feat: update L1 CloudFormation resource definitions

[aws-cdk-automation]

Updates the L1 CloudFormation resource definitions with the latest changes from @aws-cdk/aws-service-spec

L1 CloudFormation resource definition changes:

├[~] service aws-amazonmq
│ └ resources
│    └[~]  resource AWS::AmazonMQ::Broker
│       └ properties
│          └[+] ResourceShareArns: Array<string>
├[~] service aws-apigatewayv2
│ └ resources
│    └[~]  resource AWS::ApiGatewayV2::Integration
│       └      - arnTemplate: arn:${Partition}:apigateway:${Region}::/apis/${ApiId}/integrations
│              + arnTemplate: undefined
├[~] service aws-arcregionswitch
│ └ resources
│    └[~]  resource AWS::ARCRegionSwitch::Plan
│       └      - arnTemplate: arn:${Partition}:arc-region-switch::${Account}:plan/${ResourceId}
│              + arnTemplate: arn:${Partition}:arc-region-switch:${Region}:${Account}:plan/${ResourceId}
├[~] service aws-bedrock
│ └ resources
│    ├[~]  resource AWS::Bedrock::DataSource
│    │  ├ attributes
│    │  │  └ DataSourceStatus: - string<AVAILABLE|DELETING|DELETE_UNSUCCESSFUL>
│    │  │                      + string<AVAILABLE|DELETING|DELETE_UNSUCCESSFUL|CREATING|UPDATING|FAILED>
│    │  └ types
│    │     ├[+]  type AudioExtractionConfiguration
│    │     │  ├      documentation: Configuration for audio extraction.
│    │     │  │      name: AudioExtractionConfiguration
│    │     │  └ properties
│    │     │     └ AudioExtractionStatus: string<ENABLED|DISABLED> (required)
│    │     ├[~] type DataSourceConfiguration
│    │     │ └ properties
│    │     │    ├[+] ManagedKnowledgeBaseConnectorConfiguration: ManagedKnowledgeBaseConnectorConfiguration
│    │     │    └ Type: - string<S3|CONFLUENCE|SALESFORCE|SHAREPOINT|WEB|CUSTOM|REDSHIFT_METADATA> (required, immutable)
│    │     │            + string<S3|CONFLUENCE|SALESFORCE|SHAREPOINT|WEB|CUSTOM|REDSHIFT_METADATA|MANAGED_KNOWLEDGE_BASE_CONNECTOR> (required, immutable)
│    │     ├[+]  type DeletionProtectionConfiguration
│    │     │  ├      documentation: Configuration for deletion protection.
│    │     │  │      name: DeletionProtectionConfiguration
│    │     │  └ properties
│    │     │     ├ DeletionProtectionStatus: string<ENABLED|DISABLED> (required)
│    │     │     └ DeletionProtectionThreshold: integer (default=15)
│    │     ├[+]  type ImageExtractionConfiguration
│    │     │  ├      documentation: Configuration for image extraction.
│    │     │  │      name: ImageExtractionConfiguration
│    │     │  └ properties
│    │     │     └ ImageExtractionStatus: string<ENABLED|DISABLED> (required)
│    │     ├[+]  type ManagedKnowledgeBaseConnectorConfiguration
│    │     │  ├      documentation: Configuration for managed knowledge base connector data sources.
│    │     │  │      name: ManagedKnowledgeBaseConnectorConfiguration
│    │     │  └ properties
│    │     │     ├ DeletionProtectionConfiguration: DeletionProtectionConfiguration
│    │     │     ├ MediaExtractionConfiguration: MediaExtractionConfiguration
│    │     │     └ ConnectorParameters: json
│    │     ├[+]  type MediaExtractionConfiguration
│    │     │  ├      documentation: Configuration for media extraction settings.
│    │     │  │      name: MediaExtractionConfiguration
│    │     │  └ properties
│    │     │     ├ ImageExtractionConfiguration: ImageExtractionConfiguration
│    │     │     ├ AudioExtractionConfiguration: AudioExtractionConfiguration
│    │     │     └ VideoExtractionConfiguration: VideoExtractionConfiguration
│    │     ├[~] type ParsingConfiguration
│    │     │ └ properties
│    │     │    └ ParsingStrategy: - string<BEDROCK_FOUNDATION_MODEL|BEDROCK_DATA_AUTOMATION> (required)
│    │     │                       + string<BEDROCK_FOUNDATION_MODEL|BEDROCK_DATA_AUTOMATION|SMART_PARSING> (required)
│    │     └[+]  type VideoExtractionConfiguration
│    │        ├      documentation: Configuration for video extraction.
│    │        │      name: VideoExtractionConfiguration
│    │        └ properties
│    │           └ VideoExtractionStatus: string<ENABLED|DISABLED> (required)
│    └[~]  resource AWS::Bedrock::KnowledgeBase
│       ├ attributes
│       │  └ Status: - string<CREATING|ACTIVE|DELETING|UPDATING|FAILED|DELETE_UNSUCCESSFUL>
│       │            + string<CREATING|ACTIVE|DELETING|UPDATING|FAILED|DELETE_UNSUCCESSFUL|UPDATE_UNSUCCESSFUL>
│       └ types
│          ├[~] type KnowledgeBaseConfiguration
│          │ └ properties
│          │    ├[+] ManagedKnowledgeBaseConfiguration: ManagedKnowledgeBaseConfiguration (immutable)
│          │    └ Type: - string<VECTOR|KENDRA|SQL> (required, immutable)
│          │            + string<VECTOR|KENDRA|SQL|MANAGED> (required, immutable)
│          ├[+]  type ManagedKnowledgeBaseConfiguration
│          │  ├      documentation: Contains details about the model used to create vector embeddings for a managed knowledge base.
│          │  │      name: ManagedKnowledgeBaseConfiguration
│          │  └ properties
│          │     ├ EmbeddingModelArn: string (required)
│          │     ├ EmbeddingModelType: string<CUSTOM|MANAGED>
│          │     ├ EmbeddingModelConfiguration: EmbeddingModelConfiguration
│          │     └ ServerSideEncryptionConfiguration: ManagedKnowledgeBaseServerSideEncryptionConfiguration
│          └[+]  type ManagedKnowledgeBaseServerSideEncryptionConfiguration
│             ├      documentation: Contains details about the server-side encryption for the managed knowledge base.
│             │      name: ManagedKnowledgeBaseServerSideEncryptionConfiguration
│             └ properties
│                └ KmsKeyArn: string
├[~] service aws-bedrockagentcore
│ └ resources
│    ├[~]  resource AWS::BedrockAgentCore::ConfigurationBundle
│    │  └ properties
│    │     └[+] KmsKeyArn: string
│    ├[~]  resource AWS::BedrockAgentCore::GatewayTarget
│    │  ├ properties
│    │  │  └ Name: - string (required)
│    │  │          + string
│    │  └ types
│    │     ├[+]  type ConnectorConfiguration
│    │     │  ├      name: ConnectorConfiguration
│    │     │  └ properties
│    │     │     ├ Name: string (required)
│    │     │     ├ Description: string
│    │     │     ├ ParameterValues: json
│    │     │     └ ParameterOverrides: Array<ConnectorParameterOverride>
│    │     ├[+]  type ConnectorParameterOverride
│    │     │  ├      name: ConnectorParameterOverride
│    │     │  └ properties
│    │     │     ├ Path: string (required)
│    │     │     ├ Description: string
│    │     │     └ Visible: boolean
│    │     ├[+]  type ConnectorSource
│    │     │  ├      name: ConnectorSource
│    │     │  └ properties
│    │     │     └ ConnectorId: string (required)
│    │     ├[+]  type ConnectorTargetConfiguration
│    │     │  ├      name: ConnectorTargetConfiguration
│    │     │  └ properties
│    │     │     ├ Source: ConnectorSource (required)
│    │     │     ├ Enabled: Array<string>
│    │     │     └ Configurations: Array<ConnectorConfiguration>
│    │     ├[+]  type HttpApiSchemaConfiguration
│    │     │  ├      name: HttpApiSchemaConfiguration
│    │     │  └ properties
│    │     │     └ Source: ApiSchemaConfiguration (required)
│    │     ├[~] type HttpTargetConfiguration
│    │     │ └ properties
│    │     │    ├ AgentcoreRuntime: - RuntimeTargetConfiguration (required)
│    │     │    │                   + RuntimeTargetConfiguration
│    │     │    └[+] Passthrough: PassthroughTargetConfiguration
│    │     ├[~] type McpTargetConfiguration
│    │     │ └ properties
│    │     │    └[+] Connector: ConnectorTargetConfiguration
│    │     ├[+]  type PassthroughTargetConfiguration
│    │     │  ├      name: PassthroughTargetConfiguration
│    │     │  └ properties
│    │     │     ├ Endpoint: string (required)
│    │     │     ├ ProtocolType: string<MCP|A2A|INFERENCE|CUSTOM> (required)
│    │     │     ├ Schema: HttpApiSchemaConfiguration
│    │     │     └ StickinessConfiguration: StickinessConfiguration
│    │     ├[~] type RuntimeTargetConfiguration
│    │     │ └ properties
│    │     │    └[+] Schema: HttpApiSchemaConfiguration
│    │     └[+]  type StickinessConfiguration
│    │        ├      name: StickinessConfiguration
│    │        └ properties
│    │           ├ Identifier: string (required)
│    │           └ Timeout: integer
│    ├[~]  resource AWS::BedrockAgentCore::Harness
│    │  ├      - documentation: Definition of AWS::BedrockAgentCore::Harness resource type - a managed agentic loop service that provides a turnkey solution for running stateful, tool-equipped AI agents.
│    │  │      + documentation: Resource Type definition for AWS::BedrockAgentCore::Harness - a managed agentic loop service that provides a turnkey solution for running stateful, tool-equipped AI agents.
│    │  ├ attributes
│    │  │  ├[+] Memory.ManagedMemoryConfiguration.Arn: string
│    │  │  └[+] Version: string
│    │  └ types
│    │     ├[~] type CustomJWTAuthorizerConfiguration
│    │     │ └ properties
│    │     │    ├[+] PrivateEndpoint: PrivateEndpoint
│    │     │    └[+] PrivateEndpointOverrides: Array<PrivateEndpointOverride>
│    │     ├[+]  type EfsAccessPointConfiguration
│    │     │  ├      documentation: Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
│    │     │  │      name: EfsAccessPointConfiguration
│    │     │  └ properties
│    │     │     ├ AccessPointArn: string (required)
│    │     │     └ MountPath: string (required)
│    │     ├[~] type FilesystemConfiguration
│    │     │ └ properties
│    │     │    ├[+] EfsAccessPoint: EfsAccessPointConfiguration
│    │     │    ├[+] S3FilesAccessPoint: S3FilesAccessPointConfiguration
│    │     │    └ SessionStorage: - SessionStorageConfiguration (required)
│    │     │                      + SessionStorageConfiguration
│    │     ├[~] type HarnessAgentCoreMemoryRetrievalConfig
│    │     │ └ properties
│    │     │    ├ RelevanceScore: - number
│    │     │    │                 + number | string
│    │     │    └ TopK: - integer
│    │     │            + integer | string
│    │     ├[~] type HarnessAgentCoreRuntimeEnvironment
│    │     │ └ properties
│    │     │    └ NetworkConfiguration: - NetworkConfiguration (immutable)
│    │     │                            + NetworkConfiguration
│    │     ├[~] type HarnessBedrockModelConfig
│    │     │ └ properties
│    │     │    └[+] ApiFormat: string<converse_stream|responses|chat_completions>
│    │     ├[+]  type HarnessLiteLlmModelConfig
│    │     │  ├      name: HarnessLiteLlmModelConfig
│    │     │  └ properties
│    │     │     ├ ModelId: string (required)
│    │     │     ├ ApiKeyArn: string
│    │     │     ├ ApiBase: string
│    │     │     ├ MaxTokens: integer
│    │     │     ├ Temperature: number
│    │     │     └ TopP: number
│    │     ├[+]  type HarnessManagedMemoryConfiguration
│    │     │  ├      documentation: Configuration for managed memory. The harness creates and manages a memory resource in the customer's account.
│    │     │  │      name: HarnessManagedMemoryConfiguration
│    │     │  └ properties
│    │     │     ├ Arn: string
│    │     │     ├ Strategies: Array<string<SEMANTIC|SUMMARIZATION|USER_PREFERENCE|EPISODIC>>
│    │     │     ├ EventExpiryDuration: integer
│    │     │     └ EncryptionKeyArn: string (immutable)
│    │     ├[~] type HarnessMemoryConfiguration
│    │     │ └ properties
│    │     │    ├[+] Disabled: json
│    │     │    └[+] ManagedMemoryConfiguration: HarnessManagedMemoryConfiguration
│    │     ├[~] type HarnessModelConfiguration
│    │     │ └ properties
│    │     │    └[+] LiteLlmModelConfig: HarnessLiteLlmModelConfig
│    │     ├[~] type HarnessOpenAiModelConfig
│    │     │ └ properties
│    │     │    └[+] ApiFormat: string<chat_completions|responses>
│    │     ├[~] type HarnessSkill
│    │     │ └ properties
│    │     │    ├[+] AwsSkills: HarnessSkillAwsSkillsSource
│    │     │    ├[+] Git: HarnessSkillGitSource
│    │     │    ├ Path: - string (required)
│    │     │    │       + string
│    │     │    └[+] S3: HarnessSkillS3Source
│    │     ├[+]  type HarnessSkillAwsSkillsSource
│    │     │  ├      documentation: AWS Skills baked into the Harness's underlying Runtime.
│    │     │  │      name: HarnessSkillAwsSkillsSource
│    │     │  └ properties
│    │     │     └ Paths: Array<string>
│    │     ├[+]  type HarnessSkillGitAuth
│    │     │  ├      documentation: Authentication configuration for accessing a private git repository.
│    │     │  │      name: HarnessSkillGitAuth
│    │     │  └ properties
│    │     │     ├ CredentialArn: string (required)
│    │     │     └ Username: string
│    │     ├[+]  type HarnessSkillGitSource
│    │     │  ├      documentation: A git repository containing the skill, cloned over HTTPS.
│    │     │  │      name: HarnessSkillGitSource
│    │     │  └ properties
│    │     │     ├ Url: string (required)
│    │     │     ├ Path: string
│    │     │     └ Auth: HarnessSkillGitAuth
│    │     ├[+]  type HarnessSkillS3Source
│    │     │  ├      documentation: An S3 source containing the skill.
│    │     │  │      name: HarnessSkillS3Source
│    │     │  └ properties
│    │     │     └ Uri: string (required)
│    │     ├[+]  type ManagedVpcResource
│    │     │  ├      documentation: Configuration for a service-managed VPC endpoint.
│    │     │  │      name: ManagedVpcResource
│    │     │  └ properties
│    │     │     ├ VpcIdentifier: string (required)
│    │     │     ├ SubnetIds: Array<string> (required)
│    │     │     ├ EndpointIpAddressType: string<IPV4|IPV6> (required)
│    │     │     ├ SecurityGroupIds: Array<string>
│    │     │     ├ Tags: Map<string, string>
│    │     │     └ RoutingDomain: string
│    │     ├[+]  type PrivateEndpoint
│    │     │  ├      documentation: Private endpoint configuration for connecting to the OpenID Connect discovery endpoint over a private network.
│    │     │  │      name: PrivateEndpoint
│    │     │  └ properties
│    │     │     ├ SelfManagedLatticeResource: SelfManagedLatticeResource
│    │     │     └ ManagedVpcResource: ManagedVpcResource
│    │     ├[+]  type PrivateEndpointOverride
│    │     │  ├      documentation: Maps a domain to a private endpoint for resolving that domain over a private network.
│    │     │  │      name: PrivateEndpointOverride
│    │     │  └ properties
│    │     │     ├ Domain: string (required)
│    │     │     └ PrivateEndpoint: PrivateEndpoint (required)
│    │     ├[+]  type S3FilesAccessPointConfiguration
│    │     │  ├      documentation: Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
│    │     │  │      name: S3FilesAccessPointConfiguration
│    │     │  └ properties
│    │     │     ├ AccessPointArn: string (required)
│    │     │     └ MountPath: string (required)
│    │     └[+]  type SelfManagedLatticeResource
│    │        ├      documentation: Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
│    │        │      name: SelfManagedLatticeResource
│    │        └ properties
│    │           └ ResourceConfigurationIdentifier: string (required)
│    └[~]  resource AWS::BedrockAgentCore::Policy
│       ├ properties
│       │  └[+] EnforcementMode: string<ACTIVE|LOG_ONLY> (default="ACTIVE")
│       └ types
│          ├[~] type PolicyDefinition
│          │ └ properties
│          │    ├ Cedar: - CedarPolicy (required)
│          │    │        + CedarPolicy
│          │    └[+] Policy: PolicyStatement
│          └[+]  type PolicyStatement
│             ├      documentation: A policy statement within the AgentCore Policy system.
│             │      name: PolicyStatement
│             └ properties
│                └ Statement: string (required)
├[~] service aws-chatbot
│ └ resources
│    └[~]  resource AWS::Chatbot::SlackChannelConfiguration
│       └      - arnTemplate: undefined
│              + arnTemplate: arn:${Partition}:chatbot::${Account}:chat-configuration/slack-channel/${ConfigurationName}
├[~] service aws-cloudwatch
│ └ resources
│    └[~]  resource AWS::CloudWatch::LogAlarm
│       └ types
│          └[~] type ScheduledQueryConfiguration
│            └ properties
│               └[-] QueryLanguage: string (required)
├[~] service aws-codepipeline
│ └ resources
│    └[~]  resource AWS::CodePipeline::Webhook
│       ├      - tagInformation: undefined
│       │      + tagInformation: {"tagPropertyName":"Tags","variant":"standard"}
│       └ properties
│          └[+] Tags: Array<tag>
├[~] service aws-cognito
│ └ resources
│    └[~]  resource AWS::Cognito::UserPoolDomain
│       ├ properties
│       │  └[+] Routing: RoutingType
│       └ types
│          ├[+]  type FailoverType
│          │  ├      name: FailoverType
│          │  └ properties
│          │     ├ SecondaryRegion: string (required)
│          │     └ PrimaryRoute53HealthCheckId: string (required)
│          └[+]  type RoutingType
│             ├      name: RoutingType
│             └ properties
│                └ Failover: FailoverType
├[~] service aws-datapipeline
│ └ resources
│    └[~]  resource AWS::DataPipeline::Pipeline
│       └      - arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineId}
│              + arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineID}
├[~] service aws-directoryservice
│ └ resources
│    └[~]  resource AWS::DirectoryService::MicrosoftAD
│       └      - arnTemplate: arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}
│              + arnTemplate: arn:${Partition}:ds:${Region}:${Account}:${DirectoryId}
├[~] service aws-ecs
│ └ resources
│    └[~]  resource AWS::ECS::Service
│       ├ properties
│       │  └[+] Monitoring: MonitoringConfiguration
│       └ types
│          ├[+]  type MetricConfiguration
│          │  ├      name: MetricConfiguration
│          │  └ properties
│          │     ├ ResolutionSeconds: integer<20|60> (required)
│          │     └ MetricNames: Array<string<CPUUtilization|MemoryUtilization>> (required)
│          └[+]  type MonitoringConfiguration
│             ├      name: MonitoringConfiguration
│             └ properties
│                └ MetricConfigurations: Array<MetricConfiguration> (required)
├[~] service aws-eks
│ └ resources
│    └[~]  resource AWS::EKS::Cluster
│       └ types
│          └[~] type ResourcesVpcConfig
│            └ properties
│               └[+] ControlPlaneEgressMode: string
├[~] service aws-elasticloadbalancing
│ └ resources
│    └[~]  resource AWS::ElasticLoadBalancing::LoadBalancer
│       ├      - primaryIdentifier: ["Id"]
│       │      + primaryIdentifier: ["LoadBalancerName"]
│       └ attributes
│          └[-] Id: string
├[~] service aws-gamelift
│ └ resources
│    └[~]  resource AWS::GameLift::ContainerGroupDefinition
│       └ types
│          ├[~] type GameServerContainerDefinition
│          │ └ properties
│          │    └[+] LinuxCapabilities: LinuxCapabilities
│          ├[+]  type LinuxCapabilities
│          │  ├      documentation: A set of Linux capabilities that are added to a container's default Docker configuration. For more detailed information, see the capabilities(7) Linux manual page.
│          │  │      name: LinuxCapabilities
│          │  └ properties
│          │     └ Include: Array<string<AUDIT_CONTROL|AUDIT_WRITE|BLOCK_SUSPEND|CHOWN|DAC_OVERRIDE|DAC_READ_SEARCH|FOWNER|FSETID|IPC_LOCK|IPC_OWNER|KILL|LEASE|LINUX_IMMUTABLE|MAC_ADMIN|MAC_OVERRIDE|MKNOD|NET_ADMIN|NET_BIND_SERVICE|NET_BROADCAST|NET_RAW|SETFCAP|SETGID|SETPCAP|SETUID|SYS_ADMIN|SYS_BOOT|SYS_CHROOT|SYS_MODULE|SYS_NICE|SYS_PACCT|SYS_PTRACE|SYS_RAWIO|SYS_RESOURCE|SYS_TIME|SYS_TTY_CONFIG|SYSLOG|WAKE_ALARM>>
│          └[~] type SupportContainerDefinition
│            └ properties
│               └[+] LinuxCapabilities: LinuxCapabilities
├[~] service aws-iotwireless
│ └ resources
│    └[~]  resource AWS::IoTWireless::WirelessDeviceImportTask
│       └      - arnTemplate: arn:${Partition}:iotwireless:${Region}:${Account}:ImportTask/${ImportTaskId}
│              + arnTemplate: arn:${Partition}:iotwireless:${Region}:${Account}:WirelessDeviceImportTask/${WirelessDeviceImportTaskId}
├[~] service aws-lambda
│ └ resources
│    ├[~]  resource AWS::Lambda::CapacityProvider
│    │  └ types
│    │     └[~] type PropagateTagsConfig
│    │       └      - documentation: undefined
│    │              + documentation: Configuration that defines how tags are propagated to managed resources.
│    ├[~]  resource AWS::Lambda::LayerVersion
│    │  └ types
│    │     └[~] type Content
│    │       └ properties
│    │          └[+] S3ObjectStorageMode: string<COPY|REFERENCE>
│    ├[+]  resource AWS::Lambda::MicrovmImage
│    │  ├      name: MicrovmImage
│    │  │      cloudFormationType: AWS::Lambda::MicrovmImage
│    │  │      documentation: Resource Type definition for AWS::Lambda::MicrovmImage
│    │  │      tagInformation: {"tagPropertyName":"Tags","variant":"standard"}
│    │  │      arnTemplate: arn:${Partition}:lambda:${Region}:${Account}:microvm-image:${MicrovmImageName}
│    │  │      primaryIdentifier: ["ImageArn"]
│    │  ├ properties
│    │  │  ├ Name: string (required, immutable)
│    │  │  ├ BaseImageArn: string (required)
│    │  │  ├ BaseImageVersion: string (required)
│    │  │  ├ BuildRoleArn: string (required)
│    │  │  ├ Description: string (required)
│    │  │  ├ CodeArtifact: CodeArtifact (required)
│    │  │  ├ Logging: Logging (required)
│    │  │  ├ EgressNetworkConnectors: Array<string> (required)
│    │  │  ├ CpuConfigurations: Array<CpuConfiguration> (required)
│    │  │  ├ Resources: Array<Resources> (required)
│    │  │  ├ AdditionalOsCapabilities: Array<string<ALL>> (required)
│    │  │  ├ Hooks: Hooks (required)
│    │  │  ├ EnvironmentVariables: Array<EnvironmentVariable> (required)
│    │  │  └ Tags: Array<tag>
│    │  ├ attributes
│    │  │  ├ ImageArn: string
│    │  │  ├ State: string<CREATING|CREATED|CREATE_FAILED|UPDATING|UPDATED|UPDATE_FAILED|DELETING|DELETE_FAILED|DELETED>
│    │  │  ├ LatestActiveImageVersion: string
│    │  │  ├ LatestFailedImageVersion: string
│    │  │  ├ CreatedAt: string
│    │  │  └ UpdatedAt: string
│    │  └ types
│    │     ├ type CloudWatchLogging
│    │     │ ├      name: CloudWatchLogging
│    │     │ └ properties
│    │     │    ├ LogGroup: string
│    │     │    └ LogStream: string
│    │     ├ type CodeArtifact
│    │     │ ├      name: CodeArtifact
│    │     │ └ properties
│    │     │    └ Uri: string (required)
│    │     ├ type CpuConfiguration
│    │     │ ├      name: CpuConfiguration
│    │     │ └ properties
│    │     │    └ Architecture: string<ARM_64> (required)
│    │     ├ type EnvironmentVariable
│    │     │ ├      name: EnvironmentVariable
│    │     │ └ properties
│    │     │    ├ Key: string (required)
│    │     │    └ Value: string (required)
│    │     ├ type Hooks
│    │     │ ├      name: Hooks
│    │     │ └ properties
│    │     │    ├ Port: integer
│    │     │    ├ MicrovmHooks: MicrovmHooks
│    │     │    └ MicrovmImageHooks: MicrovmImageHooks
│    │     ├ type Logging
│    │     │ ├      name: Logging
│    │     │ └ properties
│    │     │    ├ Disabled: boolean (default=false)
│    │     │    └ CloudWatch: CloudWatchLogging
│    │     ├ type MicrovmHooks
│    │     │ ├      name: MicrovmHooks
│    │     │ └ properties
│    │     │    ├ Run: string<DISABLED|ENABLED>
│    │     │    ├ RunTimeoutInSeconds: integer
│    │     │    ├ Resume: string<DISABLED|ENABLED>
│    │     │    ├ ResumeTimeoutInSeconds: integer
│    │     │    ├ Suspend: string<DISABLED|ENABLED>
│    │     │    ├ SuspendTimeoutInSeconds: integer
│    │     │    ├ Terminate: string<DISABLED|ENABLED>
│    │     │    └ TerminateTimeoutInSeconds: integer
│    │     ├ type MicrovmImageHooks
│    │     │ ├      name: MicrovmImageHooks
│    │     │ └ properties
│    │     │    ├ Ready: string<DISABLED|ENABLED>
│    │     │    ├ ReadyTimeoutInSeconds: integer
│    │     │    ├ Validate: string<DISABLED|ENABLED>
│    │     │    └ ValidateTimeoutInSeconds: integer
│    │     └ type Resources
│    │       ├      name: Resources
│    │       └ properties
│    │          └ MinimumMemoryInMiB: integer (required)
│    └[+]  resource AWS::Lambda::NetworkConnector
│       ├      name: NetworkConnector
│       │      cloudFormationType: AWS::Lambda::NetworkConnector
│       │      documentation: Resource Type definition for AWS::Lambda::NetworkConnector
│       │      tagInformation: {"tagPropertyName":"Tags","variant":"standard"}
│       │      arnTemplate: arn:${Partition}:lambda:${Region}:${Account}:network-connector:${NetworkConnectorId}
│       │      primaryIdentifier: ["Arn"]
│       ├ properties
│       │  ├ Name: string (immutable)
│       │  ├ Configuration: Config (required)
│       │  ├ OperatorRole: string
│       │  └ Tags: Array<tag>
│       ├ attributes
│       │  ├ Arn: string
│       │  └ State: string<PENDING|ACTIVE|INACTIVE|FAILED|DELETING|DELETE_FAILED>
│       └ types
│          ├ type Config
│          │ ├      documentation: The network configuration for the connector. Specify a VpcEgressConfiguration to enable outbound traffic routing through your VPC.
│          │ │      name: Config
│          │ └ properties
│          │    └ VpcEgressConfiguration: VpcEgressConfiguration (required)
│          └ type VpcEgressConfiguration
│            ├      documentation: The VPC egress configuration for the network connector. Specifies the subnets, security groups, and network protocol for routing outbound traffic through your VPC.
│            │      name: VpcEgressConfiguration
│            └ properties
│               ├ SubnetIds: Array<string> (required)
│               ├ SecurityGroupIds: Array<string>
│               ├ NetworkProtocol: string<IPv4|DualStack>
│               └ AssociatedComputeResourceTypes: Array<string<MicroVm>> (required)
├[~] service aws-medialive
│ └ resources
│    └[~]  resource AWS::MediaLive::Channel
│       └ types
│          ├[+]  type AudioFeedInput
│          │  ├      name: AudioFeedInput
│          │  └ properties
│          │     ├ AudioSelectorName: string
│          │     └ FeedInput: string
│          ├[~] type AudioNormalizationSettings
│          │ └ properties
│          │    ├[+] PeakCalculation: string
│          │    └[+] PeakLimiterThreshold: number
│          ├[+]  type AudioPid
│          │  ├      name: AudioPid
│          │  └ properties
│          │     ├ DolbyEDecode: AudioDolbyEDecode
│          │     ├ PremixSettings: AudioPreMixerSettings
│          │     └ Pid: integer
│          ├[~] type AudioPidSelection
│          │ └ properties
│          │    └[+] Pids: Array<AudioPid>
│          ├[+]  type AudioPreMixerSettings
│          │  ├      name: AudioPreMixerSettings
│          │  └ properties
│          │     ├ AudioNormalizationSettings: AudioNormalizationSettings
│          │     ├ RemixSettings: RemixSettings
│          │     ├ GainDb: number
│          │     └ Channels: integer
│          ├[~] type AudioTrack
│          │ └ properties
│          │    └[+] PremixSettings: AudioPreMixerSettings
│          ├[~] type CaptionSelectorSettings
│          │ └ properties
│          │    └[+] SmartSubtitleSourceSettings: SmartSubtitleSourceSettings
│          ├[~] type InferenceSettings
│          │ └ properties
│          │    └[+] AudioFeedInputs: Array<AudioFeedInput>
│          └[+]  type SmartSubtitleSourceSettings
│             ├      name: SmartSubtitleSourceSettings
│             └ properties
│                ├ InferenceFeedOutput: string
│                └ CaptionSynchronizationMode: string
├[~] service aws-mediatailor
│ └ resources
│    └[~]  resource AWS::MediaTailor::SourceLocation
│       └      - arnTemplate: arn:${Partition}:mediatailor:${Region}:${Account}:sourceLocation/${SourceLocationName}
│              + arnTemplate: arn:${Partition}:mediatailor:${Region}:${Account}:sourceLocation/${ResourceId}
├[~] service aws-msk
│ └ resources
│    └[~]  resource AWS::MSK::Replicator
│       └ types
│          ├[~] type KafkaClusterClientAuthentication
│          │ └ properties
│          │    ├[+] MTLS: KafkaClusterMtlsAuthentication
│          │    └ SaslScram: - KafkaClusterSaslScramAuthentication (required)
│          │                 + KafkaClusterSaslScramAuthentication
│          └[+]  type KafkaClusterMtlsAuthentication
│             ├      documentation: Details for mTLS client authentication.
│             │      name: KafkaClusterMtlsAuthentication
│             └ properties
│                └ SecretArn: string (required)
├[~] service aws-neptune
│ └ resources
│    ├[~]  resource AWS::Neptune::DBCluster
│    │  └      - arnTemplate: arn:aws:rds:${Region}:${Account}:cluster:${DBClusterId}
│    │         + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName}
│    └[~]  resource AWS::Neptune::DBClusterParameterGroup
│       └      - arnTemplate: arn:aws:rds:${Region}:${Account}:cluster-pg:${ClusterPGName}
│              + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName}
├[~] service aws-networkfirewall
│ └ resources
│    └[~]  resource AWS::NetworkFirewall::RuleGroup
│       └      - arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateless-rulegroup/${Name}
│              + arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateful-rulegroup/${Name}
├[~] service aws-networkmanager
│ └ resources
│    ├[~]  resource AWS::NetworkManager::ConnectPeer
│    │  └      - arnTemplate: arn:${Partition}:networkmanager::${Account}:connect-peer/${ConnectPeerId}
│    │         + arnTemplate: arn:${Partition}:networkmanager::${Account}:connect-peer/${ResourceId}
│    └[~]  resource AWS::NetworkManager::GlobalNetwork
│       └      - arnTemplate: arn:${Partition}:networkmanager::${Account}:global-network/${ResourceId}
│              + arnTemplate: arn:${Partition}:networkmanager::${Account}:global-network/${GlobalNetworkId}
├[~] service aws-pcs
│ └ resources
│    └[~]  resource AWS::PCS::Cluster
│       └ properties
│          └ Scheduler: - Scheduler (required, immutable)
│                       + Scheduler (required)
├[~] service aws-pinpoint
│ └ resources
│    ├[~]  resource AWS::Pinpoint::EmailTemplate
│    │  └      - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH
│    │         + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/VOICE
│    ├[~]  resource AWS::Pinpoint::InAppTemplate
│    │  └      - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH
│    │         + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/VOICE
│    └[~]  resource AWS::Pinpoint::PushTemplate
│       └      - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH
│              + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/VOICE
├[~] service aws-quicksight
│ └ resources
│    └[~]  resource AWS::QuickSight::Analysis
│       └      - arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:analysis/${AnalysisId}
│              + arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:analysis/${ResourceId}
├[~] service aws-ram
│ └ resources
│    └[~]  resource AWS::RAM::ResourceShare
│       ├ properties
│       │  └[+] ResourceShareConfiguration: ResourceShareConfiguration
│       └ types
│          └[+]  type ResourceShareConfiguration
│             ├      documentation: The configuration for a resource share.
│             │      name: ResourceShareConfiguration
│             └ properties
│                ├ ExclusiveAccountAccess: boolean
│                └ RetainSharingOnAccountLeaveOrganization: boolean (immutable)
├[~] service aws-rds
│ └ resources
│    ├[~]  resource AWS::RDS::DBCluster
│    │  └      - arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster:${ClusterName}
│    │         + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName}
│    ├[~]  resource AWS::RDS::DBInstance
│    │  └      - arnTemplate: arn:${Partition}:rds:${Region}:${Account}:db:${DBInstanceId}
│    │         + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}
│    └[~]  resource AWS::RDS::DBShardGroup
│       └      - arnTemplate: undefined
│              + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:shard-group:${DbShardGroupResourceId}
├[~] service aws-s3
│ └ resources
│    └[~]  resource AWS::S3::Bucket
│       ├ attributes
│       │  ├[+] MetadataConfiguration.AnnotationTableConfiguration.TableArn: string
│       │  └[+] MetadataConfiguration.AnnotationTableConfiguration.TableName: string
│       └ types
│          ├[+]  type AnnotationTableConfiguration
│          │  ├      name: AnnotationTableConfiguration
│          │  └ properties
│          │     ├ TableName: string
│          │     ├ TableArn: string
│          │     ├ ConfigurationState: string<ENABLED|DISABLED> (required)
│          │     ├ EncryptionConfiguration: MetadataTableEncryptionConfiguration
│          │     └ Role: string
│          └[~] type MetadataConfiguration
│            └ properties
│               └[+] AnnotationTableConfiguration: AnnotationTableConfiguration
├[~] service aws-sagemaker
│ └ resources
│    └[~]  resource AWS::SageMaker::Cluster
│       ├ properties
│       │  └[+] RestrictedInstanceGroupsConfig: RestrictedInstanceGroupsConfig
│       └ types
│          ├[~] type ClusterRestrictedInstanceGroup
│          │ └ properties
│          │    └ EnvironmentConfig: - EnvironmentConfig (required)
│          │                         + EnvironmentConfig
│          ├[+]  type RestrictedInstanceGroupsConfig
│          │  ├      documentation: The cluster-level configuration for restricted instance groups, including shared environment settings for inter-RIG communication and FSx Lustre sharing.
│          │  │      name: RestrictedInstanceGroupsConfig
│          │  └ properties
│          │     └ SharedEnvironmentConfig: SharedEnvironmentConfig (required)
│          └[+]  type SharedEnvironmentConfig
│             ├      documentation: The shared environment configuration for restricted instance groups that use cluster-level shared FSx Lustre storage.
│             │      name: SharedEnvironmentConfig
│             └ properties
│                ├ FSxLustreDeletionPolicy: string<Keep|DeleteIfNotUsed> (required)
│                └ FSxLustreConfig: FSxLustreConfig
└[~] service aws-wafv2
  └ resources
     ├[~]  resource AWS::WAFv2::LoggingConfiguration
     │  └ types
     │     └[~] type ActionCondition
     │       └ properties
     │          └ Action: - string<ALLOW|BLOCK|COUNT|CAPTCHA|CHALLENGE|EXCLUDED_AS_COUNT> (required)
     │                    + string<ALLOW|BLOCK|COUNT|CAPTCHA|CHALLENGE|MONETIZE|EXCLUDED_AS_COUNT> (required)
     ├[~]  resource AWS::WAFv2::RuleGroup
     │  ├ properties
     │  │  └[+] MonetizationConfig: MonetizationConfig
     │  └ types
     │     ├[+]  type CryptoConfig
     │     │  ├      documentation: Configures cryptocurrency payment settings.
     │     │  │      name: CryptoConfig
     │     │  └ properties
     │     │     └ PaymentNetworks: Array<PaymentNetwork> (required)
     │     ├[+]  type MonetizationConfig
     │     │  ├      documentation: Configures monetization for the web ACL or rule group.
     │     │  │      name: MonetizationConfig
     │     │  └ properties
     │     │     ├ CryptoConfig: CryptoConfig
     │     │     └ CurrencyMode: string<REAL|TEST>
     │     ├[+]  type MonetizeAction
     │     │  ├      documentation: Monetize action for rules.
     │     │  │      name: MonetizeAction
     │     │  └ properties
     │     │     └ PriceMultiplier: string
     │     ├[+]  type PaymentNetwork
     │     │  ├      documentation: Configuration for a single payment network.
     │     │  │      name: PaymentNetwork
     │     │  └ properties
     │     │     ├ Chain: string<BASE|SOLANA|BASE_SEPOLIA|SOLANA_DEVNET> (required)
     │     │     ├ WalletAddress: string (required)
     │     │     └ Prices: Array<Price> (required)
     │     ├[+]  type Price
     │     │  ├      documentation: A price configuration.
     │     │  │      name: Price
     │     │  └ properties
     │     │     ├ Amount: string (required)
     │     │     └ Currency: string<USDC> (required)
     │     └[~] type RuleAction
     │       └ properties
     │          └[+] Monetize: MonetizeAction
     └[~]  resource AWS::WAFv2::WebACL
        ├ properties
        │  └[+] MonetizationConfig: MonetizationConfig
        └ types
           ├[+]  type CryptoConfig
           │  ├      documentation: Configures cryptocurrency payment settings.
           │  │      name: CryptoConfig
           │  └ properties
           │     └ PaymentNetworks: Array<PaymentNetwork> (required)
           ├[+]  type MonetizationConfig
           │  ├      documentation: Configures monetization for the web ACL or rule group.
           │  │      name: MonetizationConfig
           │  └ properties
           │     ├ CryptoConfig: CryptoConfig
           │     └ CurrencyMode: string<REAL|TEST>
           ├[+]  type MonetizeAction
           │  ├      documentation: Monetize action for rules.
           │  │      name: MonetizeAction
           │  └ properties
           │     └ PriceMultiplier: string
           ├[+]  type PaymentNetwork
           │  ├      documentation: Configuration for a single payment network.
           │  │      name: PaymentNetwork
           │  └ properties
           │     ├ Chain: string<BASE|SOLANA|BASE_SEPOLIA|SOLANA_DEVNET> (required)
           │     ├ WalletAddress: string (required)
           │     └ Prices: Array<Price> (required)
           ├[+]  type Price
           │  ├      documentation: A price configuration.
           │  │      name: Price
           │  └ properties
           │     ├ Amount: string (required)
           │     └ Currency: string<USDC> (required)
           └[~] type RuleAction
             └ properties
                └[+] Monetize: MonetizeAction

CHANGES TO L1 RESOURCES

L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-cloudwatch: AWS::CloudWatch::LogAlarm: QueryLanguage property has been removed from the ScheduledQueryConfiguration type.
• aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: Id attribute has been removed and the primary identifier is now LoadBalancerName.

[github-actions]

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-02 06:55 UTC · Rule: default-squash · triggered by rule automatic merge
• ✅ Checks passed · in-place
• ✅ Merged — 2026-07-02 07:41 UTC · at e7df4ecba4b2c1b01ab7116cb1fed98ac8e539d8 · squash

This pull request spent 45 minutes 59 seconds in the queue, including 45 minutes 45 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat: update L1 CloudFormation resource definitions #38189
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.