|
30702
30701
|
"BisectBatchOnFunctionError": "(Streams only) If the function returns an error, split the batch in two and retry. The default value is false.",
|
|
30703
30702
|
"DestinationConfig": "(Streams only) An Amazon SQS queue or Amazon SNS topic destination for discarded records.",
|
|
30704
30703
|
"Enabled": "When true, the event source mapping is active. When false, Lambda pauses polling and invocation.\n\nDefault: True",
|
|
30705
|
-
"EventSourceArn": "The Amazon Resource Name (ARN) of the event source.\n\n- *Amazon Kinesis* – The ARN of the data stream or a stream consumer.\n- *Amazon DynamoDB Streams* – The ARN of the stream.\n- *Amazon Simple Queue Service* – The ARN of the queue.\n- *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster.\n- *Amazon MQ* – The ARN of the broker.",
|
|
30704
|
+
"EventSourceArn": "The Amazon Resource Name (ARN) of the event source.\n\n- *Amazon Kinesis* – The ARN of the data stream or a stream consumer.\n- *Amazon DynamoDB Streams* – The ARN of the stream.\n- *Amazon Simple Queue Service* – The ARN of the queue.\n- *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster.\n- *Amazon MQ* – The ARN of the broker.\n- *Amazon DocumentDB* – The ARN of the DocumentDB change stream.",
|
|
30706
30705
|
"FilterCriteria": "An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see [Lambda event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html) .",
|
|
30707
30706
|
"FunctionName": "The name of the Lambda function.\n\n**Name formats** - *Function name* – `MyFunction` .\n- *Function ARN* – `arn:aws:lambda:us-west-2:123456789012:function:MyFunction` .\n- *Version or Alias ARN* – `arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD` .\n- *Partial ARN* – `123456789012:function:MyFunction` .\n\nThe length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.",
|
|
30708
30707
|
"FunctionResponseTypes": "(Streams and SQS) A list of current response type enums applied to the event source mapping.\n\nValid Values: `ReportBatchItemFailures`",
|
|
@@ -30800,7 +30799,7 @@
|
|
|
30800
30799
|
"SnapStartResponse.ApplyOn": "",
|
|
30801
30800
|
"SnapStartResponse.OptimizationStatus": ""
|
|
30802
30801
|
},
|
|
30803
|
-
"description": "The `AWS::Lambda::Function` resource creates a Lambda function. To create a function, you need a [deployment package](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html) and an [execution role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html) . The deployment package is a .zip file archive or container image that contains your function code. The execution role grants the function permission to use AWS services, such as Amazon CloudWatch Logs for log streaming and AWS X-Ray for request tracing.\n\nYou set the package type to `Image` if the deployment package is a [container image](https://docs.aws.amazon.com/lambda/latest/dg/lambda-images.html) . For a container image, the code property must include the URI of a container image in the Amazon ECR registry. You do not need to specify the handler and runtime properties.\n\nYou set the package type to `Zip` if the deployment package is a [.zip file archive](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html#gettingstarted-package-zip) . For a .zip file archive, the code property specifies the location of the .zip file. You must also specify the handler and runtime properties. For a Python example, see [Deploy Python Lambda functions with .zip file archives](https://docs.aws.amazon.com/lambda/latest/dg/python-package.html) .\n\nYou can use [code signing](https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html) if your deployment package is a .zip file archive. To enable code signing for this function, specify the ARN of a code-signing configuration. When a user attempts to deploy a code package with `UpdateFunctionCode` , Lambda checks that the code package has a valid signature from a trusted publisher. The code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.\n\nNote that you configure [provisioned concurrency](https://docs.aws.amazon.com/lambda/latest/dg/
|
|
30802
|
+
"description": "The `AWS::Lambda::Function` resource creates a Lambda function. To create a function, you need a [deployment package](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html) and an [execution role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html) . The deployment package is a .zip file archive or container image that contains your function code. The execution role grants the function permission to use AWS services, such as Amazon CloudWatch Logs for log streaming and AWS X-Ray for request tracing.\n\nYou set the package type to `Image` if the deployment package is a [container image](https://docs.aws.amazon.com/lambda/latest/dg/lambda-images.html) . For a container image, the code property must include the URI of a container image in the Amazon ECR registry. You do not need to specify the handler and runtime properties.\n\nYou set the package type to `Zip` if the deployment package is a [.zip file archive](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html#gettingstarted-package-zip) . For a .zip file archive, the code property specifies the location of the .zip file. You must also specify the handler and runtime properties. For a Python example, see [Deploy Python Lambda functions with .zip file archives](https://docs.aws.amazon.com/lambda/latest/dg/python-package.html) .\n\nYou can use [code signing](https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html) if your deployment package is a .zip file archive. To enable code signing for this function, specify the ARN of a code-signing configuration. When a user attempts to deploy a code package with `UpdateFunctionCode` , Lambda checks that the code package has a valid signature from a trusted publisher. The code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.\n\nNote that you configure [provisioned concurrency](https://docs.aws.amazon.com/lambda/latest/dg/provisioned-concurrency.html) on a `AWS::Lambda::Version` or a `AWS::Lambda::Alias` .\n\nFor a complete introduction to Lambda functions, see [What is Lambda?](https://docs.aws.amazon.com/lambda/latest/dg/lambda-welcome.html) in the *Lambda developer guide.*",
|
|
30804
30803
|
"properties": {
|
|
30805
30804
|
"Architectures": "The instruction set architecture that the function supports. Enter a string array with one of the valid values (arm64 or x86_64). The default value is `x86_64` .",
|
|
30806
30805
|
"Code": "The code for the function.",
|
|
@@ -30882,7 +30881,7 @@
|
|
|
30882
30881
|
"description": "Sets the runtime management configuration for a function's version. For more information, see [Runtime updates](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html) .",
|
|
30883
30882
|
"properties": {
|
|
30884
30883
|
"RuntimeVersionArn": "The ARN of the runtime version you want the function to use.\n\n> This is only required if you're using the *Manual* runtime update mode.",
|
|
30885
|
-
"UpdateRuntimeOn": "Specify the runtime update mode.\n\n- *Auto (default)* - Automatically update to the most recent and secure runtime version using a [Two-phase runtime version rollout](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase) . This is the best choice for most customers to ensure they always benefit from runtime updates.\n- *
|
|
30884
|
+
"UpdateRuntimeOn": "Specify the runtime update mode.\n\n- *Auto (default)* - Automatically update to the most recent and secure runtime version using a [Two-phase runtime version rollout](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase) . This is the best choice for most customers to ensure they always benefit from runtime updates.\n- *FunctionUpdate* - Lambda updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date.\n- *Manual* - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see [Roll back a runtime version](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback) .\n\n*Valid Values* : `Auto` | `FunctionUpdate` | `Manual`"
|
|
30886
30885
|
}
|
|
30887
30886
|
},
|
|
30888
30887
|
"AWS::Lambda::Function.SnapStart": {
|
|
@@ -33556,9 +33555,9 @@
|
|
|
33556
33555
|
},
|
|
33557
33556
|
"AWS::ManagedBlockchain::Member.MemberFabricConfiguration": {
|
|
33558
33557
|
"attributes": {},
|
|
33559
|
-
"description": "Configuration properties for Hyperledger Fabric for a member in a Managed Blockchain network using the Hyperledger Fabric framework.",
|
|
33558
|
+
"description": "Configuration properties for Hyperledger Fabric for a member in a Managed Blockchain network that is using the Hyperledger Fabric framework.",
|
|
33560
33559
|
"properties": {
|
|
33561
|
-
"AdminPassword": "The password for the member's initial administrative user. The `AdminPassword` must be at least
|
|
33560
|
+
"AdminPassword": "The password for the member's initial administrative user. The `AdminPassword` must be at least 8 characters long and no more than 32 characters. It must contain at least one uppercase letter, one lowercase letter, and one digit. It cannot have a single quotation mark (‘), a double quotation marks (“), a forward slash(/), a backward slash(\\), @, or a space.",
|
|
33562
33561
|
"AdminUsername": "The user name for the member's initial administrative user."
|
|
33563
33562
|
}
|
|
33564
33563
|
},
|
|
@@ -33578,21 +33577,21 @@
|
|
|
33578
33577
|
"FrameworkVersion": "The version of the blockchain framework that the network uses.",
|
|
33579
33578
|
"Name": "The name of the network.",
|
|
33580
33579
|
"NetworkFrameworkConfiguration": "Configuration properties relevant to the network for the blockchain framework that the network uses.",
|
|
33581
|
-
"VotingPolicy": "The voting rules
|
|
33580
|
+
"VotingPolicy": "The voting rules that the network uses to decide if a proposal is accepted."
|
|
33582
33581
|
}
|
|
33583
33582
|
},
|
|
33584
33583
|
"AWS::ManagedBlockchain::Member.NetworkFabricConfiguration": {
|
|
33585
33584
|
"attributes": {},
|
|
33586
33585
|
"description": "Hyperledger Fabric configuration properties for the network.",
|
|
33587
33586
|
"properties": {
|
|
33588
|
-
"Edition": "The edition of Amazon Managed Blockchain that the network uses. Valid values are `standard` and `starter` . For more information, see"
|
|
33587
|
+
"Edition": "The edition of Amazon Managed Blockchain that the network uses. Valid values are `standard` and `starter` . For more information, see [Amazon Managed Blockchain Pricing](https://docs.aws.amazon.com/managed-blockchain/pricing/)"
|
|
33589
33588
|
}
|
|
33590
33589
|
},
|
|
33591
33590
|
"AWS::ManagedBlockchain::Member.NetworkFrameworkConfiguration": {
|
|
33592
33591
|
"attributes": {},
|
|
33593
33592
|
"description": "Configuration properties relevant to the network for the blockchain framework that the network uses.",
|
|
33594
33593
|
"properties": {
|
|
33595
|
-
"NetworkFabricConfiguration": "Configuration properties for Hyperledger Fabric for a member in a Managed Blockchain network using the Hyperledger Fabric framework."
|
|
33594
|
+
"NetworkFabricConfiguration": "Configuration properties for Hyperledger Fabric for a member in a Managed Blockchain network that is using the Hyperledger Fabric framework."
|
|
33596
33595
|
}
|
|
33597
33596
|
},
|
|
33598
33597
|
"AWS::ManagedBlockchain::Member.VotingPolicy": {
|
|
@@ -36934,6 +36933,39 @@
|
|
|
36934
36933
|
"TransitGatewayArn": "The Amazon Resource Name (ARN) of the transit gateway."
|
|
36935
36934
|
}
|
|
36936
36935
|
},
|
|
36936
|
+
"AWS::NetworkManager::TransitGatewayRouteTableAttachment": {
|
|
36937
|
+
"attributes": {
|
|
36938
|
+
"AttachmentId": "The ID of the transit gateway route table attachment.",
|
|
36939
|
+
"AttachmentPolicyRuleNumber": "The policy rule number associated with the attachment.",
|
|
36940
|
+
"AttachmentType": "The type of attachment. This will be `TRANSIT_GATEWAY_ROUTE_TABLE` .",
|
|
36941
|
+
"CoreNetworkArn": "The ARN of the core network.",
|
|
36942
|
+
"CoreNetworkId": "The ID of the core network.",
|
|
36943
|
+
"CreatedAt": "The timestamp when the transit gateway route table attachment was created.",
|
|
36944
|
+
"EdgeLocation": "The Region where the core network edge is located.",
|
|
36945
|
+
"OwnerAccountId": "The ID of the transit gateway route table attachment owner.",
|
|
36946
|
+
"Ref": "`Ref` returns the attachment ID of the transit gateway route table. For example: `attachment-12367e74104d31234` .",
|
|
36947
|
+
"ResourceArn": "The resource ARN for the transit gateway route table attachment.",
|
|
36948
|
+
"SegmentName": "The name of the attachment's segment.",
|
|
36949
|
+
"State": "The state of the attachment. This can be: `REJECTED` | `PENDING_ATTACHMENT_ACCEPTANCE` | `CREATING` | `FAILED` | `AVAILABLE` | `UPDATING` | `PENDING_NETWORK_UPDATE` | `PENDING_TAG_ACCEPTANCE` | `DELETING` .",
|
|
36950
|
+
"UpdatedAt": "The timestamp when the transit gateway route table attachment was last updated."
|
|
36951
|
+
},
|
|
36952
|
+
"description": "Creates a transit gateway route table attachment.",
|
|
36953
|
+
"properties": {
|
|
36954
|
+
"PeeringId": "The ID of the transit gateway peering.",
|
|
36955
|
+
"ProposedSegmentChange": "This property is read-only. Values can't be assigned to it.",
|
|
36956
|
+
"Tags": "The list of key-value pairs associated with the transit gateway route table attachment.",
|
|
36957
|
+
"TransitGatewayRouteTableArn": "The ARN of the transit gateway attachment route table."
|
|
36958
|
+
}
|
|
36959
|
+
},
|
|
36960
|
+
"AWS::NetworkManager::TransitGatewayRouteTableAttachment.ProposedSegmentChange": {
|
|
36961
|
+
"attributes": {},
|
|
36962
|
+
"description": "Describes a proposed segment change. In some cases, the segment change must first be evaluated and accepted.",
|
|
36963
|
+
"properties": {
|
|
36964
|
+
"AttachmentPolicyRuleNumber": "The rule number in the policy document that applies to this change.",
|
|
36965
|
+
"SegmentName": "The name of the segment to change.",
|
|
36966
|
+
"Tags": "The list of key-value tags that changed for the segment."
|
|
36967
|
+
}
|
|
36968
|
+
},
|
|
36937
36969
|
"AWS::NetworkManager::VpcAttachment": {
|
|
36938
36970
|
"attributes": {
|
|
36939
36971
|
"AttachmentId": "The ID of the VPC attachment.",
|
|
@@ -38477,7 +38509,7 @@
|
|
|
38477
38509
|
"CustomDeliveryConfiguration": "The delivery configuration settings for sending the treatment through a custom channel. This object is required if the `MessageConfiguration` object for the treatment specifies a `CustomMessage` object.",
|
|
38478
38510
|
"Description": "A custom description of the campaign.",
|
|
38479
38511
|
"HoldoutPercent": "The allocated percentage of users (segment members) who shouldn't receive messages from the campaign.",
|
|
38480
|
-
"IsPaused": "Specifies whether to pause the campaign. A paused campaign doesn't run unless you resume it by changing this value to `false` . If you restart a campaign, the campaign restarts from the beginning and not at the point you paused it.",
|
|
38512
|
+
"IsPaused": "Specifies whether to pause the campaign. A paused campaign doesn't run unless you resume it by changing this value to `false` . If you restart a campaign, the campaign restarts from the beginning and not at the point you paused it. If a campaign is running it will complete and then pause. Pause only pauses or skips the next run for a recurring future scheduled campaign. A campaign scheduled for immediate can't be paused.",
|
|
38481
38513
|
"Limits": "The messaging limits for the campaign.",
|
|
38482
38514
|
"MessageConfiguration": "The message configuration settings for the campaign.",
|
|
38483
38515
|
"Name": "The name of the campaign.",
|
|
@@ -38717,7 +38749,7 @@
|
|
|
38717
38749
|
"description": "Specifies the name and version of the message template to use for the message.",
|
|
38718
38750
|
"properties": {
|
|
38719
38751
|
"Name": "The name of the message template to use for the message. If specified, this value must match the name of an existing message template.",
|
|
38720
|
-
"Version": "The unique identifier for the version of the message template to use for the message. If specified, this value must match the identifier for an existing template version. To retrieve a list of versions and version identifiers for a template, use the Template Versions resource.\n\nIf you don't specify a value for this property, Amazon Pinpoint uses the *active version* of the template. The *active version* is typically the version of a template that's been most recently reviewed and approved for use, depending on your workflow. It isn't necessarily the latest version of a template."
|
|
38752
|
+
"Version": "The unique identifier for the version of the message template to use for the message. If specified, this value must match the identifier for an existing template version. To retrieve a list of versions and version identifiers for a template, use the [Template Versions](https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-template-type-versions.html) resource.\n\nIf you don't specify a value for this property, Amazon Pinpoint uses the *active version* of the template. The *active version* is typically the version of a template that's been most recently reviewed and approved for use, depending on your workflow. It isn't necessarily the latest version of a template."
|
|
38721
38753
|
}
|
|
38722
38754
|
},
|
|
38723
38755
|
"AWS::Pinpoint::Campaign.TemplateConfiguration": {
|
|
@@ -39763,7 +39795,7 @@
|
|
|
39763
39795
|
"attributes": {},
|
|
39764
39796
|
"description": "The configuration settings of the Amazon Kinesis Data Streams destination for an Amazon QLDB journal stream.",
|
|
39765
39797
|
"properties": {
|
|
39766
|
-
"AggregationEnabled": "Enables QLDB to publish multiple data records in a single Kinesis Data Streams record, increasing the number of records sent per API call.\n\n
|
|
39798
|
+
"AggregationEnabled": "Enables QLDB to publish multiple data records in a single Kinesis Data Streams record, increasing the number of records sent per API call.\n\nDefault: `True`\n\nRecord aggregation has important implications for processing records and requires de-aggregation in your stream consumer. To learn more, see [KPL Key Concepts](https://docs.aws.amazon.com/streams/latest/dev/kinesis-kpl-concepts.html) and [Consumer De-aggregation](https://docs.aws.amazon.com/streams/latest/dev/kinesis-kpl-consumer-deaggregation.html) in the *Amazon Kinesis Data Streams Developer Guide* .",
|
|
39767
39799
|
"StreamArn": "The Amazon Resource Name (ARN) of the Kinesis Data Streams resource."
|
|
39768
39800
|
}
|
|
39769
39801
|
},
|
|
@@ -40923,7 +40955,7 @@
|
|
|
40923
40955
|
"EnableCloudwatchLogsExports": "The list of log types that need to be enabled for exporting to CloudWatch Logs. The values in the list depend on the DB engine being used. For more information, see [Publishing Database Logs to Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html#USER_LogAccess.Procedural.UploadtoCloudWatch) in the *Amazon Aurora User Guide* .\n\n*Aurora MySQL*\n\nValid values: `audit` , `error` , `general` , `slowquery`\n\n*Aurora PostgreSQL*\n\nValid values: `postgresql`\n\nValid for: Aurora DB clusters and Multi-AZ DB clusters",
|
|
40924
40956
|
"EnableHttpEndpoint": "A value that indicates whether to enable the HTTP endpoint for an Aurora Serverless DB cluster. By default, the HTTP endpoint is disabled.\n\nWhen enabled, the HTTP endpoint provides a connectionless web service API for running SQL queries on the Aurora Serverless DB cluster. You can also query your database from inside the RDS console with the query editor.\n\nFor more information, see [Using the Data API for Aurora Serverless](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.html) in the *Amazon Aurora User Guide* .\n\nValid for: Aurora DB clusters only",
|
|
40925
40957
|
"EnableIAMDatabaseAuthentication": "A value that indicates whether to enable mapping of AWS Identity and Access Management (IAM) accounts to database accounts. By default, mapping is disabled.\n\nFor more information, see [IAM Database Authentication](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html) in the *Amazon Aurora User Guide.*\n\nValid for: Aurora DB clusters only",
|
|
40926
|
-
"Engine": "The name of the database engine to be used for this DB cluster.\n\nValid Values:\n\n- `aurora` (for MySQL 5.6-compatible Aurora)\n- `aurora-mysql` (for MySQL 5.7-compatible Aurora)\n- `aurora-postgresql`\n- `mysql`\n- `postgres`\n\nValid for: Aurora DB clusters and Multi-AZ DB clusters",
|
|
40958
|
+
"Engine": "The name of the database engine to be used for this DB cluster.\n\nValid Values:\n\n- `aurora` (for MySQL 5.6-compatible Aurora)\n- `aurora-mysql` (for MySQL 5.7-compatible and MySQL 8.0-compatible Aurora)\n- `aurora-postgresql`\n- `mysql`\n- `postgres`\n\nValid for: Aurora DB clusters and Multi-AZ DB clusters",
|
|
40927
40959
|
"EngineMode": "The DB engine mode of the DB cluster, either `provisioned` , `serverless` , `parallelquery` , `global` , or `multimaster` .\n\nThe `parallelquery` engine mode isn't required for Aurora MySQL version 1.23 and higher 1.x versions, and version 2.09 and higher 2.x versions.\n\nThe `global` engine mode isn't required for Aurora MySQL version 1.22 and higher 1.x versions, and `global` engine mode isn't required for any 2.x versions.\n\nThe `multimaster` engine mode only applies for DB clusters created with Aurora MySQL version 5.6.10a.\n\nFor Aurora PostgreSQL, the `global` engine mode isn't required, and both the `parallelquery` and the `multimaster` engine modes currently aren't supported.\n\nLimitations and requirements apply to some DB engine modes. For more information, see the following sections in the *Amazon Aurora User Guide* :\n\n- [Limitations of Aurora Serverless](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.limitations)\n- [Limitations of Parallel Query](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-mysql-parallel-query.html#aurora-mysql-parallel-query-limitations)\n- [Limitations of Aurora Global Databases](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html#aurora-global-database.limitations)\n- [Limitations of Multi-Master Clusters](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-multi-master.html#aurora-multi-master-limitations)\n\nValid for: Aurora DB clusters only",
|
|
40928
40960
|
"EngineVersion": "The version number of the database engine to use.\n\nTo list all of the available engine versions for `aurora` (for MySQL 5.6-compatible Aurora), use the following command:\n\n`aws rds describe-db-engine-versions --engine aurora --query \"DBEngineVersions[].EngineVersion\"`\n\nTo list all of the available engine versions for `aurora-mysql` (for MySQL 5.7-compatible Aurora), use the following command:\n\n`aws rds describe-db-engine-versions --engine aurora-mysql --query \"DBEngineVersions[].EngineVersion\"`\n\nTo list all of the available engine versions for `aurora-postgresql` , use the following command:\n\n`aws rds describe-db-engine-versions --engine aurora-postgresql --query \"DBEngineVersions[].EngineVersion\"`\n\nValid for: Aurora DB clusters and Multi-AZ DB clusters",
|
|
40929
40961
|
"GlobalClusterIdentifier": "If you are configuring an Aurora global database cluster and want your Aurora DB cluster to be a secondary member in the global database cluster, specify the global cluster ID of the global database cluster. To define the primary database cluster of the global cluster, use the [AWS::RDS::GlobalCluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-globalcluster.html) resource.\n\nIf you aren't configuring a global database cluster, don't specify this property.\n\n> To remove the DB cluster from a global database cluster, specify an empty value for the `GlobalClusterIdentifier` property. \n\nFor information about Aurora global databases, see [Working with Amazon Aurora Global Databases](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html) in the *Amazon Aurora User Guide* .\n\nValid for: Aurora DB clusters only",
|
|
@@ -41014,7 +41046,7 @@
|
|
|
41014
41046
|
},
|
|
41015
41047
|
"description": "The `AWS::RDS::DBClusterParameterGroup` resource creates a new Amazon RDS DB cluster parameter group.\n\nFor information about configuring parameters for Amazon Aurora DB clusters, see [Working with parameter groups](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_WorkingWithParamGroups.html) in the *Amazon Aurora User Guide* .\n\n> If you apply a parameter group to a DB cluster, then its DB instances might need to reboot. This can result in an outage while the DB instances are rebooting.\n> \n> If you apply a change to parameter group associated with a stopped DB cluster, then the update stack waits until the DB cluster is started.",
|
|
41016
41048
|
"properties": {
|
|
41017
|
-
"DBClusterParameterGroupName": "The name of the DB cluster parameter group.\n\nConstraints:\n\n- Must not match the name of an existing DB cluster parameter group.\n\nIf you don't specify a value for `DBClusterParameterGroupName` property, a name is automatically created for the DB cluster
|
|
41049
|
+
"DBClusterParameterGroupName": "The name of the DB cluster parameter group.\n\nConstraints:\n\n- Must not match the name of an existing DB cluster parameter group.\n\nIf you don't specify a value for `DBClusterParameterGroupName` property, a name is automatically created for the DB cluster parameter group.\n\n> This value is stored as a lowercase string.",
|
|
41018
41050
|
"Description": "A friendly description for this DB cluster parameter group.",
|
|
41019
41051
|
"Family": "The DB cluster parameter group family name. A DB cluster parameter group can be associated with one and only one DB cluster parameter group family, and can be applied only to a DB cluster running a DB engine and engine version compatible with that DB cluster parameter group family.\n\n> The DB cluster parameter group family can't be changed when updating a DB cluster parameter group. \n\nTo list all of the available parameter group families, use the following command:\n\n`aws rds describe-db-engine-versions --query \"DBEngineVersions[].DBParameterGroupFamily\"`\n\nThe output contains duplicates.\n\nFor more information, see `[CreateDBClusterParameterGroup](https://docs.aws.amazon.com//AmazonRDS/latest/APIReference/API_CreateDBClusterParameterGroup.html)` .",
|
|
41020
41052
|
"Parameters": "Provides a list of parameters for the DB cluster parameter group.",
|
|
@@ -41023,8 +41055,8 @@
|
|
|
41023
41055
|
},
|
|
41024
41056
|
"AWS::RDS::DBInstance": {
|
|
41025
41057
|
"attributes": {
|
|
41026
|
-
"CertificateDetails.CAIdentifier": "",
|
|
41027
|
-
"CertificateDetails.ValidTill": "",
|
|
41058
|
+
"CertificateDetails.CAIdentifier": "The CA identifier of the CA certificate used for the DB instance's server certificate.",
|
|
41059
|
+
"CertificateDetails.ValidTill": "The expiration date of the DB instance’s server certificate.",
|
|
41028
41060
|
"DBInstanceArn": "The Amazon Resource Name (ARN) for the DB instance.",
|
|
41029
41061
|
"DBSystemId": "The Oracle system ID (Oracle SID) for a container database (CDB). The Oracle SID is also the name of the CDB.\n\nThis setting is valid for RDS Custom only.",
|
|
41030
41062
|
"DbiResourceId": "The AWS Region-unique, immutable identifier for the DB instance. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB instance is accessed.",
|
|
@@ -41068,7 +41100,7 @@
|
|
|
41068
41100
|
"Engine": "The name of the database engine that you want to use for this DB instance.\n\n> When you are creating a DB instance, the `Engine` property is required. \n\nValid Values:\n\n- `aurora` (for MySQL 5.6-compatible Aurora)\n- `aurora-mysql` (for MySQL 5.7-compatible Aurora)\n- `aurora-postgresql`\n- `custom-oracle-ee`\n- `custom-oracle-ee-cdb`\n- `custom-sqlserver-ee`\n- `custom-sqlserver-se`\n- `custom-sqlserver-web`\n- `mariadb`\n- `mysql`\n- `oracle-ee`\n- `oracle-ee-cdb`\n- `oracle-se2`\n- `oracle-se2-cdb`\n- `postgres`\n- `sqlserver-ee`\n- `sqlserver-se`\n- `sqlserver-ex`\n- `sqlserver-web`",
|
|
41069
41101
|
"EngineVersion": "The version number of the database engine to use.\n\nFor a list of valid engine versions, use the `DescribeDBEngineVersions` action.\n\nThe following are the database engines and links to information about the major and minor versions that are available with Amazon RDS. Not every database engine is available for every AWS Region.\n\n*Amazon Aurora*\n\nNot applicable. The version number of the database engine to be used by the DB instance is managed by the DB cluster.\n\n*MariaDB*\n\nSee [MariaDB on Amazon RDS Versions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MariaDB.html#MariaDB.Concepts.VersionMgmt) in the *Amazon RDS User Guide.*\n\n*Microsoft SQL Server*\n\nSee [Microsoft SQL Server Versions on Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html#SQLServer.Concepts.General.VersionSupport) in the *Amazon RDS User Guide.*\n\n*MySQL*\n\nSee [MySQL on Amazon RDS Versions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MySQL.html#MySQL.Concepts.VersionMgmt) in the *Amazon RDS User Guide.*\n\n*Oracle*\n\nSee [Oracle Database Engine Release Notes](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.PatchComposition.html) in the *Amazon RDS User Guide.*\n\n*PostgreSQL*\n\nSee [Supported PostgreSQL Database Versions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html#PostgreSQL.Concepts.General.DBVersions) in the *Amazon RDS User Guide.*",
|
|
41070
41102
|
"Iops": "The number of I/O operations per second (IOPS) that the database provisions. The value must be equal to or greater than 1000.\n\nIf you specify this property, you must follow the range of allowed ratios of your requested IOPS rate to the amount of storage that you allocate (IOPS to allocated storage). For example, you can provision an Oracle database instance with 1000 IOPS and 200 GiB of storage (a ratio of 5:1), or specify 2000 IOPS with 200 GiB of storage (a ratio of 10:1). For more information, see [Amazon RDS Provisioned IOPS Storage to Improve Performance](https://docs.aws.amazon.com/AmazonRDS/latest/DeveloperGuide/CHAP_Storage.html#USER_PIOPS) in the *Amazon RDS User Guide* .\n\n> If you specify `io1` for the `StorageType` property, then you must also specify the `Iops` property.",
|
|
41071
|
-
"KmsKeyId": "The ARN of the AWS KMS key that's used to encrypt the DB instance, such as `arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef` . If you enable the StorageEncrypted property but don't specify this property, AWS CloudFormation uses the default KMS key. If you specify this property, you must set the StorageEncrypted property to true.\n\nIf you specify the `SourceDBInstanceIdentifier` property, the value is inherited from the source DB instance if the read replica is created in the same region.\n\nIf you create an encrypted read replica in a different AWS Region, then you must specify a KMS key for the destination AWS Region. KMS encryption keys are specific to the region that they're created in, and you can't use encryption keys from one region in another region.\n\nIf you specify the `SnapshotIdentifier` property, the `StorageEncrypted` property value is inherited from the snapshot, and if the DB instance is encrypted, the specified `KmsKeyId` property is used.\n\nIf you specify `DBSecurityGroups` , AWS CloudFormation ignores this property. To specify both a security group and this property, you must use a VPC security group. For more information about Amazon RDS and VPC, see [Using Amazon RDS with Amazon VPC](https://docs.aws.amazon.com/
|
|
41103
|
+
"KmsKeyId": "The ARN of the AWS KMS key that's used to encrypt the DB instance, such as `arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef` . If you enable the StorageEncrypted property but don't specify this property, AWS CloudFormation uses the default KMS key. If you specify this property, you must set the StorageEncrypted property to true.\n\nIf you specify the `SourceDBInstanceIdentifier` property, the value is inherited from the source DB instance if the read replica is created in the same region.\n\nIf you create an encrypted read replica in a different AWS Region, then you must specify a KMS key for the destination AWS Region. KMS encryption keys are specific to the region that they're created in, and you can't use encryption keys from one region in another region.\n\nIf you specify the `SnapshotIdentifier` property, the `StorageEncrypted` property value is inherited from the snapshot, and if the DB instance is encrypted, the specified `KmsKeyId` property is used.\n\nIf you specify `DBSecurityGroups` , AWS CloudFormation ignores this property. To specify both a security group and this property, you must use a VPC security group. For more information about Amazon RDS and VPC, see [Using Amazon RDS with Amazon VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.html) in the *Amazon RDS User Guide* .\n\n*Amazon Aurora*\n\nNot applicable. The KMS key identifier is managed by the DB cluster.",
|
|
41072
41104
|
"LicenseModel": "License model information for this DB instance.\n\nValid values:\n\n- Aurora MySQL - `general-public-license`\n- Aurora PostgreSQL - `postgresql-license`\n- MariaDB - `general-public-license`\n- Microsoft SQL Server - `license-included`\n- MySQL - `general-public-license`\n- Oracle - `bring-your-own-license` or `license-included`\n- PostgreSQL - `postgresql-license`\n\n> If you've specified `DBSecurityGroups` and then you update the license model, AWS CloudFormation replaces the underlying DB instance. This will incur some interruptions to database availability.",
|
|
41073
41105
|
"ManageMasterUserPassword": "A value that indicates whether to manage the master user password with AWS Secrets Manager.\n\nFor more information, see [Password management with AWS Secrets Manager](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-secrets-manager.html) in the *Amazon RDS User Guide.*\n\nConstraints:\n\n- Can't manage the master user password with AWS Secrets Manager if `MasterUserPassword` is specified.",
|
|
41074
41106
|
"MasterUserPassword": "The password for the master user. The password can include any printable ASCII character except \"/\", \"\"\", or \"@\".\n\n*Amazon Aurora*\n\nNot applicable. The password for the master user is managed by the DB cluster.\n\n*MariaDB*\n\nConstraints: Must contain from 8 to 41 characters.\n\n*Microsoft SQL Server*\n\nConstraints: Must contain from 8 to 128 characters.\n\n*MySQL*\n\nConstraints: Must contain from 8 to 41 characters.\n\n*Oracle*\n\nConstraints: Must contain from 8 to 30 characters.\n\n*PostgreSQL*\n\nConstraints: Must contain from 8 to 128 characters.",
|
|
@@ -41082,7 +41114,7 @@
|
|
|
41082
41114
|
"NetworkType": "The network type of the DB instance.\n\nValid values:\n\n- `IPV4`\n- `DUAL`\n\nThe network type is determined by the `DBSubnetGroup` specified for the DB instance. A `DBSubnetGroup` can support only the IPv4 protocol or the IPv4 and IPv6 protocols ( `DUAL` ).\n\nFor more information, see [Working with a DB instance in a VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html) in the *Amazon RDS User Guide.*",
|
|
41083
41115
|
"OptionGroupName": "Indicates that the DB instance should be associated with the specified option group.\n\nPermanent options, such as the TDE option for Oracle Advanced Security TDE, can't be removed from an option group. Also, that option group can't be removed from a DB instance once it is associated with a DB instance.",
|
|
41084
41116
|
"PerformanceInsightsKMSKeyId": "The AWS KMS key identifier for encryption of Performance Insights data.\n\nThe KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.\n\nIf you do not specify a value for `PerformanceInsightsKMSKeyId` , then Amazon RDS uses your default KMS key. There is a default KMS key for your AWS account. Your AWS account has a different default KMS key for each AWS Region.\n\nFor information about enabling Performance Insights, see [EnablePerformanceInsights](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-enableperformanceinsights) .",
|
|
41085
|
-
"PerformanceInsightsRetentionPeriod": "The
|
|
41117
|
+
"PerformanceInsightsRetentionPeriod": "The number of days to retain Performance Insights data. The default is 7 days. The following values are valid:\n\n- 7\n- *month* * 31, where *month* is a number of months from 1-23\n- 731\n\nFor example, the following values are valid:\n\n- 93 (3 months * 31)\n- 341 (11 months * 31)\n- 589 (19 months * 31)\n- 731\n\nIf you specify a retention period such as 94, which isn't a valid value, RDS issues an error.\n\nThis setting doesn't apply to RDS Custom.",
|
|
41086
41118
|
"Port": "The port number on which the database accepts connections.\n\n*Amazon Aurora*\n\nNot applicable. The port number is managed by the DB cluster.",
|
|
41087
41119
|
"PreferredBackupWindow": "The daily time range during which automated backups are created if automated backups are enabled, using the `BackupRetentionPeriod` parameter. For more information, see [Backup Window](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow) in the *Amazon RDS User Guide.*\n\nConstraints:\n\n- Must be in the format `hh24:mi-hh24:mi` .\n- Must be in Universal Coordinated Time (UTC).\n- Must not conflict with the preferred maintenance window.\n- Must be at least 30 minutes.\n\n*Amazon Aurora*\n\nNot applicable. The daily time range for creating automated backups is managed by the DB cluster.",
|
|
41088
41120
|
"PreferredMaintenanceWindow": "The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).\n\nFormat: `ddd:hh24:mi-ddd:hh24:mi`\n\nThe default is a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week. To see the time blocks available, see [Adjusting the Preferred DB Instance Maintenance Window](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#AdjustingTheMaintenanceWindow) in the *Amazon RDS User Guide.*\n\n> This property applies when AWS CloudFormation initially creates the DB instance. If you use AWS CloudFormation to update the DB instance, those updates are applied immediately. \n\nConstraints: Minimum 30-minute window.",
|
|
@@ -41186,7 +41218,7 @@
|
|
|
41186
41218
|
"description": "Specifies the details of authentication used by a proxy to log in as a specific database user.",
|
|
41187
41219
|
"properties": {
|
|
41188
41220
|
"AuthScheme": "The type of authentication that the proxy uses for connections from the proxy to the underlying database.\n\nValid Values: `SECRETS`",
|
|
41189
|
-
"ClientPasswordAuthType": "",
|
|
41221
|
+
"ClientPasswordAuthType": "Specifies the details of authentication used by a proxy to log in as a specific database user.",
|
|
41190
41222
|
"Description": "A user-specified description about the authentication used by a proxy to log in as a specific database user.",
|
|
41191
41223
|
"IAMAuth": "Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy. The `ENABLED` value is valid only for proxies with RDS for Microsoft SQL Server.\n\nValid Values: `ENABLED | DISABLED | REQUIRED`",
|
|
41192
41224
|
"SecretArn": "The Amazon Resource Name (ARN) representing the secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager."
|
|
@@ -41206,7 +41238,7 @@
|
|
|
41206
41238
|
"Endpoint": "The custom endpoint for the RDS DB instance or Aurora DB cluster.",
|
|
41207
41239
|
"IsDefault": "A value that indicates whether this endpoint is the default endpoint for the associated DB proxy. Default DB proxy endpoints always have read/write capability. Other endpoints that you associate with the DB proxy can be either read/write or read-only.",
|
|
41208
41240
|
"Ref": "`Ref` returns the name of the DB proxy endpoint.",
|
|
41209
|
-
"TargetRole": "",
|
|
41241
|
+
"TargetRole": "A value that indicates whether the DB proxy endpoint can be used for read/write or read-only operations.",
|
|
41210
41242
|
"VpcId": "The VPC ID of the DB proxy endpoint."
|
|
41211
41243
|
},
|
|
41212
41244
|
"description": "The `AWS::RDS::DBProxyEndpoint` resource creates or updates a DB proxy endpoint. You can use custom proxy endpoints to access a proxy through a different VPC than the proxy's default VPC.\n\nFor more information about RDS Proxy, see [AWS::RDS::DBProxy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbproxy.html) .",
|
|
@@ -41459,8 +41491,8 @@
|
|
|
41459
41491
|
"LoggingProperties": "Specifies logging information, such as queries and connection attempts, for the specified Amazon Redshift cluster.",
|
|
41460
41492
|
"MaintenanceTrackName": "An optional parameter for the name of the maintenance track for the cluster. If you don't provide a maintenance track name, the cluster is assigned to the `current` track.",
|
|
41461
41493
|
"ManualSnapshotRetentionPeriod": "The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots.\n\nThe value must be either -1 or an integer between 1 and 3,653.",
|
|
41462
|
-
"MasterUserPassword": "The password associated with the admin user
|
|
41463
|
-
"MasterUsername": "The user name associated with the admin user
|
|
41494
|
+
"MasterUserPassword": "The password associated with the admin user for the cluster that is being created.\n\nConstraints:\n\n- Must be between 8 and 64 characters in length.\n- Must contain at least one uppercase letter.\n- Must contain at least one lowercase letter.\n- Must contain one number.\n- Can be any printable ASCII character (ASCII code 33-126) except `'` (single quote), `\"` (double quote), `\\` , `/` , or `@` .",
|
|
41495
|
+
"MasterUsername": "The user name associated with the admin user for the cluster that is being created.\n\nConstraints:\n\n- Must be 1 - 128 alphanumeric characters or hyphens. The user name can't be `PUBLIC` .\n- Must contain only lowercase letters, numbers, underscore, plus sign, period (dot), at symbol (@), or hyphen.\n- The first character must be a letter.\n- Must not contain a colon (:) or a slash (/).\n- Cannot be a reserved word. A list of reserved words can be found in [Reserved Words](https://docs.aws.amazon.com/redshift/latest/dg/r_pg_keywords.html) in the Amazon Redshift Database Developer Guide.",
|
|
41464
41496
|
"NodeType": "The node type to be provisioned for the cluster. For information about node types, go to [Working with Clusters](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#how-many-nodes) in the *Amazon Redshift Cluster Management Guide* .\n\nValid Values: `ds2.xlarge` | `ds2.8xlarge` | `dc1.large` | `dc1.8xlarge` | `dc2.large` | `dc2.8xlarge` | `ra3.xlplus` | `ra3.4xlarge` | `ra3.16xlarge`",
|
|
41465
41497
|
"NumberOfNodes": "The number of compute nodes in the cluster. This parameter is required when the *ClusterType* parameter is specified as `multi-node` .\n\nFor information about determining how many nodes you need, go to [Working with Clusters](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#how-many-nodes) in the *Amazon Redshift Cluster Management Guide* .\n\nIf you don't specify this parameter, you get a single-node cluster. When requesting a multi-node cluster, you must specify the number of nodes that you want in the cluster.\n\nDefault: `1`\n\nConstraints: Value must be at least 1 and no more than 100.",
|
|
41466
41498
|
"OwnerAccount": "The AWS account used to create or copy the snapshot. Required if you are restoring a snapshot you do not own, optional if you own the snapshot.",
|
|
@@ -41470,7 +41502,7 @@
|
|
|
41470
41502
|
"ResourceAction": "",
|
|
41471
41503
|
"RevisionTarget": "",
|
|
41472
41504
|
"RotateEncryptionKey": "",
|
|
41473
|
-
"SnapshotClusterIdentifier": "The name of the cluster the source snapshot was created from. This parameter is required if your IAM user has a policy containing a snapshot resource element that specifies anything other than * for the cluster name.",
|
|
41505
|
+
"SnapshotClusterIdentifier": "The name of the cluster the source snapshot was created from. This parameter is required if your IAM user or role has a policy containing a snapshot resource element that specifies anything other than * for the cluster name.",
|
|
41474
41506
|
"SnapshotCopyGrantName": "The name of the snapshot copy grant.",
|
|
41475
41507
|
"SnapshotCopyManual": "Indicates whether to apply the snapshot retention period to newly copied manual snapshots instead of automated snapshots.",
|
|
41476
41508
|
"SnapshotCopyRetentionPeriod": "The number of days to retain automated snapshots in the destination AWS Region after they are copied from the source AWS Region .\n\nBy default, this only changes the retention period of copied automated snapshots.\n\nIf you decrease the retention period for automated snapshots that are copied to a destination AWS Region , Amazon Redshift deletes any existing automated snapshots that were copied to the destination AWS Region and that fall outside of the new retention period.\n\nConstraints: Must be at least 1 and no more than 35 for automated snapshots.\n\nIf you specify the `manual` option, only newly copied manual snapshots will have the new retention period.\n\nIf you specify the value of -1 newly copied manual snapshots are retained indefinitely.\n\nConstraints: The number of days must be either -1 or an integer between 1 and 3,653 for manual snapshots.",
|
|
@@ -41497,13 +41529,13 @@
|
|
|
41497
41529
|
},
|
|
41498
41530
|
"AWS::Redshift::ClusterParameterGroup": {
|
|
41499
41531
|
"attributes": {
|
|
41500
|
-
"ParameterGroupName": "The name of the parameter group.",
|
|
41501
41532
|
"Ref": "`Ref` returns the resource name. For example:\n\n`{ \"Ref\": \"myClusterParameterGroup\" }`\n\nFor the Amazon Redshift cluster parameter group `myClusterParameterGroup` , `Ref` returns the name of the cluster parameter group."
|
|
41502
41533
|
},
|
|
41503
41534
|
"description": "Describes a parameter group.",
|
|
41504
41535
|
"properties": {
|
|
41505
41536
|
"Description": "The description of the parameter group.",
|
|
41506
41537
|
"ParameterGroupFamily": "The name of the cluster parameter group family that this cluster parameter group is compatible with.",
|
|
41538
|
+
"ParameterGroupName": "The name of the cluster parameter group.",
|
|
41507
41539
|
"Parameters": "An array of parameters to be modified. A maximum of 20 parameters can be modified in a single request.\n\nFor each parameter to be modified, you must supply at least the parameter name and parameter value; other name-value pairs of the parameter are optional.\n\nFor the workload management (WLM) configuration, you must supply all the name-value pairs in the wlm_json_configuration parameter.",
|
|
41508
41540
|
"Tags": "The list of tags for the cluster parameter group."
|
|
41509
41541
|
}
|
|
@@ -42053,10 +42085,10 @@
|
|
|
42053
42085
|
"AppArn": "The Amazon Resource Name (ARN) of the app.",
|
|
42054
42086
|
"Ref": "The returned Amazon Resource Name (ARN) for the app."
|
|
42055
42087
|
},
|
|
42056
|
-
"description": "Creates
|
|
42088
|
+
"description": "Creates an AWS Resilience Hub application. An AWS Resilience Hub application is a collection of AWS resources structured to prevent and recover AWS application disruptions. To describe a AWS Resilience Hub application, you provide an application name, resources from one or more–up to five– AWS CloudFormation stacks, and an appropriate resiliency policy.\n\nAfter you create an AWS Resilience Hub application, you publish it so that you can run a resiliency assessment on it. You can then use recommendations from the assessment to improve resiliency by running another assessment, comparing results, and then iterating the process until you achieve your goals for recovery time objective (RTO) and recovery point objective (RPO).",
|
|
42057
42089
|
"properties": {
|
|
42058
42090
|
"AppAssessmentSchedule": "Assessment execution schedule with 'Daily' or 'Disabled' values.",
|
|
42059
|
-
"AppTemplateBody": "A string containing a full Resilience Hub app template body.",
|
|
42091
|
+
"AppTemplateBody": "A string containing a full AWS Resilience Hub app template body.",
|
|
42060
42092
|
"Description": "The optional description for an app.",
|
|
42061
42093
|
"Name": "The name for the application.",
|
|
42062
42094
|
"ResiliencyPolicyArn": "The Amazon Resource Name (ARN) of the resiliency policy.",
|
|
@@ -42071,7 +42103,7 @@
|
|
|
42071
42103
|
"AwsAccountId": "The AWS account that owns the physical resource.",
|
|
42072
42104
|
"AwsRegion": "The AWS Region that the physical resource is located in.",
|
|
42073
42105
|
"Identifier": "The identifier of the physical resource.",
|
|
42074
|
-
"Type": "Specifies the type of physical resource identifier.\n\n- **Arn** - The resource identifier is an Amazon Resource Name (ARN) .\n- **Native** - The resource identifier is
|
|
42106
|
+
"Type": "Specifies the type of physical resource identifier.\n\n- **Arn** - The resource identifier is an Amazon Resource Name (ARN) .\n- **Native** - The resource identifier is an AWS Resilience Hub -native identifier."
|
|
42075
42107
|
}
|
|
42076
42108
|
},
|
|
42077
42109
|
"AWS::ResilienceHub::App.ResourceMapping": {
|
|
@@ -42656,12 +42688,12 @@
|
|
|
42656
42688
|
"AWS::Route53RecoveryControl::Cluster": {
|
|
42657
42689
|
"attributes": {
|
|
42658
42690
|
"ClusterArn": "The Amazon Resource Name (ARN) of the cluster.",
|
|
42691
|
+
"ClusterEndpoints": "Endpoints for the cluster.",
|
|
42659
42692
|
"Ref": "`Ref` returns the `ClusterArn` object.",
|
|
42660
42693
|
"Status": "Deployment status of a resource. Status can be one of the following: PENDING, DEPLOYED, PENDING_DELETION."
|
|
42661
42694
|
},
|
|
42662
42695
|
"description": "Returns an array of all the clusters in an account.",
|
|
42663
42696
|
"properties": {
|
|
42664
|
-
"ClusterEndpoints": "",
|
|
42665
42697
|
"Name": "Name of the cluster. You can use any non-white space character in the name.",
|
|
42666
42698
|
"Tags": "The value for a tag."
|
|
42667
42699
|
}
|
|
@@ -44457,7 +44489,7 @@
|
|
|
44457
44489
|
"Subscription": "The Amazon SNS subscriptions (endpoints) for this topic.",
|
|
44458
44490
|
"Tags": "The list of tags to add to a new topic.\n\n> To be able to tag a topic on creation, you must have the `sns:CreateTopic` and `sns:TagResource` permissions.",
|
|
44459
44491
|
"TopicName": "The name of the topic you want to create. Topic names must include only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 256 characters long. FIFO topic names must end with `.fifo` .\n\nIf you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the topic name. For more information, see [Name type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .\n\n> If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.",
|
|
44460
|
-
"TracingConfig": "Tracing mode of an Amazon SNS topic. By default `TracingConfig` is set to `PassThrough` , and the topic passes through the tracing header it receives from an SNS publisher to its subscriptions. If set to Active, SNS will vend X-Ray segment data to topic owner account if the sampled flag in the tracing header is true. Only supported on standard topics."
|
|
44492
|
+
"TracingConfig": "Tracing mode of an Amazon SNS topic. By default `TracingConfig` is set to `PassThrough` , and the topic passes through the tracing header it receives from an SNS publisher to its subscriptions. If set to `Active` , SNS will vend X-Ray segment data to topic owner account if the sampled flag in the tracing header is true. Only supported on standard topics."
|
|
44461
44493
|
}
|
|
44462
44494
|
},
|
|
44463
44495
|
"AWS::SNS::Topic.Subscription": {
|
|
@@ -47767,12 +47799,13 @@
|
|
|
47767
47799
|
"properties": {
|
|
47768
47800
|
"ExcludeCharacters": "A string of the characters that you don't want in the password.",
|
|
47769
47801
|
"KmsKeyArn": "The ARN of the KMS key that Secrets Manager uses to encrypt the secret. If you don't specify this value, then Secrets Manager uses the key `aws/secretsmanager` . If `aws/secretsmanager` doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.",
|
|
47770
|
-
"MasterSecretArn": "The ARN of the secret that contains
|
|
47771
|
-
"MasterSecretKmsKeyArn": "The ARN of the KMS key that Secrets Manager
|
|
47802
|
+
"MasterSecretArn": "The ARN of the secret that contains superuser credentials, if you use the [Alternating users rotation strategy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users) . CloudFormation grants the execution role for the Lambda rotation function `GetSecretValue` permission to the secret in this property. For more information, see [Lambda rotation function execution role permissions for Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html) .\n\nYou must create the superuser secret before you can set this property.\n\nYou must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see [JSON structure of Secrets Manager secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html) .\n\nYou can specify `MasterSecretArn` or `SuperuserSecretArn` but not both. They represent the same superuser secret.",
|
|
47803
|
+
"MasterSecretKmsKeyArn": "The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the [alternating users strategy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users) and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key `aws/secretsmanager` . CloudFormation grants the execution role for the Lambda rotation function `Decrypt` , `DescribeKey` , and `GenerateDataKey` permission to the key in this property. For more information, see [Lambda rotation function execution role permissions for Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html) .\n\nYou can specify `MasterSecretKmsKeyArn` or `SuperuserSecretKmsKeyArn` but not both. They represent the same superuser secret KMS key .",
|
|
47772
47804
|
"RotationLambdaName": "The name of the Lambda rotation function.",
|
|
47773
47805
|
"RotationType": "The rotation template to base the rotation function on, one of the following:\n\n- `MySQLSingleUser` to use the template [SecretsManagerRDSMySQLRotationSingleUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-mysql-singleuser) .\n- `MySQLMultiUser` to use the template [SecretsManagerRDSMySQLRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-mysql-multiuser) .\n- `PostgreSQLSingleUser` to use the template [SecretsManagerRDSPostgreSQLRotationSingleUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-postgre-singleuser)\n- `PostgreSQLMultiUser` to use the template [SecretsManagerRDSPostgreSQLRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-postgre-multiuser) .\n- `OracleSingleUser` to use the template [SecretsManagerRDSOracleRotationSingleUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-oracle-singleuser) .\n- `OracleMultiUser` to use the template [SecretsManagerRDSOracleRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-oracle-multiuser) .\n- `MariaDBSingleUser` to use the template [SecretsManagerRDSMariaDBRotationSingleUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-mariadb-singleuser) .\n- `MariaDBMultiUser` to use the template [SecretsManagerRDSMariaDBRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-mariadb-multiuser) .\n- `SQLServerSingleUser` to use the template [SecretsManagerRDSSQLServerRotationSingleUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-sqlserver-singleuser) .\n- `SQLServerMultiUser` to use the template [SecretsManagerRDSSQLServerRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-sqlserver-multiuser) .\n- `RedshiftSingleUser` to use the template [SecretsManagerRedshiftRotationSingleUsr](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-redshift-singleuser) .\n- `RedshiftMultiUser` to use the template [SecretsManagerRedshiftRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-redshift-multiuser) .\n- `MongoDBSingleUser` to use the template [SecretsManagerMongoDBRotationSingleUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-mongodb-singleuser) .\n- `MongoDBMultiUser` to use the template [SecretsManagerMongoDBRotationMultiUser](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-mongodb-multiuser) .",
|
|
47774
|
-
"
|
|
47775
|
-
"
|
|
47806
|
+
"Runtime": "The Python runtime version associated with the Lambda function.",
|
|
47807
|
+
"SuperuserSecretArn": "The ARN of the secret that contains superuser credentials, if you use the [Alternating users rotation strategy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users) . CloudFormation grants the execution role for the Lambda rotation function `GetSecretValue` permission to the secret in this property. For more information, see [Lambda rotation function execution role permissions for Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html) .\n\nYou must create the superuser secret before you can set this property.\n\nYou must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see [JSON structure of Secrets Manager secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html) .\n\nYou can specify `MasterSecretArn` or `SuperuserSecretArn` but not both. They represent the same superuser secret.",
|
|
47808
|
+
"SuperuserSecretKmsKeyArn": "The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the [alternating users strategy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users) and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key `aws/secretsmanager` . CloudFormation grants the execution role for the Lambda rotation function `Decrypt` , `DescribeKey` , and `GenerateDataKey` permission to the key in this property. For more information, see [Lambda rotation function execution role permissions for Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-required-permissions-function.html) .\n\nYou can specify `MasterSecretKmsKeyArn` or `SuperuserSecretKmsKeyArn` but not both. They represent the same superuser secret KMS key .",
|
|
47776
47809
|
"VpcSecurityGroupIds": "A comma-separated list of security group IDs applied to the target database.\n\nThe templates applies the same security groups as on the Lambda rotation function that is created as part of this stack.",
|
|
47777
47810
|
"VpcSubnetIds": "A comma separated list of VPC subnet IDs of the target database network. The Lambda rotation function is in the same subnet group."
|
|
47778
47811
|
}
|
|
@@ -49536,7 +49569,7 @@
|
|
|
49536
49569
|
"properties": {
|
|
49537
49570
|
"LogDestinationConfigs": "The logging destination configuration that you want to associate with the web ACL.\n\n> You can associate one logging destination to a web ACL.",
|
|
49538
49571
|
"LoggingFilter": "Filtering that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation.",
|
|
49539
|
-
"RedactedFields": "The parts of the request that you want to keep out of the logs. For example, if you redact the `SingleHeader` field, the `HEADER` field in the logs will be `
|
|
49572
|
+
"RedactedFields": "The parts of the request that you want to keep out of the logs. For example, if you redact the `SingleHeader` field, the `HEADER` field in the logs will be `REDACTED` .\n\n> You can specify only the following fields for redaction: `UriPath` , `QueryString` , `SingleHeader` , `Method` , and `JsonBody` .",
|
|
49540
49573
|
"ResourceArn": "The Amazon Resource Name (ARN) of the web ACL that you want to associate with `LogDestinationConfigs` ."
|
|
49541
49574
|
}
|
|
49542
49575
|
},
|
|
@@ -50517,7 +50550,7 @@
|
|
|
50517
50550
|
},
|
|
50518
50551
|
"description": "> This is the latest version of *AWS WAF* , named AWS WAF V2, released in November, 2019. For information, including how to migrate your AWS WAF resources from the prior release, see the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html) . \n\nUse a web ACL association to define an association between a web ACL and a regional application resource, to protect the resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, or an Amazon Cognito user pool.\n\nFor Amazon CloudFront , don't use this resource. Instead, use your CloudFront distribution configuration. To associate a web ACL with a distribution, provide the Amazon Resource Name (ARN) of the `WebACL` to your CloudFront distribution configuration. To disassociate a web ACL, provide an empty ARN. For information, see [AWS::CloudFront::Distribution](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html) .\n\nWhen you create a web ACL or make changes to a web ACL or web ACL components, like rules and rule groups, AWS WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an AWS resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.",
|
|
50519
50552
|
"properties": {
|
|
50520
|
-
"ResourceArn": "The Amazon Resource Name (ARN) of the resource to associate with the web ACL.\n\nThe ARN must be in one of the following formats:\n\n- For an Application Load Balancer: `arn:aws:elasticloadbalancing: *region* : *account-id* :loadbalancer/app/ *load-balancer-name* / *load-balancer-id*`\n- For an Amazon API Gateway REST API: `arn:aws:apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*`\n- For an AWS AppSync GraphQL API: `arn:aws:appsync: *region* : *account-id* :apis/ *GraphQLApiId*`\n- For an Amazon Cognito user pool: `arn:aws:cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*`",
|
|
50553
|
+
"ResourceArn": "The Amazon Resource Name (ARN) of the resource to associate with the web ACL.\n\nThe ARN must be in one of the following formats:\n\n- For an Application Load Balancer: `arn:aws:elasticloadbalancing: *region* : *account-id* :loadbalancer/app/ *load-balancer-name* / *load-balancer-id*`\n- For an Amazon API Gateway REST API: `arn:aws:apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*`\n- For an AWS AppSync GraphQL API: `arn:aws:appsync: *region* : *account-id* :apis/ *GraphQLApiId*`\n- For an Amazon Cognito user pool: `arn:aws:cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*`\n- For an AWS App Runner service: `arn:aws:apprunner: *region* : *account-id* :service/ *apprunner-service-name* / *apprunner-service-id*`",
|
|
50521
50554
|
"WebACLArn": "The Amazon Resource Name (ARN) of the web ACL that you want to associate with the resource."
|
|
50522
50555
|
}
|
|
50523
50556
|
},
|