botocore 1.38.35__tar.gz → 1.38.38__tar.gz

{botocore-1.38.35/botocore.egg-info → botocore-1.38.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: botocore
-Version: 1.38.35
+Version: 1.38.38
 Summary: Low-level, data-driven core of boto 3.
 Home-page: https://github.com/boto/botocore
 Author: Amazon Web Services

{botocore-1.38.35 → botocore-1.38.38}/botocore/__init__.py

@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.38.35'
+__version__ = '1.38.38'
 
 
 class NullHandler(logging.Handler):

{botocore-1.38.35 → botocore-1.38.38}/botocore/data/accessanalyzer/2019-11-01/service-2.json

@@ -1125,6 +1125,10 @@
         "unusedAccess":{
           "shape":"UnusedAccessConfiguration",
           "documentation":"<p>Specifies the configuration of an unused access analyzer for an Amazon Web Services organization or account.</p>"
+        },
+        "internalAccess":{
+          "shape":"InternalAccessConfiguration",
+          "documentation":"<p>Specifies the configuration of an internal access analyzer for an Amazon Web Services organization or account. This configuration determines how the analyzer evaluates access within your Amazon Web Services environment.</p>"
         }
       },
       "documentation":"<p>Contains information about the configuration of an analyzer for an Amazon Web Services organization or account.</p>",
@@ -1187,7 +1191,7 @@
         },
         "configuration":{
           "shape":"AnalyzerConfiguration",
-          "documentation":"<p>Specifies whether the analyzer is an external access or unused access analyzer.</p>"
+          "documentation":"<p>Specifies if the analyzer is an external access, unused access, or internal access analyzer.</p>"
         }
       },
       "documentation":"<p>Contains information about the analyzer.</p>"
@@ -1609,7 +1613,7 @@
         },
         "type":{
           "shape":"Type",
-          "documentation":"<p>The type of analyzer to create. Only <code>ACCOUNT</code>, <code>ORGANIZATION</code>, <code>ACCOUNT_UNUSED_ACCESS</code>, and <code>ORGANIZATION_UNUSED_ACCESS</code> analyzers are supported. You can create only one analyzer per account per Region. You can create up to 5 analyzers per organization per Region.</p>"
+          "documentation":"<p>The type of analyzer to create. You can create only one analyzer per account per Region. You can create up to 5 analyzers per organization per Region.</p>"
         },
         "archiveRules":{
           "shape":"InlineArchiveRulesList",
@@ -1626,7 +1630,7 @@
         },
         "configuration":{
           "shape":"AnalyzerConfiguration",
-          "documentation":"<p>Specifies the configuration of the analyzer. If the analyzer is an unused access analyzer, the specified scope of unused access is used for the configuration.</p>"
+          "documentation":"<p>Specifies the configuration of the analyzer. If the analyzer is an unused access analyzer, the specified scope of unused access is used for the configuration. If the analyzer is an internal access analyzer, the specified internal access analysis rules are used for the configuration.</p>"
         }
       },
       "documentation":"<p>Creates an analyzer.</p>"
@@ -1841,7 +1845,7 @@
         },
         "resourceControlPolicyRestriction":{
           "shape":"ResourceControlPolicyRestriction",
-          "documentation":"<p>The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP).</p>"
+          "documentation":"<p>The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP).</p> <ul> <li> <p> <code>APPLICABLE</code>: There is an RCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. For example, if <code>s3:DeleteObject</code> is blocked by the RCP and the restriction is <code>APPLICABLE</code>, then <code>s3:DeleteObject</code> would still be included in the list of actions for the finding.</p> </li> <li> <p> <code>FAILED_TO_EVALUATE_RCP</code>: There was an error evaluating the RCP.</p> </li> <li> <p> <code>NOT_APPLICABLE</code>: There was no RCP present in the organization, or there was no RCP applicable to the resource. For example, the resource being analyzed is an Amazon RDS snapshot and there is an RCP in the organization, but the RCP only impacts Amazon S3 buckets.</p> </li> <li> <p> <code>APPLIED</code>: This restriction is not currently available for external access findings. </p> </li> </ul>"
         }
       },
       "documentation":"<p>Contains information about an external access finding.</p>"
@@ -1983,6 +1987,10 @@
     "FindingDetails":{
       "type":"structure",
       "members":{
+        "internalAccessDetails":{
+          "shape":"InternalAccessDetails",
+          "documentation":"<p>The details for an internal access analyzer finding. This contains information about access patterns identified within your Amazon Web Services organization or account.</p>"
+        },
         "externalAccessDetails":{
           "shape":"ExternalAccessDetails",
           "documentation":"<p>The details for an external access analyzer finding.</p>"
@@ -2199,7 +2207,7 @@
         },
         "findingType":{
           "shape":"FindingType",
-          "documentation":"<p>The type of the external access or unused access finding.</p>"
+          "documentation":"<p>The type of the access finding. For external access analyzers, the type is <code>ExternalAccess</code>. For unused access analyzers, the type can be <code>UnusedIAMRole</code>, <code>UnusedIAMUserAccessKey</code>, <code>UnusedIAMUserPassword</code>, or <code>UnusedPermission</code>. For internal access analyzers, the type is <code>InternalAccess</code>.</p>"
         }
       },
       "documentation":"<p>Contains information about a finding.</p>"
@@ -2211,7 +2219,8 @@
         "UnusedIAMRole",
         "UnusedIAMUserAccessKey",
         "UnusedIAMUserPassword",
-        "UnusedPermission"
+        "UnusedPermission",
+        "InternalAccess"
       ]
     },
     "FindingsList":{
@@ -2229,6 +2238,10 @@
           "shape":"ExternalAccessFindingsStatistics",
           "documentation":"<p>The aggregate statistics for an external access analyzer.</p>"
         },
+        "internalAccessFindingsStatistics":{
+          "shape":"InternalAccessFindingsStatistics",
+          "documentation":"<p>The aggregate statistics for an internal access analyzer. This includes information about active, archived, and resolved findings related to internal access within your Amazon Web Services organization or account.</p>"
+        },
         "unusedAccessFindingsStatistics":{
           "shape":"UnusedAccessFindingsStatistics",
           "documentation":"<p>The aggregate statistics for an unused access analyzer.</p>"
@@ -2644,7 +2657,7 @@
         },
         "findingType":{
           "shape":"FindingType",
-          "documentation":"<p>The type of the finding. For external access analyzers, the type is <code>ExternalAccess</code>. For unused access analyzers, the type can be <code>UnusedIAMRole</code>, <code>UnusedIAMUserAccessKey</code>, <code>UnusedIAMUserPassword</code>, or <code>UnusedPermission</code>.</p>"
+          "documentation":"<p>The type of the finding. For external access analyzers, the type is <code>ExternalAccess</code>. For unused access analyzers, the type can be <code>UnusedIAMRole</code>, <code>UnusedIAMUserAccessKey</code>, <code>UnusedIAMUserPassword</code>, or <code>UnusedPermission</code>. For internal access analyzers, the type is <code>InternalAccess</code>.</p>"
         }
       }
     },
@@ -2750,6 +2763,142 @@
       "type":"integer",
       "box":true
     },
+    "InternalAccessAnalysisRule":{
+      "type":"structure",
+      "members":{
+        "inclusions":{
+          "shape":"InternalAccessAnalysisRuleCriteriaList",
+          "documentation":"<p>A list of rules for the internal access analyzer containing criteria to include in analysis. Only resources that meet the rule criteria will generate findings.</p>"
+        }
+      },
+      "documentation":"<p>Contains information about analysis rules for the internal access analyzer. Analysis rules determine which entities will generate findings based on the criteria you define when you create the rule.</p>"
+    },
+    "InternalAccessAnalysisRuleCriteria":{
+      "type":"structure",
+      "members":{
+        "accountIds":{
+          "shape":"AccountIdsList",
+          "documentation":"<p>A list of Amazon Web Services account IDs to apply to the internal access analysis rule criteria. Account IDs can only be applied to the analysis rule criteria for organization-level analyzers.</p>"
+        },
+        "resourceTypes":{
+          "shape":"ResourceTypeList",
+          "documentation":"<p>A list of resource types to apply to the internal access analysis rule criteria. The analyzer will only generate findings for resources of these types. These resource types are currently supported for internal access analyzers:</p> <ul> <li> <p> <code>AWS::S3::Bucket</code> </p> </li> <li> <p> <code>AWS::RDS::DBSnapshot</code> </p> </li> <li> <p> <code>AWS::RDS::DBClusterSnapshot</code> </p> </li> <li> <p> <code>AWS::S3Express::DirectoryBucket</code> </p> </li> <li> <p> <code>AWS::DynamoDB::Table</code> </p> </li> <li> <p> <code>AWS::DynamoDB::Stream</code> </p> </li> </ul>"
+        },
+        "resourceArns":{
+          "shape":"ResourceArnsList",
+          "documentation":"<p>A list of resource ARNs to apply to the internal access analysis rule criteria. The analyzer will only generate findings for resources that match these ARNs.</p>"
+        }
+      },
+      "documentation":"<p>The criteria for an analysis rule for an internal access analyzer.</p>"
+    },
+    "InternalAccessAnalysisRuleCriteriaList":{
+      "type":"list",
+      "member":{"shape":"InternalAccessAnalysisRuleCriteria"}
+    },
+    "InternalAccessConfiguration":{
+      "type":"structure",
+      "members":{
+        "analysisRule":{
+          "shape":"InternalAccessAnalysisRule",
+          "documentation":"<p>Contains information about analysis rules for the internal access analyzer. These rules determine which resources and access patterns will be analyzed.</p>"
+        }
+      },
+      "documentation":"<p>Specifies the configuration of an internal access analyzer for an Amazon Web Services organization or account. This configuration determines how the analyzer evaluates internal access within your Amazon Web Services environment.</p>"
+    },
+    "InternalAccessDetails":{
+      "type":"structure",
+      "members":{
+        "action":{
+          "shape":"ActionList",
+          "documentation":"<p>The action in the analyzed policy statement that has internal access permission to use.</p>"
+        },
+        "condition":{
+          "shape":"ConditionKeyMap",
+          "documentation":"<p>The condition in the analyzed policy statement that resulted in an internal access finding.</p>"
+        },
+        "principal":{
+          "shape":"PrincipalMap",
+          "documentation":"<p>The principal that has access to a resource within the internal environment.</p>"
+        },
+        "principalOwnerAccount":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Web Services account ID that owns the principal identified in the internal access finding.</p>"
+        },
+        "accessType":{
+          "shape":"InternalAccessType",
+          "documentation":"<p>The type of internal access identified in the finding. This indicates how the access is granted within your Amazon Web Services environment.</p>"
+        },
+        "principalType":{
+          "shape":"PrincipalType",
+          "documentation":"<p>The type of principal identified in the internal access finding, such as IAM role or IAM user.</p>"
+        },
+        "sources":{
+          "shape":"FindingSourceList",
+          "documentation":"<p>The sources of the internal access finding. This indicates how the access that generated the finding is granted within your Amazon Web Services environment.</p>"
+        },
+        "resourceControlPolicyRestriction":{
+          "shape":"ResourceControlPolicyRestriction",
+          "documentation":"<p>The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP).</p> <ul> <li> <p> <code>APPLICABLE</code>: There is an RCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. For example, if <code>s3:DeleteObject</code> is blocked by the RCP and the restriction is <code>APPLICABLE</code>, then <code>s3:DeleteObject</code> would still be included in the list of actions for the finding. Only applicable to internal access findings with the account as the zone of trust. </p> </li> <li> <p> <code>FAILED_TO_EVALUATE_RCP</code>: There was an error evaluating the RCP.</p> </li> <li> <p> <code>NOT_APPLICABLE</code>: There was no RCP present in the organization. For internal access findings with the account as the zone of trust, <code>NOT_APPLICABLE</code> could also indicate that there was no RCP applicable to the resource.</p> </li> <li> <p> <code>APPLIED</code>: An RCP is present in the organization and IAM Access Analyzer included it in the evaluation of effective permissions. For example, if <code>s3:DeleteObject</code> is blocked by the RCP and the restriction is <code>APPLIED</code>, then <code>s3:DeleteObject</code> would not be included in the list of actions for the finding. Only applicable to internal access findings with the organization as the zone of trust. </p> </li> </ul>"
+        },
+        "serviceControlPolicyRestriction":{
+          "shape":"ServiceControlPolicyRestriction",
+          "documentation":"<p>The type of restriction applied to the finding by an Organizations service control policy (SCP).</p> <ul> <li> <p> <code>APPLICABLE</code>: There is an SCP present in the organization but IAM Access Analyzer does not include it in the evaluation of effective permissions. Only applicable to internal access findings with the account as the zone of trust. </p> </li> <li> <p> <code>FAILED_TO_EVALUATE_SCP</code>: There was an error evaluating the SCP.</p> </li> <li> <p> <code>NOT_APPLICABLE</code>: There was no SCP present in the organization. For internal access findings with the account as the zone of trust, <code>NOT_APPLICABLE</code> could also indicate that there was no SCP applicable to the principal.</p> </li> <li> <p> <code>APPLIED</code>: An SCP is present in the organization and IAM Access Analyzer included it in the evaluation of effective permissions. Only applicable to internal access findings with the organization as the zone of trust. </p> </li> </ul>"
+        }
+      },
+      "documentation":"<p>Contains information about an internal access finding. This includes details about the access that was identified within your Amazon Web Services organization or account.</p>"
+    },
+    "InternalAccessFindingsStatistics":{
+      "type":"structure",
+      "members":{
+        "resourceTypeStatistics":{
+          "shape":"InternalAccessResourceTypeStatisticsMap",
+          "documentation":"<p>The total number of active findings for each resource type of the specified internal access analyzer.</p>"
+        },
+        "totalActiveFindings":{
+          "shape":"Integer",
+          "documentation":"<p>The number of active findings for the specified internal access analyzer.</p>"
+        },
+        "totalArchivedFindings":{
+          "shape":"Integer",
+          "documentation":"<p>The number of archived findings for the specified internal access analyzer.</p>"
+        },
+        "totalResolvedFindings":{
+          "shape":"Integer",
+          "documentation":"<p>The number of resolved findings for the specified internal access analyzer.</p>"
+        }
+      },
+      "documentation":"<p>Provides aggregate statistics about the findings for the specified internal access analyzer. This includes counts of active, archived, and resolved findings.</p>"
+    },
+    "InternalAccessResourceTypeDetails":{
+      "type":"structure",
+      "members":{
+        "totalActiveFindings":{
+          "shape":"Integer",
+          "documentation":"<p>The total number of active findings for the resource type in the internal access analyzer.</p>"
+        },
+        "totalResolvedFindings":{
+          "shape":"Integer",
+          "documentation":"<p>The total number of resolved findings for the resource type in the internal access analyzer.</p>"
+        },
+        "totalArchivedFindings":{
+          "shape":"Integer",
+          "documentation":"<p>The total number of archived findings for the resource type in the internal access analyzer.</p>"
+        }
+      },
+      "documentation":"<p>Contains information about the total number of active, archived, and resolved findings for a resource type of an internal access analyzer.</p>"
+    },
+    "InternalAccessResourceTypeStatisticsMap":{
+      "type":"map",
+      "key":{"shape":"ResourceType"},
+      "value":{"shape":"InternalAccessResourceTypeDetails"}
+    },
+    "InternalAccessType":{
+      "type":"string",
+      "enum":[
+        "INTRA_ACCOUNT",
+        "INTRA_ORG"
+      ]
+    },
     "InternalServerException":{
       "type":"structure",
       "required":["message"],
@@ -3480,6 +3629,13 @@
       "key":{"shape":"String"},
       "value":{"shape":"String"}
     },
+    "PrincipalType":{
+      "type":"string",
+      "enum":[
+        "IAM_ROLE",
+        "IAM_USER"
+      ]
+    },
     "RdsDbClusterSnapshotAccountId":{"type":"string"},
     "RdsDbClusterSnapshotAccountIdsList":{
       "type":"list",
@@ -3642,12 +3798,17 @@
       "type":"string",
       "pattern":"arn:[^:]*:[^:]*:[^:]*:[^:]*:.*"
     },
+    "ResourceArnsList":{
+      "type":"list",
+      "member":{"shape":"String"}
+    },
     "ResourceControlPolicyRestriction":{
       "type":"string",
       "enum":[
         "APPLICABLE",
         "FAILED_TO_EVALUATE_RCP",
-        "NOT_APPLICABLE"
+        "NOT_APPLICABLE",
+        "APPLIED"
       ]
     },
     "ResourceNotFoundException":{
@@ -3711,6 +3872,10 @@
       },
       "documentation":"<p>Contains information about the total number of active cross-account and public findings for a resource type of an external access analyzer.</p>"
     },
+    "ResourceTypeList":{
+      "type":"list",
+      "member":{"shape":"ResourceType"}
+    },
     "ResourceTypeStatisticsMap":{
       "type":"map",
       "key":{"shape":"ResourceType"},
@@ -3858,6 +4023,15 @@
     },
     "SecretsManagerSecretKmsId":{"type":"string"},
     "SecretsManagerSecretPolicy":{"type":"string"},
+    "ServiceControlPolicyRestriction":{
+      "type":"string",
+      "enum":[
+        "APPLICABLE",
+        "FAILED_TO_EVALUATE_SCP",
+        "NOT_APPLICABLE",
+        "APPLIED"
+      ]
+    },
     "ServiceQuotaExceededException":{
       "type":"structure",
       "required":[
@@ -4150,7 +4324,9 @@
         "ACCOUNT",
         "ORGANIZATION",
         "ACCOUNT_UNUSED_ACCESS",
-        "ORGANIZATION_UNUSED_ACCESS"
+        "ORGANIZATION_UNUSED_ACCESS",
+        "ACCOUNT_INTERNAL_ACCESS",
+        "ORGANIZATION_INTERNAL_ACCESS"
       ]
     },
     "UnprocessableEntityException":{

{botocore-1.38.35 → botocore-1.38.38}/botocore/data/acm/2015-12-08/service-2.json

@@ -24,11 +24,11 @@
       },
       "input":{"shape":"AddTagsToCertificateRequest"},
       "errors":[
-        {"shape":"TagPolicyException"},
         {"shape":"InvalidParameterException"},
+        {"shape":"TagPolicyException"},
         {"shape":"TooManyTagsException"},
-        {"shape":"ThrottlingException"},
         {"shape":"InvalidArnException"},
+        {"shape":"ThrottlingException"},
         {"shape":"InvalidTagException"},
         {"shape":"ResourceNotFoundException"}
       ],
@@ -43,8 +43,8 @@
       "input":{"shape":"DeleteCertificateRequest"},
       "errors":[
         {"shape":"ResourceInUseException"},
-        {"shape":"ThrottlingException"},
         {"shape":"InvalidArnException"},
+        {"shape":"ThrottlingException"},
         {"shape":"ConflictException"},
         {"shape":"AccessDeniedException"},
         {"shape":"ResourceNotFoundException"}
@@ -78,7 +78,7 @@
         {"shape":"RequestInProgressException"},
         {"shape":"ResourceNotFoundException"}
       ],
-      "documentation":"<p>Exports a private certificate issued by a private certificate authority (CA) for use anywhere. The exported file contains the certificate, the certificate chain, and the encrypted private 2048-bit RSA key associated with the public key that is embedded in the certificate. For security, you must assign a passphrase for the private key when exporting it. </p> <p>For information about exporting and formatting a certificate using the ACM console or CLI, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-export-private.html\">Export a Private Certificate</a>.</p>"
+      "documentation":"<p>Exports a private certificate issued by a private certificate authority (CA) or public certificate for use anywhere. The exported file contains the certificate, the certificate chain, and the encrypted private key associated with the public key that is embedded in the certificate. For security, you must assign a passphrase for the private key when exporting it. </p> <p>For information about exporting and formatting a certificate using the ACM console or CLI, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/export-private.html\">Export a private certificate</a> and <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/export-public-certificate\">Export a public certificate</a>.</p>"
     },
     "GetAccountConfiguration":{
       "name":"GetAccountConfiguration",
@@ -117,8 +117,8 @@
       "input":{"shape":"ImportCertificateRequest"},
       "output":{"shape":"ImportCertificateResponse"},
       "errors":[
-        {"shape":"TagPolicyException"},
         {"shape":"InvalidParameterException"},
+        {"shape":"TagPolicyException"},
         {"shape":"TooManyTagsException"},
         {"shape":"InvalidArnException"},
         {"shape":"InvalidTagException"},
@@ -178,10 +178,10 @@
       },
       "input":{"shape":"RemoveTagsFromCertificateRequest"},
       "errors":[
-        {"shape":"TagPolicyException"},
         {"shape":"InvalidParameterException"},
-        {"shape":"ThrottlingException"},
+        {"shape":"TagPolicyException"},
         {"shape":"InvalidArnException"},
+        {"shape":"ThrottlingException"},
         {"shape":"InvalidTagException"},
         {"shape":"ResourceNotFoundException"}
       ],
@@ -199,7 +199,7 @@
         {"shape":"RequestInProgressException"},
         {"shape":"ResourceNotFoundException"}
       ],
-      "documentation":"<p>Renews an eligible ACM certificate. At this time, only exported private certificates can be renewed with this operation. In order to renew your Amazon Web Services Private CA certificates with ACM, you must first <a href=\"https://docs.aws.amazon.com/privateca/latest/userguide/PcaPermissions.html\">grant the ACM service principal permission to do so</a>. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/manual-renewal.html\">Testing Managed Renewal</a> in the ACM User Guide.</p>"
+      "documentation":"<p>Renews an <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html\">eligible ACM certificate</a>. In order to renew your Amazon Web Services Private CA certificates with ACM, you must first <a href=\"https://docs.aws.amazon.com/privateca/latest/userguide/PcaPermissions.html\">grant the ACM service principal permission to do so</a>. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/manual-renewal.html\">Testing Managed Renewal</a> in the ACM User Guide.</p>"
     },
     "RequestCertificate":{
       "name":"RequestCertificate",
@@ -210,15 +210,15 @@
       "input":{"shape":"RequestCertificateRequest"},
       "output":{"shape":"RequestCertificateResponse"},
       "errors":[
-        {"shape":"TagPolicyException"},
         {"shape":"InvalidParameterException"},
+        {"shape":"TagPolicyException"},
         {"shape":"TooManyTagsException"},
         {"shape":"InvalidArnException"},
         {"shape":"InvalidTagException"},
         {"shape":"InvalidDomainValidationOptionsException"},
         {"shape":"LimitExceededException"}
       ],
-      "documentation":"<p>Requests an ACM certificate for use with other Amazon Web Services services. To request an ACM certificate, you must specify a fully qualified domain name (FQDN) in the <code>DomainName</code> parameter. You can also specify additional FQDNs in the <code>SubjectAlternativeNames</code> parameter. </p> <p>If you are requesting a private certificate, domain validation is not required. If you are requesting a public certificate, each domain name that you specify must be validated to verify that you own or control the domain. You can use <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html\">DNS validation</a> or <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-email.html\">email validation</a>. We recommend that you use DNS validation. ACM issues public certificates after receiving approval from the domain owner. </p> <note> <p>ACM behavior differs from the <a href=\"https://datatracker.ietf.org/doc/html/rfc6125#appendix-B.2\">RFC 6125</a> specification of the certificate validation process. ACM first checks for a Subject Alternative Name, and, if it finds one, ignores the common name (CN).</p> </note> <p>After successful completion of the <code>RequestCertificate</code> action, there is a delay of several seconds before you can retrieve information about the new certificate.</p>"
+      "documentation":"<p>Requests an ACM certificate for use with other Amazon Web Services services. To request an ACM certificate, you must specify a fully qualified domain name (FQDN) in the <code>DomainName</code> parameter. You can also specify additional FQDNs in the <code>SubjectAlternativeNames</code> parameter. </p> <p>If you are requesting a private certificate, domain validation is not required. If you are requesting a public certificate, each domain name that you specify must be validated to verify that you own or control the domain. You can use <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html\">DNS validation</a> or <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-email.html\">email validation</a>. We recommend that you use DNS validation.</p> <note> <p>ACM behavior differs from the <a href=\"https://datatracker.ietf.org/doc/html/rfc6125#appendix-B.2\">RFC 6125</a> specification of the certificate validation process. ACM first checks for a Subject Alternative Name, and, if it finds one, ignores the common name (CN).</p> </note> <p>After successful completion of the <code>RequestCertificate</code> action, there is a delay of several seconds before you can retrieve information about the new certificate.</p>"
     },
     "ResendValidationEmail":{
       "name":"ResendValidationEmail",
@@ -235,6 +235,24 @@
       ],
       "documentation":"<p>Resends the email that requests domain ownership validation. The domain owner or an authorized representative must approve the ACM certificate before it can be issued. The certificate can be approved by clicking a link in the mail to navigate to the Amazon certificate approval website and then clicking <b>I Approve</b>. However, the validation email can be blocked by spam filters. Therefore, if you do not receive the original mail, you can request that the mail be resent within 72 hours of requesting the ACM certificate. If more than 72 hours have elapsed since your original request or since your last attempt to resend validation mail, you must request a new certificate. For more information about setting up your contact email addresses, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/setup-email.html\">Configure Email for your Domain</a>. </p>"
     },
+    "RevokeCertificate":{
+      "name":"RevokeCertificate",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"RevokeCertificateRequest"},
+      "output":{"shape":"RevokeCertificateResponse"},
+      "errors":[
+        {"shape":"ResourceInUseException"},
+        {"shape":"InvalidArnException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"ConflictException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"}
+      ],
+      "documentation":"<p>Revokes a public ACM certificate. You can only revoke certificates that have been previously exported.</p>"
+    },
     "UpdateCertificateOptions":{
       "name":"UpdateCertificateOptions",
       "http":{
@@ -248,7 +266,7 @@
         {"shape":"InvalidStateException"},
         {"shape":"ResourceNotFoundException"}
       ],
-      "documentation":"<p>Updates a certificate. Currently, you can use this function to specify whether to opt in to or out of recording your certificate in a certificate transparency log. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency\"> Opting Out of Certificate Transparency Logging</a>. </p>"
+      "documentation":"<p>Updates a certificate. You can use this function to specify whether to opt in to or out of recording your certificate in a certificate transparency log and exporting. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency\"> Opting Out of Certificate Transparency Logging</a> and <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html\">Certificate Manager Exportable Managed Certificates</a>.</p>"
     }
   },
   "shapes":{
@@ -420,6 +438,13 @@
       },
       "documentation":"<p>Contains metadata about an ACM certificate. This structure is returned in the response to a <a>DescribeCertificate</a> request. </p>"
     },
+    "CertificateExport":{
+      "type":"string",
+      "enum":[
+        "ENABLED",
+        "DISABLED"
+      ]
+    },
     "CertificateManagedBy":{
       "type":"string",
       "enum":["CLOUDFRONT"]
@@ -430,9 +455,13 @@
         "CertificateTransparencyLoggingPreference":{
           "shape":"CertificateTransparencyLoggingPreference",
           "documentation":"<p>You can opt out of certificate transparency logging by specifying the <code>DISABLED</code> option. Opt in by specifying <code>ENABLED</code>. </p>"
+        },
+        "Export":{
+          "shape":"CertificateExport",
+          "documentation":"<p>You can opt in to allow the export of your certificates by specifying <code>ENABLED</code>.</p>"
         }
       },
-      "documentation":"<p>Structure that contains options for your certificate. Currently, you can use this only to specify whether to opt in to or out of certificate transparency logging. Some browsers require that public certificates issued for your domain be recorded in a log. Certificates that are not logged typically generate a browser error. Transparency makes it possible for you to detect SSL/TLS certificates that have been mistakenly or maliciously issued for your domain. For general information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency\">Certificate Transparency Logging</a>. </p>"
+      "documentation":"<p>Structure that contains options for your certificate. You can use this structure to specify whether to opt in to or out of certificate transparency logging and export your certificate. </p> <p>Some browsers require that public certificates issued for your domain be recorded in a log. Certificates that are not logged typically generate a browser error. Transparency makes it possible for you to detect SSL/TLS certificates that have been mistakenly or maliciously issued for your domain. For general information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency\">Certificate Transparency Logging</a>.</p> <p>You can export public ACM certificates to use with Amazon Web Services services as well as outside Amazon Web Services Cloud. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html\">Certificate Manager exportable public certificate</a>.</p>"
     },
     "CertificateStatus":{
       "type":"string",
@@ -489,6 +518,10 @@
           "shape":"ExtendedKeyUsageNames",
           "documentation":"<p>Contains a list of Extended Key Usage X.509 v3 extension objects. Each object specifies a purpose for which the certificate public key can be used and consists of a name and an object identifier (OID). </p>"
         },
+        "ExportOption":{
+          "shape":"CertificateExport",
+          "documentation":"<p>Indicates if export is enabled for the certificate.</p>"
+        },
         "InUse":{
           "shape":"NullableBoolean",
           "documentation":"<p>Indicates whether the certificate is currently in use by any Amazon Web Services resources.</p>"
@@ -630,11 +663,11 @@
         },
         "ResourceRecord":{
           "shape":"ResourceRecord",
-          "documentation":"<p>Contains the CNAME record that you add to your DNS database for domain validation. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html\">Use DNS to Validate Domain Ownership</a>.</p> <p>Note: The CNAME information that you need does not include the name of your domain. If you include your domain name in the DNS database CNAME record, validation fails. For example, if the name is \"_a79865eb4cd1a6ab990a45779b4e0b96.yourdomain.com\", only \"_a79865eb4cd1a6ab990a45779b4e0b96\" must be used.</p>"
+          "documentation":"<p>Contains the CNAME record that you add to your DNS database for domain validation. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html\">Use DNS to Validate Domain Ownership</a>.</p> <note> <p>The CNAME information that you need does not include the name of your domain. If you include your domain name in the DNS database CNAME record, validation fails. For example, if the name is <code>_a79865eb4cd1a6ab990a45779b4e0b96.yourdomain.com</code>, only <code>_a79865eb4cd1a6ab990a45779b4e0b96</code> must be used.</p> </note>"
         },
         "HttpRedirect":{
           "shape":"HttpRedirect",
-          "documentation":"<p>Contains information for HTTP-based domain validation of certificates requested through CloudFront and issued by ACM. This field exists only when the certificate type is <code>AMAZON_ISSUED</code> and the validation method is <code>HTTP</code>.</p>"
+          "documentation":"<p>Contains information for HTTP-based domain validation of certificates requested through Amazon CloudFront and issued by ACM. This field exists only when the certificate type is <code>AMAZON_ISSUED</code> and the validation method is <code>HTTP</code>.</p>"
         },
         "ValidationMethod":{
           "shape":"ValidationMethod",
@@ -797,6 +830,10 @@
           "shape":"KeyAlgorithmList",
           "documentation":"<p>Specify one or more algorithms that can be used to generate key pairs.</p> <p>Default filtering returns only <code>RSA_1024</code> and <code>RSA_2048</code> certificates that have at least one domain. To return other certificate types, provide the desired type signatures in a comma-separated list. For example, <code>\"keyTypes\": [\"RSA_2048\",\"RSA_4096\"]</code> returns both <code>RSA_2048</code> and <code>RSA_4096</code> certificates.</p>"
         },
+        "exportOption":{
+          "shape":"CertificateExport",
+          "documentation":"<p>Specify <code>ENABLED</code> or <code>DISABLED</code> to identify certificates that can be exported.</p>"
+        },
         "managedBy":{
           "shape":"CertificateManagedBy",
           "documentation":"<p>Identifies the Amazon Web Services service that manages the certificate issued by ACM.</p>"
@@ -848,7 +885,7 @@
           "documentation":"<p>The URL hosting the validation token. <code>RedirectFrom</code> must return this content or redirect here.</p>"
         }
       },
-      "documentation":"<p>Contains information for HTTP-based domain validation of certificates requested through CloudFront and issued by ACM. This field exists only when the certificate type is <code>AMAZON_ISSUED</code> and the validation method is <code>HTTP</code>.</p>"
+      "documentation":"<p>Contains information for HTTP-based domain validation of certificates requested through Amazon CloudFront and issued by ACM. This field exists only when the certificate type is <code>AMAZON_ISSUED</code> and the validation method is <code>HTTP</code>.</p>"
     },
     "IdempotencyToken":{
       "type":"string",
@@ -903,7 +940,7 @@
       "members":{
         "message":{"shape":"String"}
       },
-      "documentation":"<p>One or more of of request parameters specified is not valid.</p>",
+      "documentation":"<p>One or more of request parameters specified is not valid.</p>",
       "exception":true
     },
     "InvalidArnException":{
@@ -1229,7 +1266,7 @@
         },
         "Options":{
           "shape":"CertificateOptions",
-          "documentation":"<p>Currently, you can use this parameter to specify whether to add the certificate to a certificate transparency log. Certificate transparency makes it possible to detect SSL/TLS certificates that have been mistakenly or maliciously issued. Certificates that have not been logged typically produce an error message in a browser. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency\">Opting Out of Certificate Transparency Logging</a>.</p>"
+          "documentation":"<p>You can use this parameter to specify whether to add the certificate to a certificate transparency log and export your certificate.</p> <p>Certificate transparency makes it possible to detect SSL/TLS certificates that have been mistakenly or maliciously issued. Certificates that have not been logged typically produce an error message in a browser. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency\">Opting Out of Certificate Transparency Logging</a>.</p> <p>You can export public ACM certificates to use with Amazon Web Services services as well as outside the Amazon Web Services Cloud. For more information, see <a href=\"https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html\">Certificate Manager exportable public certificate</a>.</p>"
         },
         "CertificateAuthorityArn":{
           "shape":"PcaArn",
@@ -1343,6 +1380,32 @@
         "A_A_COMPROMISE"
       ]
     },
+    "RevokeCertificateRequest":{
+      "type":"structure",
+      "required":[
+        "CertificateArn",
+        "RevocationReason"
+      ],
+      "members":{
+        "CertificateArn":{
+          "shape":"Arn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the public or private certificate that will be revoked. The ARN must have the following form: </p> <p> <code>arn:aws:acm:region:account:certificate/12345678-1234-1234-1234-123456789012</code> </p>"
+        },
+        "RevocationReason":{
+          "shape":"RevocationReason",
+          "documentation":"<p>Specifies why you revoked the certificate.</p>"
+        }
+      }
+    },
+    "RevokeCertificateResponse":{
+      "type":"structure",
+      "members":{
+        "CertificateArn":{
+          "shape":"Arn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the public or private certificate that was revoked.</p>"
+        }
+      }
+    },
     "ServiceErrorMessage":{"type":"string"},
     "SortBy":{
       "type":"string",
@@ -1427,7 +1490,7 @@
         },
         "Options":{
           "shape":"CertificateOptions",
-          "documentation":"<p>Use to update the options for your certificate. Currently, you can specify whether to add your certificate to a transparency log. Certificate transparency makes it possible to detect SSL/TLS certificates that have been mistakenly or maliciously issued. Certificates that have not been logged typically produce an error message in a browser. </p>"
+          "documentation":"<p>Use to update the options for your certificate. Currently, you can specify whether to add your certificate to a transparency log or export your certificate. Certificate transparency makes it possible to detect SSL/TLS certificates that have been mistakenly or maliciously issued. Certificates that have not been logged typically produce an error message in a browser. </p>"
         }
       }
     },

{botocore-1.38.35 → botocore-1.38.38}/botocore/data/apigateway/2015-07-09/service-2.json

@@ -3769,7 +3769,7 @@
         },
         "domainNameArn":{
           "shape":"String",
-          "documentation":"<p>The ARN of the domain name. Supported only for private custom domain names. </p>"
+          "documentation":"<p>The ARN of the domain name. </p>"
         },
         "certificateName":{
           "shape":"String",
@@ -5373,7 +5373,7 @@
         },
         "timeoutInMillis":{
           "shape":"Integer",
-          "documentation":"<p>Custom timeout between 50 and 29,000 milliseconds. The default value is 29,000 milliseconds or 29 seconds.</p>"
+          "documentation":"<p>Custom timeout between 50 and 29,000 milliseconds. The default value is 29,000 milliseconds or 29 seconds. You can increase the default value to longer than 29 seconds for Regional or private APIs only.</p>"
         },
         "cacheNamespace":{
           "shape":"String",
@@ -5983,7 +5983,7 @@
         },
         "timeoutInMillis":{
           "shape":"NullableInteger",
-          "documentation":"<p>Custom timeout between 50 and 29,000 milliseconds. The default value is 29,000 milliseconds or 29 seconds.</p>"
+          "documentation":"<p>Custom timeout between 50 and 29,000 milliseconds. The default value is 29,000 milliseconds or 29 seconds. You can increase the default value to longer than 29 seconds for Regional or private APIs only.</p>"
         },
         "tlsConfig":{"shape":"TlsConfig"}
       },

{botocore-1.38.35 → botocore-1.38.38}/botocore/data/apigatewayv2/2018-11-29/service-2.json

@@ -360,7 +360,7 @@
     },
     "CreateRoutingRule": {
       "name": "CreateRoutingRule",
-      "documentation": "<p>Creates a RoutingRule</p>",
+      "documentation": "<p>Creates a RoutingRule.</p>",
       "http": {
         "method": "POST",
         "requestUri": "/v2/domainnames/{domainName}/routingrules",