cdk-docker-image-deployment 0.0.577 → 0.0.579

package/node_modules/aws-sdk/clients/networkfirewall.d.ts

@@ -52,11 +52,11 @@ declare class NetworkFirewall extends Service {
    */
   createRuleGroup(callback?: (err: AWSError, data: NetworkFirewall.Types.CreateRuleGroupResponse) => void): Request<NetworkFirewall.Types.CreateRuleGroupResponse, AWSError>;
   /**
-   * Creates an Network Firewall TLS inspection configuration. A TLS inspection configuration contains Certificate Manager certificate associations between and the scope configurations that Network Firewall uses to decrypt and re-encrypt traffic traveling through your firewall. After you create a TLS inspection configuration, you can associate it with a new firewall policy. To update the settings for a TLS inspection configuration, use UpdateTLSInspectionConfiguration. To manage a TLS inspection configuration's tags, use the standard Amazon Web Services resource tagging operations, ListTagsForResource, TagResource, and UntagResource. To retrieve information about TLS inspection configurations, use ListTLSInspectionConfigurations and DescribeTLSInspectionConfiguration.  For more information about TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide. 
+   * Creates an Network Firewall TLS inspection configuration. Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using ACM, create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. To update the settings for a TLS inspection configuration, use UpdateTLSInspectionConfiguration. To manage a TLS inspection configuration's tags, use the standard Amazon Web Services resource tagging operations, ListTagsForResource, TagResource, and UntagResource. To retrieve information about TLS inspection configurations, use ListTLSInspectionConfigurations and DescribeTLSInspectionConfiguration.  For more information about TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide. 
    */
   createTLSInspectionConfiguration(params: NetworkFirewall.Types.CreateTLSInspectionConfigurationRequest, callback?: (err: AWSError, data: NetworkFirewall.Types.CreateTLSInspectionConfigurationResponse) => void): Request<NetworkFirewall.Types.CreateTLSInspectionConfigurationResponse, AWSError>;
   /**
-   * Creates an Network Firewall TLS inspection configuration. A TLS inspection configuration contains Certificate Manager certificate associations between and the scope configurations that Network Firewall uses to decrypt and re-encrypt traffic traveling through your firewall. After you create a TLS inspection configuration, you can associate it with a new firewall policy. To update the settings for a TLS inspection configuration, use UpdateTLSInspectionConfiguration. To manage a TLS inspection configuration's tags, use the standard Amazon Web Services resource tagging operations, ListTagsForResource, TagResource, and UntagResource. To retrieve information about TLS inspection configurations, use ListTLSInspectionConfigurations and DescribeTLSInspectionConfiguration.  For more information about TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide. 
+   * Creates an Network Firewall TLS inspection configuration. Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using ACM, create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. To update the settings for a TLS inspection configuration, use UpdateTLSInspectionConfiguration. To manage a TLS inspection configuration's tags, use the standard Amazon Web Services resource tagging operations, ListTagsForResource, TagResource, and UntagResource. To retrieve information about TLS inspection configurations, use ListTLSInspectionConfigurations and DescribeTLSInspectionConfiguration.  For more information about TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide. 
    */
   createTLSInspectionConfiguration(callback?: (err: AWSError, data: NetworkFirewall.Types.CreateTLSInspectionConfigurationResponse) => void): Request<NetworkFirewall.Types.CreateTLSInspectionConfigurationResponse, AWSError>;
   /**
@@ -1305,22 +1305,22 @@ declare namespace NetworkFirewall {
   }
   export interface LogDestinationConfig {
     /**
-     * The type of log to send. Alert logs report traffic that matches a StatefulRule with an action setting that sends an alert log message. Flow logs are standard network traffic flow logs. 
+     * The type of log to record. You can record the following types of logs from your Network Firewall stateful engine.    ALERT - Logs for traffic that matches your stateful rules and that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP, ALERT, and REJECT. For more information, see StatefulRule.    FLOW - Standard network traffic flow logs. The stateful rules engine records flow logs for all network traffic that it receives. Each flow log record captures the network flow for a specific standard stateless rule group.    TLS - Logs for events that are related to TLS inspection. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.  
      */
     LogType: LogType;
     /**
-     * The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket, a CloudWatch log group, or a Kinesis Data Firehose delivery stream.
+     * The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket, a CloudWatch log group, or a Firehose delivery stream.
      */
     LogDestinationType: LogDestinationType;
     /**
-     * The named location for the logs, provided in a key:value mapping that is specific to the chosen destination type.    For an Amazon S3 bucket, provide the name of the bucket, with key bucketName, and optionally provide a prefix, with key prefix. The following example specifies an Amazon S3 bucket named DOC-EXAMPLE-BUCKET and the prefix alerts:   "LogDestination": { "bucketName": "DOC-EXAMPLE-BUCKET", "prefix": "alerts" }    For a CloudWatch log group, provide the name of the CloudWatch log group, with key logGroup. The following example specifies a log group named alert-log-group:   "LogDestination": { "logGroup": "alert-log-group" }    For a Kinesis Data Firehose delivery stream, provide the name of the delivery stream, with key deliveryStream. The following example specifies a delivery stream named alert-delivery-stream:   "LogDestination": { "deliveryStream": "alert-delivery-stream" }   
+     * The named location for the logs, provided in a key:value mapping that is specific to the chosen destination type.    For an Amazon S3 bucket, provide the name of the bucket, with key bucketName, and optionally provide a prefix, with key prefix.  The following example specifies an Amazon S3 bucket named DOC-EXAMPLE-BUCKET and the prefix alerts:   "LogDestination": { "bucketName": "DOC-EXAMPLE-BUCKET", "prefix": "alerts" }    For a CloudWatch log group, provide the name of the CloudWatch log group, with key logGroup. The following example specifies a log group named alert-log-group:   "LogDestination": { "logGroup": "alert-log-group" }    For a Firehose delivery stream, provide the name of the delivery stream, with key deliveryStream. The following example specifies a delivery stream named alert-delivery-stream:   "LogDestination": { "deliveryStream": "alert-delivery-stream" }   
      */
     LogDestination: LogDestinationMap;
   }
   export type LogDestinationConfigs = LogDestinationConfig[];
   export type LogDestinationMap = {[key: string]: HashMapValue};
   export type LogDestinationType = "S3"|"CloudWatchLogs"|"KinesisDataFirehose"|string;
-  export type LogType = "ALERT"|"FLOW"|string;
+  export type LogType = "ALERT"|"FLOW"|"TLS"|string;
   export interface LoggingConfiguration {
     /**
      * Defines the logging destinations for the logs for a firewall. Network Firewall generates logs for stateful rule groups. 
@@ -1666,7 +1666,7 @@ declare namespace NetworkFirewall {
   }
   export interface StatefulRule {
     /**
-     * Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.  The actions for a stateful rule are defined as follows:     PASS - Permits the packets to go to the intended destination.    DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration.     ALERT - Sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration.  You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP.  
+     * Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.  The actions for a stateful rule are defined as follows:     PASS - Permits the packets to go to the intended destination.    DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration.     ALERT - Sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration.  You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP.    REJECT - Drops traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and an RST bit contained in the TCP header flags. REJECT is available only for TCP traffic. This option doesn't support FTP or IMAP protocols.  
      */
     Action: StatefulAction;
     /**

package/node_modules/aws-sdk/clients/networkmanager.d.ts

@@ -862,6 +862,10 @@ declare namespace NetworkManager {
      * The name of the segment attachment.
      */
     SegmentName?: ConstrainedString;
+    /**
+     * The name of the network function group.
+     */
+    NetworkFunctionGroupName?: NetworkFunctionGroupName;
     /**
      * The tags associated with the attachment.
      */
@@ -870,6 +874,10 @@ declare namespace NetworkManager {
      * The attachment to move from one segment to another.
      */
     ProposedSegmentChange?: ProposedSegmentChange;
+    /**
+     * Describes a proposed change to a network function group associated with the attachment.
+     */
+    ProposedNetworkFunctionGroupChange?: ProposedNetworkFunctionGroupChange;
     /**
      * The timestamp when the attachment was created.
      */
@@ -878,7 +886,31 @@ declare namespace NetworkManager {
      * The timestamp when the attachment was last updated.
      */
     UpdatedAt?: DateTime;
+    /**
+     * Describes the error associated with the attachment request.
+     */
+    LastModificationErrors?: AttachmentErrorList;
   }
+  export interface AttachmentError {
+    /**
+     * The error code for the attachment request. 
+     */
+    Code?: AttachmentErrorCode;
+    /**
+     * The message associated with the error code.
+     */
+    Message?: ServerSideString;
+    /**
+     * The ARN of the requested attachment resource.
+     */
+    ResourceArn?: ResourceArn;
+    /**
+     * The ID of the attachment request.
+     */
+    RequestId?: ServerSideString;
+  }
+  export type AttachmentErrorCode = "VPC_NOT_FOUND"|"SUBNET_NOT_FOUND"|"SUBNET_DUPLICATED_IN_AVAILABILITY_ZONE"|"SUBNET_NO_FREE_ADDRESSES"|"SUBNET_UNSUPPORTED_AVAILABILITY_ZONE"|"SUBNET_NO_IPV6_CIDRS"|"VPN_CONNECTION_NOT_FOUND"|"MAXIMUM_NO_ENCAP_LIMIT_EXCEEDED"|string;
+  export type AttachmentErrorList = AttachmentError[];
   export type AttachmentId = string;
   export type AttachmentList = Attachment[];
   export type AttachmentState = "REJECTED"|"PENDING_ATTACHMENT_ACCEPTANCE"|"CREATING"|"FAILED"|"AVAILABLE"|"UPDATING"|"PENDING_NETWORK_UPDATE"|"PENDING_TAG_ACCEPTANCE"|"DELETING"|string;
@@ -903,7 +935,7 @@ declare namespace NetworkManager {
   export type ChangeAction = "ADD"|"MODIFY"|"REMOVE"|string;
   export type ChangeSetState = "PENDING_GENERATION"|"FAILED_GENERATION"|"READY_TO_EXECUTE"|"EXECUTING"|"EXECUTION_SUCCEEDED"|"OUT_OF_DATE"|string;
   export type ChangeStatus = "NOT_STARTED"|"IN_PROGRESS"|"COMPLETE"|"FAILED"|string;
-  export type ChangeType = "CORE_NETWORK_SEGMENT"|"CORE_NETWORK_EDGE"|"ATTACHMENT_MAPPING"|"ATTACHMENT_ROUTE_PROPAGATION"|"ATTACHMENT_ROUTE_STATIC"|"CORE_NETWORK_CONFIGURATION"|"SEGMENTS_CONFIGURATION"|"SEGMENT_ACTIONS_CONFIGURATION"|"ATTACHMENT_POLICIES_CONFIGURATION"|string;
+  export type ChangeType = "CORE_NETWORK_SEGMENT"|"NETWORK_FUNCTION_GROUP"|"CORE_NETWORK_EDGE"|"ATTACHMENT_MAPPING"|"ATTACHMENT_ROUTE_PROPAGATION"|"ATTACHMENT_ROUTE_STATIC"|"CORE_NETWORK_CONFIGURATION"|"SEGMENTS_CONFIGURATION"|"SEGMENT_ACTIONS_CONFIGURATION"|"ATTACHMENT_POLICIES_CONFIGURATION"|string;
   export type ClientToken = string;
   export interface ConnectAttachment {
     /**
@@ -959,9 +991,13 @@ declare namespace NetworkManager {
      */
     Tags?: TagList;
     /**
-     * The subnet ARN for the Connect peer.
+     * The subnet ARN for the Connect peer. This only applies only when the protocol is NO_ENCAP.
      */
     SubnetArn?: SubnetArn;
+    /**
+     * Describes the error associated with the attachment request.
+     */
+    LastModificationErrors?: ConnectPeerErrorList;
   }
   export interface ConnectPeerAssociation {
     /**
@@ -1028,6 +1064,26 @@ declare namespace NetworkManager {
      */
     BgpConfigurations?: ConnectPeerBgpConfigurationList;
   }
+  export interface ConnectPeerError {
+    /**
+     * The error code for the Connect peer request.
+     */
+    Code?: ConnectPeerErrorCode;
+    /**
+     * The message associated with the error code.
+     */
+    Message?: ServerSideString;
+    /**
+     * The ARN of the requested Connect peer resource.
+     */
+    ResourceArn?: ResourceArn;
+    /**
+     * The ID of the Connect peer request.
+     */
+    RequestId?: ServerSideString;
+  }
+  export type ConnectPeerErrorCode = "EDGE_LOCATION_NO_FREE_IPS"|"EDGE_LOCATION_PEER_DUPLICATE"|"SUBNET_NOT_FOUND"|"IP_OUTSIDE_SUBNET_CIDR_RANGE"|"INVALID_INSIDE_CIDR_BLOCK"|"NO_ASSOCIATED_CIDR_BLOCK"|string;
+  export type ConnectPeerErrorList = ConnectPeerError[];
   export type ConnectPeerId = string;
   export type ConnectPeerIdList = ConnectPeerId[];
   export type ConnectPeerState = "CREATING"|"FAILED"|"AVAILABLE"|"DELETING"|string;
@@ -1164,6 +1220,10 @@ declare namespace NetworkManager {
      * The segments within a core network.
      */
     Segments?: CoreNetworkSegmentList;
+    /**
+     * The network function groups associated with a core network.
+     */
+    NetworkFunctionGroups?: CoreNetworkNetworkFunctionGroupList;
     /**
      * The edges within a core network.
      */
@@ -1236,6 +1296,10 @@ declare namespace NetworkManager {
      * The segment name if the change event is associated with a segment.
      */
     SegmentName?: ConstrainedString;
+    /**
+     * The changed network function group name.
+     */
+    NetworkFunctionGroupName?: ConstrainedString;
     /**
      * The ID of the attachment if the change event is associated with an attachment. 
      */
@@ -1251,6 +1315,10 @@ declare namespace NetworkManager {
      * The names of the segments in a core network.
      */
     SegmentName?: ConstrainedString;
+    /**
+     * The network function group name if the change event is associated with a network function group.
+     */
+    NetworkFunctionGroupName?: ConstrainedString;
     /**
      * The Regions where edges are located in a core network. 
      */
@@ -1275,6 +1343,10 @@ declare namespace NetworkManager {
      * The shared segments for a core network change value. 
      */
     SharedSegments?: ConstrainedStringList;
+    /**
+     * Describes the service insertion action. 
+     */
+    ServiceInsertionActions?: ServiceInsertionActionList;
   }
   export interface CoreNetworkEdge {
     /**
@@ -1292,6 +1364,35 @@ declare namespace NetworkManager {
   }
   export type CoreNetworkEdgeList = CoreNetworkEdge[];
   export type CoreNetworkId = string;
+  export interface CoreNetworkNetworkFunctionGroup {
+    /**
+     * The name of the network function group.
+     */
+    Name?: ConstrainedString;
+    /**
+     * The core network edge locations.
+     */
+    EdgeLocations?: ExternalRegionCodeList;
+    /**
+     * The segments associated with the network function group.
+     */
+    Segments?: ServiceInsertionSegments;
+  }
+  export interface CoreNetworkNetworkFunctionGroupIdentifier {
+    /**
+     * The ID of the core network.
+     */
+    CoreNetworkId?: CoreNetworkId;
+    /**
+     * The network function group name.
+     */
+    NetworkFunctionGroupName?: ConstrainedString;
+    /**
+     * The location for the core network edge.
+     */
+    EdgeLocation?: ExternalRegionCode;
+  }
+  export type CoreNetworkNetworkFunctionGroupList = CoreNetworkNetworkFunctionGroup[];
   export interface CoreNetworkPolicy {
     /**
      * The ID of a core network.
@@ -1469,7 +1570,7 @@ declare namespace NetworkManager {
      */
     ConnectAttachmentId: AttachmentId;
     /**
-     * A Connect peer core network address.
+     * A Connect peer core network address. This only applies only when the protocol is GRE.
      */
     CoreNetworkAddress?: IPAddress;
     /**
@@ -1477,7 +1578,7 @@ declare namespace NetworkManager {
      */
     PeerAddress: IPAddress;
     /**
-     * The Connect peer BGP options.
+     * The Connect peer BGP options. This only applies only when the protocol is GRE.
      */
     BgpOptions?: BgpOptions;
     /**
@@ -1493,7 +1594,7 @@ declare namespace NetworkManager {
      */
     ClientToken?: ClientToken;
     /**
-     * The subnet ARN for the Connect peer.
+     * The subnet ARN for the Connect peer. This only applies only when the protocol is NO_ENCAP.
      */
     SubnetArn?: SubnetArn;
   }
@@ -2141,6 +2242,18 @@ declare namespace NetworkManager {
      */
     TransitGatewayConnectPeerAssociation?: TransitGatewayConnectPeerAssociation;
   }
+  export interface EdgeOverride {
+    /**
+     * The list of edge locations.
+     */
+    EdgeSets?: EdgeSetList;
+    /**
+     * The edge that should be used when overriding the current edge order.
+     */
+    UseEdge?: ConstrainedString;
+  }
+  export type EdgeSet = ConstrainedString[];
+  export type EdgeSetList = EdgeSet[];
   export interface ExecuteCoreNetworkChangeSetRequest {
     /**
      * The ID of a core network.
@@ -2469,7 +2582,7 @@ declare namespace NetworkManager {
      */
     GlobalNetworkId: GlobalNetworkId;
     /**
-     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    connection     device     link     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
+     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    attachment     connect-peer     connection     core-network     device     link     peering     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
      */
     ResourceType?: ConstrainedString;
     /**
@@ -2513,7 +2626,7 @@ declare namespace NetworkManager {
      */
     AccountId?: AWSAccountId;
     /**
-     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    connection     device     link     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
+     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    attachment     connect-peer     connection     core-network     device     link     peering     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
      */
     ResourceType?: ConstrainedString;
     /**
@@ -2561,7 +2674,7 @@ declare namespace NetworkManager {
      */
     AccountId?: AWSAccountId;
     /**
-     * The resource type. The following are the supported resource types for Direct Connect:    dxcon - The definition model is Connection.    dx-gateway - The definition model is DirectConnectGateway.    dx-vif - The definition model is VirtualInterface.   The following are the supported resource types for Network Manager:    connection - The definition model is Connection.    device - The definition model is Device.    link - The definition model is Link.    site - The definition model is Site.   The following are the supported resource types for Amazon VPC:    customer-gateway - The definition model is CustomerGateway.    transit-gateway - The definition model is TransitGateway.    transit-gateway-attachment - The definition model is TransitGatewayAttachment.    transit-gateway-connect-peer - The definition model is TransitGatewayConnectPeer.    transit-gateway-route-table - The definition model is TransitGatewayRouteTable.    vpn-connection - The definition model is VpnConnection.  
+     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    attachment     connect-peer     connection     core-network     device     link     peering     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
      */
     ResourceType?: ConstrainedString;
     /**
@@ -2673,7 +2786,7 @@ declare namespace NetworkManager {
      */
     AccountId?: AWSAccountId;
     /**
-     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    connection     device     link     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
+     * The resource type. The following are the supported resource types:    connect-peer     transit-gateway-connect-peer     vpn-connection   
      */
     ResourceType?: ConstrainedString;
     /**
@@ -3155,6 +3268,14 @@ declare namespace NetworkManager {
   }
   export type Long = number;
   export type MaxResults = number;
+  export interface NetworkFunctionGroup {
+    /**
+     * The name of the network function group.
+     */
+    Name?: ConstrainedString;
+  }
+  export type NetworkFunctionGroupList = NetworkFunctionGroup[];
+  export type NetworkFunctionGroupName = string;
   export interface NetworkResource {
     /**
      * The ARN of the gateway.
@@ -3173,7 +3294,7 @@ declare namespace NetworkManager {
      */
     AccountId?: AWSAccountId;
     /**
-     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    connection     device     link     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
+     * The resource type. The following are the supported resource types for Direct Connect:    dxcon     dx-gateway     dx-vif    The following are the supported resource types for Network Manager:    attachment     connect-peer     connection     core-network     device     link     peering     site    The following are the supported resource types for Amazon VPC:    customer-gateway     transit-gateway     transit-gateway-attachment     transit-gateway-connect-peer     transit-gateway-route-table     vpn-connection   
      */
     ResourceType?: ConstrainedString;
     /**
@@ -3275,6 +3396,10 @@ declare namespace NetworkManager {
      * The name of the segment.
      */
     SegmentName?: ConstrainedString;
+    /**
+     * The network function group name associated with the destination.
+     */
+    NetworkFunctionGroupName?: ConstrainedString;
     /**
      * The edge location for the network destination.
      */
@@ -3406,11 +3531,59 @@ declare namespace NetworkManager {
      * The timestamp when the attachment peer was created.
      */
     CreatedAt?: DateTime;
+    /**
+     * Describes the error associated with the Connect peer request.
+     */
+    LastModificationErrors?: PeeringErrorList;
   }
+  export interface PeeringError {
+    /**
+     * The error code for the peering request.
+     */
+    Code?: PeeringErrorCode;
+    /**
+     * The message associated with the error code.
+     */
+    Message?: ServerSideString;
+    /**
+     * The ARN of the requested peering resource.
+     */
+    ResourceArn?: ResourceArn;
+    /**
+     * The ID of the Peering request.
+     */
+    RequestId?: ServerSideString;
+    /**
+     * Provides additional information about missing permissions for the peering error.
+     */
+    MissingPermissionsContext?: PermissionsErrorContext;
+  }
+  export type PeeringErrorCode = "TRANSIT_GATEWAY_NOT_FOUND"|"TRANSIT_GATEWAY_PEERS_LIMIT_EXCEEDED"|"MISSING_PERMISSIONS"|"INTERNAL_ERROR"|"EDGE_LOCATION_PEER_DUPLICATE"|"INVALID_TRANSIT_GATEWAY_STATE"|string;
+  export type PeeringErrorList = PeeringError[];
   export type PeeringId = string;
   export type PeeringList = Peering[];
   export type PeeringState = "CREATING"|"FAILED"|"AVAILABLE"|"DELETING"|string;
   export type PeeringType = "TRANSIT_GATEWAY"|string;
+  export interface PermissionsErrorContext {
+    /**
+     * The missing permissions.
+     */
+    MissingPermission?: ServerSideString;
+  }
+  export interface ProposedNetworkFunctionGroupChange {
+    /**
+     * The list of proposed changes to the key-value tags associated with the network function group.
+     */
+    Tags?: TagList;
+    /**
+     * The proposed new attachment policy rule number for the network function group.
+     */
+    AttachmentPolicyRuleNumber?: Integer;
+    /**
+     * The proposed name change for the network function group name.
+     */
+    NetworkFunctionGroupName?: ConstrainedString;
+  }
   export interface ProposedSegmentChange {
     /**
      * The list of key-value tags that changed for the segment.
@@ -3633,12 +3806,47 @@ declare namespace NetworkManager {
      * The segment edge in a core network.
      */
     CoreNetworkSegmentEdge?: CoreNetworkSegmentEdgeIdentifier;
+    /**
+     * The route table identifier associated with the network function group.
+     */
+    CoreNetworkNetworkFunctionGroup?: CoreNetworkNetworkFunctionGroupIdentifier;
   }
-  export type RouteTableType = "TRANSIT_GATEWAY_ROUTE_TABLE"|"CORE_NETWORK_SEGMENT"|string;
+  export type RouteTableType = "TRANSIT_GATEWAY_ROUTE_TABLE"|"CORE_NETWORK_SEGMENT"|"NETWORK_FUNCTION_GROUP"|string;
   export type RouteType = "PROPAGATED"|"STATIC"|string;
   export type RouteTypeList = RouteType[];
   export type SLRDeploymentStatus = string;
+  export type SegmentActionServiceInsertion = "send-via"|"send-to"|string;
+  export type SendViaMode = "dual-hop"|"single-hop"|string;
   export type ServerSideString = string;
+  export interface ServiceInsertionAction {
+    /**
+     * The action the service insertion takes for traffic. send-via sends east-west traffic between attachments. send-to sends north-south traffic to the security appliance, and then from that to either the Internet or to an on-premesis location. 
+     */
+    Action?: SegmentActionServiceInsertion;
+    /**
+     * Describes the mode packets take for the send-via action. This is not used when the action is send-to. dual-hop packets traverse attachments in both the source to the destination core network edges. This mode requires that an inspection attachment must be present in all Regions of the service insertion-enabled segments. For single-hop, packets traverse a single intermediate inserted attachment. You can use EdgeOverride to specify a specific edge to use. 
+     */
+    Mode?: SendViaMode;
+    /**
+     * The list of destination segments if the service insertion action is send-via.
+     */
+    WhenSentTo?: WhenSentTo;
+    /**
+     * The list of network function groups and any edge overrides for the chosen service insertion action. Used for both send-to or send-via.
+     */
+    Via?: Via;
+  }
+  export type ServiceInsertionActionList = ServiceInsertionAction[];
+  export interface ServiceInsertionSegments {
+    /**
+     * The list of segments associated with the send-via action.
+     */
+    SendVia?: ConstrainedStringList;
+    /**
+     * The list of segments associated with the send-to action.
+     */
+    SendTo?: ConstrainedStringList;
+  }
   export interface Site {
     /**
      * The ID of the site.
@@ -4061,6 +4269,16 @@ declare namespace NetworkManager {
      */
     VpcAttachment?: VpcAttachment;
   }
+  export interface Via {
+    /**
+     * The list of network function groups associated with the service insertion action.
+     */
+    NetworkFunctionGroups?: NetworkFunctionGroupList;
+    /**
+     * Describes any edge overrides. An edge override is a specific edge to be used for traffic.
+     */
+    WithEdgeOverrides?: WithEdgeOverridesList;
+  }
   export type VpcArn = string;
   export interface VpcAttachment {
     /**
@@ -4087,6 +4305,14 @@ declare namespace NetworkManager {
     ApplianceModeSupport?: Boolean;
   }
   export type VpnConnectionArn = string;
+  export interface WhenSentTo {
+    /**
+     * The list of destination segments when the service insertion action is send-to.
+     */
+    WhenSentToSegmentsList?: WhenSentToSegmentsList;
+  }
+  export type WhenSentToSegmentsList = ConstrainedString[];
+  export type WithEdgeOverridesList = EdgeOverride[];
   /**
    * A string in YYYY-MM-DD format that represents the latest possible API version that can be used in this service. Specify 'latest' to use the latest possible version.
    */