cdk-rds-sql 1.3.1 → 2.0.0

package/node_modules/aws-sdk/clients/appsync.d.ts

@@ -155,6 +155,14 @@ declare class AppSync extends Service {
    * Removes an ApiAssociation object from a custom domain.
    */
   disassociateApi(callback?: (err: AWSError, data: AppSync.Types.DisassociateApiResponse) => void): Request<AppSync.Types.DisassociateApiResponse, AWSError>;
+  /**
+   * Evaluates the given code and returns the response. The code definition requirements depend on the specified runtime. For APPSYNC_JS runtimes, the code defines the request and response functions. The request function takes the incoming request after a GraphQL operation is parsed and converts it into a request configuration for the selected data source operation. The response function interprets responses from the data source and maps it to the shape of the GraphQL field output type. 
+   */
+  evaluateCode(params: AppSync.Types.EvaluateCodeRequest, callback?: (err: AWSError, data: AppSync.Types.EvaluateCodeResponse) => void): Request<AppSync.Types.EvaluateCodeResponse, AWSError>;
+  /**
+   * Evaluates the given code and returns the response. The code definition requirements depend on the specified runtime. For APPSYNC_JS runtimes, the code defines the request and response functions. The request function takes the incoming request after a GraphQL operation is parsed and converts it into a request configuration for the selected data source operation. The response function interprets responses from the data source and maps it to the shape of the GraphQL field output type. 
+   */
+  evaluateCode(callback?: (err: AWSError, data: AppSync.Types.EvaluateCodeResponse) => void): Request<AppSync.Types.EvaluateCodeResponse, AWSError>;
   /**
    * Evaluates a given template and returns the response. The mapping template can be a request or response template. Request templates take the incoming request after a GraphQL operation is parsed and convert it into a request configuration for the selected data source operation. Response templates interpret responses from the data source and map it to the shape of the GraphQL field output type. Mapping templates are written in the Apache Velocity Template Language (VTL).
    */
@@ -498,6 +506,16 @@ declare namespace AppSync {
     deletes?: Long;
   }
   export type ApiKeys = ApiKey[];
+  export interface AppSyncRuntime {
+    /**
+     * The name of the runtime to use. Currently, the only allowed value is APPSYNC_JS.
+     */
+    name: RuntimeName;
+    /**
+     * The version of the runtime to use. Currently, the only allowed version is 1.0.0.
+     */
+    runtimeVersion: String;
+  }
   export interface AssociateApiRequest {
     /**
      * The domain name.
@@ -552,6 +570,39 @@ declare namespace AppSync {
   }
   export type CachingKeys = String[];
   export type CertificateArn = string;
+  export type Code = string;
+  export interface CodeError {
+    /**
+     * The type of code error.  Examples include, but aren't limited to: LINT_ERROR, PARSER_ERROR.
+     */
+    errorType?: String;
+    /**
+     * A user presentable error. Examples include, but aren't limited to: Parsing error: Unterminated string literal.
+     */
+    value?: String;
+    /**
+     * The line, column, and span location of the error in the code.
+     */
+    location?: CodeErrorLocation;
+  }
+  export type CodeErrorColumn = number;
+  export type CodeErrorLine = number;
+  export interface CodeErrorLocation {
+    /**
+     * The line number in the code. Defaults to 0 if unknown.
+     */
+    line?: CodeErrorLine;
+    /**
+     * The column number in the code. Defaults to 0 if unknown.
+     */
+    column?: CodeErrorColumn;
+    /**
+     * The span/length of the error. Defaults to -1 if unknown.
+     */
+    span?: CodeErrorSpan;
+  }
+  export type CodeErrorSpan = number;
+  export type CodeErrors = CodeError[];
   export interface CognitoUserPoolConfig {
     /**
      * The user pool ID.
@@ -719,14 +770,19 @@ declare namespace AppSync {
      */
     responseMappingTemplate?: MappingTemplate;
     /**
-     * The version of the request mapping template. Currently, the supported value is 2018-05-29.
+     * The version of the request mapping template. Currently, the supported value is 2018-05-29. Note that when using VTL and mapping templates, the functionVersion is required.
      */
-    functionVersion: String;
+    functionVersion?: String;
     syncConfig?: SyncConfig;
     /**
      * The maximum batching size for a resolver.
      */
     maxBatchSize?: MaxBatchSize;
+    runtime?: AppSyncRuntime;
+    /**
+     * The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+     */
+    code?: Code;
   }
   export interface CreateFunctionResponse {
     /**
@@ -823,6 +879,11 @@ declare namespace AppSync {
      * The maximum batching size for a resolver.
      */
     maxBatchSize?: MaxBatchSize;
+    runtime?: AppSyncRuntime;
+    /**
+     * The resolver code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+     */
+    code?: Code;
   }
   export interface CreateResolverResponse {
     /**
@@ -1073,6 +1134,48 @@ declare namespace AppSync {
     message?: ErrorMessage;
   }
   export type ErrorMessage = string;
+  export interface EvaluateCodeErrorDetail {
+    /**
+     * The error payload.
+     */
+    message?: ErrorMessage;
+    /**
+     * Contains the list of CodeError objects.
+     */
+    codeErrors?: CodeErrors;
+  }
+  export interface EvaluateCodeRequest {
+    /**
+     * The runtime to be used when evaluating the code. Currently, only the APPSYNC_JS runtime is supported.
+     */
+    runtime: AppSyncRuntime;
+    /**
+     * The code definition to be evaluated. Note that code and runtime are both required for this action. The runtime value must be APPSYNC_JS.
+     */
+    code: Code;
+    /**
+     * The map that holds all of the contextual information for your resolver invocation. A context is required for this action.
+     */
+    context: Context;
+    /**
+     * The function within the code to be evaluated. If provided, the valid values are request and response.
+     */
+    function?: String;
+  }
+  export interface EvaluateCodeResponse {
+    /**
+     * The result of the evaluation operation.
+     */
+    evaluationResult?: EvaluationResult;
+    /**
+     * Contains the payload of the response error.
+     */
+    error?: EvaluateCodeErrorDetail;
+    /**
+     * A list of logs that were generated by calls to util.log.info and util.log.error in the evaluated code.
+     */
+    logs?: Logs;
+  }
   export interface EvaluateMappingTemplateRequest {
     /**
      * The mapping template; this can be a request or response template. A template is required for this action.
@@ -1092,6 +1195,10 @@ declare namespace AppSync {
      * The ErrorDetail object.
      */
     error?: ErrorDetail;
+    /**
+     * A list of logs that were generated by calls to util.log.info and util.log.error in the evaluated code.
+     */
+    logs?: Logs;
   }
   export type EvaluationResult = string;
   export type FieldLogLevel = "NONE"|"ERROR"|"ALL"|string;
@@ -1141,6 +1248,11 @@ declare namespace AppSync {
      * The maximum batching size for a resolver.
      */
     maxBatchSize?: MaxBatchSize;
+    runtime?: AppSyncRuntime;
+    /**
+     * The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+     */
+    code?: Code;
   }
   export type Functions = FunctionConfiguration[];
   export type FunctionsIds = String[];
@@ -1613,6 +1725,7 @@ declare namespace AppSync {
      */
     excludeVerboseContent?: Boolean;
   }
+  export type Logs = String[];
   export type Long = number;
   export type MapOfStringToString = {[key: string]: String};
   export type MappingTemplate = string;
@@ -1732,11 +1845,17 @@ declare namespace AppSync {
      * The maximum batching size for a resolver.
      */
     maxBatchSize?: MaxBatchSize;
+    runtime?: AppSyncRuntime;
+    /**
+     * The resolver code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+     */
+    code?: Code;
   }
   export type ResolverKind = "UNIT"|"PIPELINE"|string;
   export type Resolvers = Resolver[];
   export type ResourceArn = string;
   export type ResourceName = string;
+  export type RuntimeName = "APPSYNC_JS"|string;
   export type SchemaStatus = "PROCESSING"|"ACTIVE"|"DELETING"|"FAILED"|"SUCCESS"|"NOT_APPLICABLE"|string;
   export interface StartSchemaCreationRequest {
     /**
@@ -1969,14 +2088,19 @@ declare namespace AppSync {
      */
     responseMappingTemplate?: MappingTemplate;
     /**
-     * The version of the request mapping template. Currently, the supported value is 2018-05-29.
+     * The version of the request mapping template. Currently, the supported value is 2018-05-29. Note that when using VTL and mapping templates, the functionVersion is required.
      */
-    functionVersion: String;
+    functionVersion?: String;
     syncConfig?: SyncConfig;
     /**
      * The maximum batching size for a resolver.
      */
     maxBatchSize?: MaxBatchSize;
+    runtime?: AppSyncRuntime;
+    /**
+     * The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+     */
+    code?: Code;
   }
   export interface UpdateFunctionResponse {
     /**
@@ -2073,6 +2197,11 @@ declare namespace AppSync {
      * The maximum batching size for a resolver.
      */
     maxBatchSize?: MaxBatchSize;
+    runtime?: AppSyncRuntime;
+    /**
+     * The resolver code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+     */
+    code?: Code;
   }
   export interface UpdateResolverResponse {
     /**

package/node_modules/aws-sdk/clients/athena.d.ts

@@ -315,6 +315,7 @@ declare namespace Athena {
      */
     S3AclOption: S3AclOption;
   }
+  export type Age = number;
   export type AmazonResourceName = string;
   export interface AthenaError {
     /**
@@ -1121,6 +1122,10 @@ declare namespace Athena {
      * The location in Amazon S3 where query results were stored and the encryption option, if any, used for query results. These are known as "client-side settings". If workgroup settings override client-side settings, then the query uses the location for the query results and the encryption configuration that are specified for the workgroup.
      */
     ResultConfiguration?: ResultConfiguration;
+    /**
+     * Specifies the query result reuse behavior that was used for the query.
+     */
+    ResultReuseConfiguration?: ResultReuseConfiguration;
     /**
      * The database in which the query execution occurred.
      */
@@ -1189,6 +1194,10 @@ declare namespace Athena {
      * The number of milliseconds that Athena took to finalize and publish the query results after the query engine finished running the query.
      */
     ServiceProcessingTimeInMillis?: Long;
+    /**
+     * Contains information about whether previous query results were reused for the query.
+     */
+    ResultReuseInformation?: ResultReuseInformation;
   }
   export interface QueryExecutionStatus {
     /**
@@ -1372,6 +1381,28 @@ declare namespace Athena {
     RemoveAclConfiguration?: BoxedBoolean;
   }
   export type ResultOutputLocation = string;
+  export interface ResultReuseByAgeConfiguration {
+    /**
+     * True if previous query results can be reused when the query is run; otherwise, false. The default is false.
+     */
+    Enabled: Boolean;
+    /**
+     * Specifies, in minutes, the maximum age of a previous query result that Athena should consider for reuse. The default is 60.
+     */
+    MaxAgeInMinutes?: Age;
+  }
+  export interface ResultReuseConfiguration {
+    /**
+     * Specifies whether previous query results are reused, and if so, their maximum age.
+     */
+    ResultReuseByAgeConfiguration?: ResultReuseByAgeConfiguration;
+  }
+  export interface ResultReuseInformation {
+    /**
+     * True if a previous query result was reused; false if the result was generated from a new run of the query.
+     */
+    ReusedPreviousResult: Boolean;
+  }
   export interface ResultSet {
     /**
      * The rows in the table.
@@ -1421,6 +1452,10 @@ declare namespace Athena {
      * A list of values for the parameters in a query. The values are applied sequentially to the parameters in the query in the order in which the parameters occur.
      */
     ExecutionParameters?: ExecutionParameters;
+    /**
+     * Specifies the query result reuse behavior for the query.
+     */
+    ResultReuseConfiguration?: ResultReuseConfiguration;
   }
   export interface StartQueryExecutionOutput {
     /**

package/node_modules/aws-sdk/clients/auditmanager.d.ts

@@ -52,11 +52,11 @@ declare class AuditManager extends Service {
    */
   batchDisassociateAssessmentReportEvidence(callback?: (err: AWSError, data: AuditManager.Types.BatchDisassociateAssessmentReportEvidenceResponse) => void): Request<AuditManager.Types.BatchDisassociateAssessmentReportEvidenceResponse, AWSError>;
   /**
-   *  Uploads one or more pieces of evidence to a control in an Audit Manager assessment. 
+   * Uploads one or more pieces of evidence to a control in an Audit Manager assessment. You can upload manual evidence from any Amazon Simple Storage Service (Amazon S3) bucket by specifying the S3 URI of the evidence.  You must upload manual evidence to your S3 bucket before you can upload it to your assessment. For instructions, see CreateBucket and PutObject in the Amazon Simple Storage Service API Reference.  The following restrictions apply to this action:   Maximum size of an individual evidence file: 100 MB   Number of daily manual evidence uploads per control: 100   Supported file formats: See Supported file types for manual evidence in the Audit Manager User Guide    For more information about Audit Manager service restrictions, see Quotas and restrictions for Audit Manager.
    */
   batchImportEvidenceToAssessmentControl(params: AuditManager.Types.BatchImportEvidenceToAssessmentControlRequest, callback?: (err: AWSError, data: AuditManager.Types.BatchImportEvidenceToAssessmentControlResponse) => void): Request<AuditManager.Types.BatchImportEvidenceToAssessmentControlResponse, AWSError>;
   /**
-   *  Uploads one or more pieces of evidence to a control in an Audit Manager assessment. 
+   * Uploads one or more pieces of evidence to a control in an Audit Manager assessment. You can upload manual evidence from any Amazon Simple Storage Service (Amazon S3) bucket by specifying the S3 URI of the evidence.  You must upload manual evidence to your S3 bucket before you can upload it to your assessment. For instructions, see CreateBucket and PutObject in the Amazon Simple Storage Service API Reference.  The following restrictions apply to this action:   Maximum size of an individual evidence file: 100 MB   Number of daily manual evidence uploads per control: 100   Supported file formats: See Supported file types for manual evidence in the Audit Manager User Guide    For more information about Audit Manager service restrictions, see Quotas and restrictions for Audit Manager.
    */
   batchImportEvidenceToAssessmentControl(callback?: (err: AWSError, data: AuditManager.Types.BatchImportEvidenceToAssessmentControlResponse) => void): Request<AuditManager.Types.BatchImportEvidenceToAssessmentControlResponse, AWSError>;
   /**
@@ -140,11 +140,11 @@ declare class AuditManager extends Service {
    */
   deregisterAccount(callback?: (err: AWSError, data: AuditManager.Types.DeregisterAccountResponse) => void): Request<AuditManager.Types.DeregisterAccountResponse, AWSError>;
   /**
-   * Removes the specified Amazon Web Services account as a delegated administrator for Audit Manager.   When you remove a delegated administrator from your Audit Manager settings, you continue to have access to the evidence that you previously collected under that account. This is also the case when you deregister a delegated administrator from Organizations. However, Audit Manager will stop collecting and attaching evidence to that delegated administrator account moving forward.   When you deregister a delegated administrator account for Audit Manager, the data for that account isn’t deleted. If you want to delete resource data for a delegated administrator account, you must perform that task separately before you deregister the account. Either, you can do this in the Audit Manager console. Or, you can use one of the delete API operations that are provided by Audit Manager.  To delete your Audit Manager resource data, see the following instructions:     DeleteAssessment (see also: Deleting an assessment in the Audit Manager User Guide)    DeleteAssessmentFramework (see also: Deleting a custom framework in the Audit Manager User Guide)    DeleteAssessmentFrameworkShare (see also: Deleting a share request in the Audit Manager User Guide)    DeleteAssessmentReport (see also: Deleting an assessment report in the Audit Manager User Guide)    DeleteControl (see also: Deleting a custom control in the Audit Manager User Guide)   At this time, Audit Manager doesn't provide an option to delete evidence. All available delete operations are listed above. 
+   * Removes the specified Amazon Web Services account as a delegated administrator for Audit Manager.  When you remove a delegated administrator from your Audit Manager settings, you continue to have access to the evidence that you previously collected under that account. This is also the case when you deregister a delegated administrator from Organizations. However, Audit Manager will stop collecting and attaching evidence to that delegated administrator account moving forward.  Keep in mind the following cleanup task if you use evidence finder: Before you use your management account to remove a delegated administrator, make sure that the current delegated administrator account signs in to Audit Manager and disables evidence finder first. Disabling evidence finder automatically deletes the event data store that was created in their account when they enabled evidence finder. If this task isn’t completed, the event data store remains in their account. In this case, we recommend that the original delegated administrator goes to CloudTrail Lake and manually deletes the event data store. This cleanup task is necessary to ensure that you don't end up with multiple event data stores. Audit Manager will ignore an unused event data store after you remove or change a delegated administrator account. However, the unused event data store continues to incur storage costs from CloudTrail Lake if you don't delete it.  When you deregister a delegated administrator account for Audit Manager, the data for that account isn’t deleted. If you want to delete resource data for a delegated administrator account, you must perform that task separately before you deregister the account. Either, you can do this in the Audit Manager console. Or, you can use one of the delete API operations that are provided by Audit Manager.  To delete your Audit Manager resource data, see the following instructions:     DeleteAssessment (see also: Deleting an assessment in the Audit Manager User Guide)    DeleteAssessmentFramework (see also: Deleting a custom framework in the Audit Manager User Guide)    DeleteAssessmentFrameworkShare (see also: Deleting a share request in the Audit Manager User Guide)    DeleteAssessmentReport (see also: Deleting an assessment report in the Audit Manager User Guide)    DeleteControl (see also: Deleting a custom control in the Audit Manager User Guide)   At this time, Audit Manager doesn't provide an option to delete evidence. All available delete operations are listed above.
    */
   deregisterOrganizationAdminAccount(params: AuditManager.Types.DeregisterOrganizationAdminAccountRequest, callback?: (err: AWSError, data: AuditManager.Types.DeregisterOrganizationAdminAccountResponse) => void): Request<AuditManager.Types.DeregisterOrganizationAdminAccountResponse, AWSError>;
   /**
-   * Removes the specified Amazon Web Services account as a delegated administrator for Audit Manager.   When you remove a delegated administrator from your Audit Manager settings, you continue to have access to the evidence that you previously collected under that account. This is also the case when you deregister a delegated administrator from Organizations. However, Audit Manager will stop collecting and attaching evidence to that delegated administrator account moving forward.   When you deregister a delegated administrator account for Audit Manager, the data for that account isn’t deleted. If you want to delete resource data for a delegated administrator account, you must perform that task separately before you deregister the account. Either, you can do this in the Audit Manager console. Or, you can use one of the delete API operations that are provided by Audit Manager.  To delete your Audit Manager resource data, see the following instructions:     DeleteAssessment (see also: Deleting an assessment in the Audit Manager User Guide)    DeleteAssessmentFramework (see also: Deleting a custom framework in the Audit Manager User Guide)    DeleteAssessmentFrameworkShare (see also: Deleting a share request in the Audit Manager User Guide)    DeleteAssessmentReport (see also: Deleting an assessment report in the Audit Manager User Guide)    DeleteControl (see also: Deleting a custom control in the Audit Manager User Guide)   At this time, Audit Manager doesn't provide an option to delete evidence. All available delete operations are listed above. 
+   * Removes the specified Amazon Web Services account as a delegated administrator for Audit Manager.  When you remove a delegated administrator from your Audit Manager settings, you continue to have access to the evidence that you previously collected under that account. This is also the case when you deregister a delegated administrator from Organizations. However, Audit Manager will stop collecting and attaching evidence to that delegated administrator account moving forward.  Keep in mind the following cleanup task if you use evidence finder: Before you use your management account to remove a delegated administrator, make sure that the current delegated administrator account signs in to Audit Manager and disables evidence finder first. Disabling evidence finder automatically deletes the event data store that was created in their account when they enabled evidence finder. If this task isn’t completed, the event data store remains in their account. In this case, we recommend that the original delegated administrator goes to CloudTrail Lake and manually deletes the event data store. This cleanup task is necessary to ensure that you don't end up with multiple event data stores. Audit Manager will ignore an unused event data store after you remove or change a delegated administrator account. However, the unused event data store continues to incur storage costs from CloudTrail Lake if you don't delete it.  When you deregister a delegated administrator account for Audit Manager, the data for that account isn’t deleted. If you want to delete resource data for a delegated administrator account, you must perform that task separately before you deregister the account. Either, you can do this in the Audit Manager console. Or, you can use one of the delete API operations that are provided by Audit Manager.  To delete your Audit Manager resource data, see the following instructions:     DeleteAssessment (see also: Deleting an assessment in the Audit Manager User Guide)    DeleteAssessmentFramework (see also: Deleting a custom framework in the Audit Manager User Guide)    DeleteAssessmentFrameworkShare (see also: Deleting a share request in the Audit Manager User Guide)    DeleteAssessmentReport (see also: Deleting an assessment report in the Audit Manager User Guide)    DeleteControl (see also: Deleting a custom control in the Audit Manager User Guide)   At this time, Audit Manager doesn't provide an option to delete evidence. All available delete operations are listed above.
    */
   deregisterOrganizationAdminAccount(callback?: (err: AWSError, data: AuditManager.Types.DeregisterOrganizationAdminAccountResponse) => void): Request<AuditManager.Types.DeregisterOrganizationAdminAccountResponse, AWSError>;
   /**
@@ -276,11 +276,11 @@ declare class AuditManager extends Service {
    */
   getOrganizationAdminAccount(callback?: (err: AWSError, data: AuditManager.Types.GetOrganizationAdminAccountResponse) => void): Request<AuditManager.Types.GetOrganizationAdminAccountResponse, AWSError>;
   /**
-   *  Returns a list of the in-scope Amazon Web Services for the specified assessment. 
+   * Returns a list of all of the Amazon Web Services that you can choose to include in your assessment. When you create an assessment, specify which of these services you want to include to narrow the assessment's scope.
    */
   getServicesInScope(params: AuditManager.Types.GetServicesInScopeRequest, callback?: (err: AWSError, data: AuditManager.Types.GetServicesInScopeResponse) => void): Request<AuditManager.Types.GetServicesInScopeResponse, AWSError>;
   /**
-   *  Returns a list of the in-scope Amazon Web Services for the specified assessment. 
+   * Returns a list of all of the Amazon Web Services that you can choose to include in your assessment. When you create an assessment, specify which of these services you want to include to narrow the assessment's scope.
    */
   getServicesInScope(callback?: (err: AWSError, data: AuditManager.Types.GetServicesInScopeResponse) => void): Request<AuditManager.Types.GetServicesInScopeResponse, AWSError>;
   /**
@@ -955,11 +955,11 @@ declare namespace AuditManager {
      */
     evidenceId?: UUID;
     /**
-     *  The error code that the AssessmentReportEvidence API returned. 
+     *  The error code that was returned. 
      */
     errorCode?: ErrorCode;
     /**
-     *  The error message that the AssessmentReportEvidence API returned. 
+     *  The error message that was returned. 
      */
     errorMessage?: ErrorMessage;
   }
@@ -1202,6 +1202,7 @@ declare namespace AuditManager {
     createdBy?: IamArn;
   }
   export type ChangeLogs = ChangeLog[];
+  export type CloudTrailArn = string;
   export type ComplianceType = string;
   export interface Control {
     /**
@@ -1237,7 +1238,7 @@ declare namespace AuditManager {
      */
     actionPlanInstructions?: ActionPlanInstructions;
     /**
-     *  The data source that determines where Audit Manager collects evidence from for the control. 
+     *  The data source types that determine where Audit Manager collects evidence from for the control. 
      */
     controlSources?: ControlSources;
     /**
@@ -1495,6 +1496,10 @@ declare namespace AuditManager {
      *  The identifier for the assessment. 
      */
     assessmentId: UUID;
+    /**
+     * A SQL statement that represents an evidence finder query. Provide this parameter when you want to generate an assessment report from the results of an evidence finder search query. When you use this parameter, Audit Manager generates a one-time report using only the evidence from the query output. This report does not include any assessment evidence that was manually added to a report using the console, or associated with a report using the API.  To use this parameter, the enablementStatus of evidence finder must be ENABLED.   For examples and help resolving queryStatement validation exceptions, see Troubleshooting evidence finder issues in the AWS Audit Manager User Guide. 
+     */
+    queryStatement?: QueryStatement;
   }
   export interface CreateAssessmentReportResponse {
     /**
@@ -1815,7 +1820,7 @@ declare namespace AuditManager {
      */
     iamId?: IamArn;
     /**
-     *  The evaluation status for evidence that falls under the compliance check category. For evidence collected from Security Hub, a Pass or Fail result is shown. For evidence collected from Config, a Compliant or Noncompliant result is shown. 
+     * The evaluation status for automated evidence that falls under the compliance check category.   Audit Manager classes evidence as non-compliant if Security Hub reports a Fail result, or if Config reports a Non-compliant result.   Audit Manager classes evidence as compliant if Security Hub reports a Pass result, or if Config reports a Compliant result.   If a compliance check isn't available or applicable, then no compliance evaluation can be made for that evidence. This is the case if the evidence uses Config or Security Hub as the underlying data source type, but those services aren't enabled. This is also the case if the evidence uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail).   
      */
     complianceCheck?: String;
     /**
@@ -1842,6 +1847,26 @@ declare namespace AuditManager {
   export type EvidenceAttributeKey = string;
   export type EvidenceAttributeValue = string;
   export type EvidenceAttributes = {[key: string]: EvidenceAttributeValue};
+  export type EvidenceFinderBackfillStatus = "NOT_STARTED"|"IN_PROGRESS"|"COMPLETED"|string;
+  export interface EvidenceFinderEnablement {
+    /**
+     * The Amazon Resource Name (ARN) of the CloudTrail Lake event data store that’s used by evidence finder. The event data store is the lake of evidence data that evidence finder runs queries against.
+     */
+    eventDataStoreArn?: CloudTrailArn;
+    /**
+     * The current status of the evidence finder feature and the related event data store.     ENABLE_IN_PROGRESS means that you requested to enable evidence finder. An event data store is currently being created to support evidence finder queries.    ENABLED means that an event data store was successfully created and evidence finder is enabled. We recommend that you wait 24 hours until the event data store is backfilled with your past evidence data. You can use evidence finder in the meantime, but not all data might be available until the backfill is complete.    DISABLE_IN_PROGRESS means that you requested to disable evidence finder, and your request is pending the deletion of the event data store.    DISABLED means that you have permanently disabled evidence finder and the event data store has been deleted. You can't re-enable evidence finder after this point.  
+     */
+    enablementStatus?: EvidenceFinderEnablementStatus;
+    /**
+     * The current status of the evidence data backfill process.  The backfill starts after you enable evidence finder. During this task, Audit Manager populates an event data store with your past evidence data so that your evidence can be queried.    NOT_STARTED means that the backfill hasn’t started yet.     IN_PROGRESS means that the backfill is in progress. This can take up to 24 hours to complete, depending on the amount of evidence data.     COMPLETED means that the backfill is complete. All of your past evidence is now queryable.   
+     */
+    backfillStatus?: EvidenceFinderBackfillStatus;
+    /**
+     * Represents any errors that occurred when enabling or disabling evidence finder. 
+     */
+    error?: ErrorMessage;
+  }
+  export type EvidenceFinderEnablementStatus = "ENABLED"|"DISABLED"|"ENABLE_IN_PROGRESS"|"DISABLE_IN_PROGRESS"|string;
   export type EvidenceIds = UUID[];
   export interface EvidenceInsights {
     /**
@@ -2611,6 +2636,7 @@ declare namespace AuditManager {
   export type Notifications = Notification[];
   export type NullableInteger = number;
   export type ObjectTypeEnum = "ASSESSMENT"|"CONTROL_SET"|"CONTROL"|"DELEGATION"|"ASSESSMENT_REPORT"|string;
+  export type QueryStatement = string;
   export type Region = string;
   export interface RegisterAccountRequest {
     /**
@@ -2653,6 +2679,10 @@ declare namespace AuditManager {
      *  The value of the resource. 
      */
     value?: String;
+    /**
+     *  The evaluation status for a resource that was assessed when collecting compliance check evidence.    Audit Manager classes the resource as non-compliant if Security Hub reports a Fail result, or if Config reports a Non-compliant result.   Audit Manager classes the resource as compliant if Security Hub reports a Pass result, or if Config reports a Compliant result.   If a compliance check isn't available or applicable, then no compliance evaluation can be made for that resource. This is the case if a resource assessment uses Config or Security Hub as the underlying data source type, but those services aren't enabled. This is also the case if the resource assessment uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail).   
+     */
+    complianceCheck?: String;
   }
   export type Resources = Resource[];
   export interface Role {
@@ -2698,7 +2728,7 @@ declare namespace AuditManager {
     category?: NonEmptyString;
   }
   export type ServiceMetadataList = ServiceMetadata[];
-  export type SettingAttribute = "ALL"|"IS_AWS_ORG_ENABLED"|"SNS_TOPIC"|"DEFAULT_ASSESSMENT_REPORTS_DESTINATION"|"DEFAULT_PROCESS_OWNERS"|string;
+  export type SettingAttribute = "ALL"|"IS_AWS_ORG_ENABLED"|"SNS_TOPIC"|"DEFAULT_ASSESSMENT_REPORTS_DESTINATION"|"DEFAULT_PROCESS_OWNERS"|"EVIDENCE_FINDER_ENABLEMENT"|string;
   export interface Settings {
     /**
      *  Specifies whether Organizations is enabled. 
@@ -2720,6 +2750,10 @@ declare namespace AuditManager {
      *  The KMS key details. 
      */
     kmsKey?: KmsKey;
+    /**
+     * The current evidence finder status and event data store details.
+     */
+    evidenceFinderEnablement?: EvidenceFinderEnablement;
   }
   export type ShareRequestAction = "ACCEPT"|"DECLINE"|"REVOKE"|string;
   export type ShareRequestComment = string;
@@ -2734,7 +2768,7 @@ declare namespace AuditManager {
      */
     keywordInputType?: KeywordInputType;
     /**
-     *  The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.  If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:   For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules.   Managed rule name: s3-bucket-acl-prohibited   keywordValue: S3_BUCKET_ACL_PROHIBITED      For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the rule from a managed rule.   Custom rule name: my-custom-config-rule  keywordValue: Custom_my-custom-config-rule      For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.   Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w  keywordValue: Custom_CustomRuleForAccount-conformance-pack    Service-linked rule name: securityhub-api-gw-cache-encrypted-101104e1  keywordValue: Custom_securityhub-api-gw-cache-encrypted    Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba  keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled     
+     *  The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.  If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:   For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules.   Managed rule name: s3-bucket-acl-prohibited   keywordValue: S3_BUCKET_ACL_PROHIBITED      For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the rule from a managed rule.   Custom rule name: my-custom-config-rule  keywordValue: Custom_my-custom-config-rule      For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.   Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w  keywordValue: Custom_CustomRuleForAccount-conformance-pack    Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba  keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled     
      */
     keywordValue?: KeywordValue;
   }
@@ -3026,6 +3060,10 @@ declare namespace AuditManager {
      *  The KMS key details. 
      */
     kmsKey?: KmsKey;
+    /**
+     * Specifies whether the evidence finder feature is enabled. Change this attribute to enable or disable evidence finder.  When you use this attribute to disable evidence finder, Audit Manager deletes the event data store that’s used to query your evidence data. As a result, you can’t re-enable evidence finder and use the feature again. Your only alternative is to deregister and then re-register Audit Manager.  Disabling evidence finder is permanent, so consider this decision carefully before you proceed. If you’re using Audit Manager as a delegated administrator, keep in mind that this action applies to all member accounts in your organization. 
+     */
+    evidenceFinderEnabled?: Boolean;
   }
   export interface UpdateSettingsResponse {
     /**