diff --git a/asff/generated.py b/asff/generated.py index b6fe5d6..166c2f0 100644 --- a/asff/generated.py +++ b/asff/generated.py @@ -50,7 +50,7 @@ class Config: class Severity(ASFFBaseModel): """ - The severity of the finding. The finding provider can provide the initial severity, but cannot update it after that. The severity can only be updated by a master account. It cannot be updated by a member account. The finding must have either Label or Normalized populated. If only one of these attributes is populated, then Security Hub automatically populates the other one. If neither attribute is populated, then the finding is invalid. Label is the preferred attribute. + The severity of the finding. The finding provider can provide the initial severity. The finding provider can only update the severity if it has not been updated using BatchUpdateFindings. The finding must have either Label or Normalized populated. If only one of these attributes is populated, then Security Hub automatically populates the other one. If neither attribute is populated, then the finding is invalid. Label is the preferred attribute. :param product: Deprecated. This attribute is being deprecated. Instead of providing Product, provide Original. The native severity as defined by the AWS service or integrated partner product that generated the finding. :param label: The severity value of the finding. The allowed values are the following. INFORMATIONAL - No issue was found. LOW - The issue does not require action on its own. MEDIUM - The issue must be addressed but not urgently. HIGH - The issue must be addressed as a priority. CRITICAL - The issue must be remediated immediately to avoid it escalating. If you provide Normalized and do not provide Label, then Label is set automatically as follows. 0 - INFORMATIONAL 1–39 - LOW 40–69 - MEDIUM 70–89 - HIGH 90–100 - CRITICAL @@ -393,6 +393,47 @@ class AwsCodeBuildProjectDetails(ASFFBaseModel): vpc_config: Optional[AwsCodeBuildProjectVpcConfig] +class AwsCloudFrontDistributionCacheBehavior(ASFFBaseModel): + """ + Information about a cache behavior for the distribution. + + :param viewer_protocol_policy: The protocol that viewers can use to access the files in an origin. You can specify the following options: allow-all - Viewers can use HTTP or HTTPS. redirect-to-https - CloudFront responds to HTTP requests with an HTTP status code of 301 (Moved Permanently) and the HTTPS URL. The viewer then uses the new URL to resubmit. https-only - CloudFront responds to HTTP request with an HTTP status code of 403 (Forbidden). + + :return: AwsCloudFrontDistributionCacheBehavior object + """ + + viewer_protocol_policy: Optional[NonEmptyString] + + +AwsCloudFrontDistributionCacheBehaviorsItemList = List[ + AwsCloudFrontDistributionCacheBehavior +] + + +class AwsCloudFrontDistributionCacheBehaviors(ASFFBaseModel): + """ + Provides information about caching for the distribution. + + :param items: The cache behaviors for the distribution. + + :return: AwsCloudFrontDistributionCacheBehaviors object + """ + + items: Optional[AwsCloudFrontDistributionCacheBehaviorsItemList] + + +class AwsCloudFrontDistributionDefaultCacheBehavior(ASFFBaseModel): + """ + Contains information about the default cache configuration for the distribution. + + :param viewer_protocol_policy: The protocol that viewers can use to access the files in an origin. You can specify the following options: allow-all - Viewers can use HTTP or HTTPS. redirect-to-https - CloudFront responds to HTTP requests with an HTTP status code of 301 (Moved Permanently) and the HTTPS URL. The viewer then uses the new URL to resubmit. https-only - CloudFront responds to HTTP request with an HTTP status code of 403 (Forbidden). + + :return: AwsCloudFrontDistributionDefaultCacheBehavior object + """ + + viewer_protocol_policy: Optional[NonEmptyString] + + class AwsCloudFrontDistributionLogging(ASFFBaseModel): """ A complex type that controls whether access logs are written for the distribution. @@ -411,6 +452,18 @@ class AwsCloudFrontDistributionLogging(ASFFBaseModel): prefix: Optional[NonEmptyString] +class AwsCloudFrontDistributionOriginS3OriginConfig(ASFFBaseModel): + """ + Information about an origin that is an S3 bucket that is not configured with static website hosting. + + :param origin_access_identity: The CloudFront origin access identity to associate with the origin. + + :return: AwsCloudFrontDistributionOriginS3OriginConfig object + """ + + origin_access_identity: Optional[NonEmptyString] + + class AwsCloudFrontDistributionOriginItem(ASFFBaseModel): """ A complex type that describes the Amazon S3 bucket, HTTP server (for example, a web server), Amazon Elemental MediaStore, or other server from which CloudFront gets your files. @@ -418,6 +471,7 @@ class AwsCloudFrontDistributionOriginItem(ASFFBaseModel): :param domain_name: Amazon S3 origins: The DNS name of the Amazon S3 bucket from which you want CloudFront to get objects for this origin. :param id: A unique identifier for the origin or origin group. :param origin_path: An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin. + :param s3_origin_config: An origin that is an S3 bucket that is not configured with static website hosting. :return: AwsCloudFrontDistributionOriginItem object """ @@ -425,6 +479,7 @@ class AwsCloudFrontDistributionOriginItem(ASFFBaseModel): domain_name: Optional[NonEmptyString] id: Optional[NonEmptyString] origin_path: Optional[NonEmptyString] + s3_origin_config: Optional[AwsCloudFrontDistributionOriginS3OriginConfig] AwsCloudFrontDistributionOriginItemList = List[AwsCloudFrontDistributionOriginItem] @@ -442,26 +497,92 @@ class AwsCloudFrontDistributionOrigins(ASFFBaseModel): items: Optional[AwsCloudFrontDistributionOriginItemList] +AwsCloudFrontDistributionOriginGroupFailoverStatusCodesItemList = List[Integer] + + +class AwsCloudFrontDistributionOriginGroupFailoverStatusCodes(ASFFBaseModel): + """ + The status codes that cause an origin group to fail over. + + :param items: The list of status code values that can cause a failover to the next origin. + :param quantity: The number of status codes that can cause a failover. + + :return: AwsCloudFrontDistributionOriginGroupFailoverStatusCodes object + """ + + items: Optional[AwsCloudFrontDistributionOriginGroupFailoverStatusCodesItemList] + quantity: Optional[Integer] + + +class AwsCloudFrontDistributionOriginGroupFailover(ASFFBaseModel): + """ + Provides information about when an origin group fails over. + + :param status_codes: Information about the status codes that cause an origin group to fail over. + + :return: AwsCloudFrontDistributionOriginGroupFailover object + """ + + status_codes: Optional[AwsCloudFrontDistributionOriginGroupFailoverStatusCodes] + + +class AwsCloudFrontDistributionOriginGroup(ASFFBaseModel): + """ + Information about an origin group for the distribution. + + :param failover_criteria: Provides the criteria for an origin group to fail over. + + :return: AwsCloudFrontDistributionOriginGroup object + """ + + failover_criteria: Optional[AwsCloudFrontDistributionOriginGroupFailover] + + +AwsCloudFrontDistributionOriginGroupsItemList = List[ + AwsCloudFrontDistributionOriginGroup +] + + +class AwsCloudFrontDistributionOriginGroups(ASFFBaseModel): + """ + Provides information about origin groups that are associated with the distribution. + + :param items: The list of origin groups. + + :return: AwsCloudFrontDistributionOriginGroups object + """ + + items: Optional[AwsCloudFrontDistributionOriginGroupsItemList] + + class AwsCloudFrontDistributionDetails(ASFFBaseModel): """ A distribution configuration. + :param cache_behaviors: Provides information about the cache configuration for the distribution. + :param default_cache_behavior: The default cache behavior for the configuration. + :param default_root_object: The object that CloudFront sends in response to requests from the origin (for example, index.html) when a viewer requests the root URL for the distribution (http://www.example.com) instead of an object in your distribution (http://www.example.com/product-description.html). :param domain_name: The domain name corresponding to the distribution. :param e_tag: The entity tag is a hash of the object. :param last_modified_time: Indicates when that the distribution was last modified. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. :param logging: A complex type that controls whether access logs are written for the distribution. :param origins: A complex type that contains information about origins for this distribution. + :param origin_groups: Provides information about the origin groups in the distribution. :param status: Indicates the current status of the distribution. :param web_acl_id: A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. :return: AwsCloudFrontDistributionDetails object """ + cache_behaviors: Optional[AwsCloudFrontDistributionCacheBehaviors] + default_cache_behavior: Optional[AwsCloudFrontDistributionDefaultCacheBehavior] + default_root_object: Optional[NonEmptyString] domain_name: Optional[NonEmptyString] e_tag: Optional[NonEmptyString] last_modified_time: Optional[Iso8601Timestamp] logging: Optional[AwsCloudFrontDistributionLogging] origins: Optional[AwsCloudFrontDistributionOrigins] + origin_groups: Optional[AwsCloudFrontDistributionOriginGroups] status: Optional[NonEmptyString] web_acl_id: Optional[NonEmptyString] @@ -1084,6 +1205,54 @@ class AwsSecretsManagerSecretDetails(ASFFBaseModel): AwsIamAccessKeyStatus = constr(regex="^(Active|Inactive)$") +class AwsIamAccessKeySessionContextAttributes(ASFFBaseModel): + """ + Attributes of the session that the key was used for. + + :param mfa_authenticated: Indicates whether the session used multi-factor authentication (MFA). + :param creation_date: Indicates when the session was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + + :return: AwsIamAccessKeySessionContextAttributes object + """ + + mfa_authenticated: Optional[Boolean] + creation_date: Optional[Iso8601Timestamp] + + +class AwsIamAccessKeySessionContextSessionIssuer(ASFFBaseModel): + """ + Information about the entity that created the session. + + :param type: The type of principal (user, role, or group) that created the session. + :param principal_id: The principal ID of the principal (user, role, or group) that created the session. + :param arn: The ARN of the session. + :param account_id: The identifier of the AWS account that created the session. + :param user_name: The name of the principal that created the session. + + :return: AwsIamAccessKeySessionContextSessionIssuer object + """ + + type: Optional[NonEmptyString] + principal_id: Optional[NonEmptyString] + arn: Optional[NonEmptyString] + account_id: Optional[NonEmptyString] + user_name: Optional[NonEmptyString] + + +class AwsIamAccessKeySessionContext(ASFFBaseModel): + """ + Provides information about the session that the key was used for. + + :param attributes: Attributes of the session that the key was used for. + :param session_issuer: Information about the entity that created the session. + + :return: AwsIamAccessKeySessionContext object + """ + + attributes: Optional[AwsIamAccessKeySessionContextAttributes] + session_issuer: Optional[AwsIamAccessKeySessionContextSessionIssuer] + + class AwsIamAccessKeyDetails(ASFFBaseModel): """ IAM access key details related to a finding. @@ -1094,6 +1263,9 @@ class AwsIamAccessKeyDetails(ASFFBaseModel): :param principal_id: The ID of the principal associated with an access key. :param principal_type: The type of principal associated with an access key. :param principal_name: The name of the principal. + :param account_id: The AWS account ID of the account for the key. + :param access_key_id: The identifier of the access key. + :param session_context: Information about the session that the key was used for. :return: AwsIamAccessKeyDetails object """ @@ -1104,11 +1276,14 @@ class AwsIamAccessKeyDetails(ASFFBaseModel): principal_id: Optional[NonEmptyString] principal_type: Optional[NonEmptyString] principal_name: Optional[NonEmptyString] + account_id: Optional[NonEmptyString] + access_key_id: Optional[NonEmptyString] + session_context: Optional[AwsIamAccessKeySessionContext] class AwsIamAttachedManagedPolicy(ASFFBaseModel): """ - A managed policy that is attached to an IAM user. + A managed policy that is attached to an IAM principal. :param policy_name: The name of the policy. :param policy_arn: The ARN of the policy. @@ -1125,9 +1300,9 @@ class AwsIamAttachedManagedPolicy(ASFFBaseModel): class AwsIamPermissionsBoundary(ASFFBaseModel): """ - Information about the policy used to set the permissions boundary for an IAM user. + Information about the policy used to set the permissions boundary for an IAM principal. - :param permissions_boundary_arn: The ARN of the policy used to set the permissions boundary for the user. + :param permissions_boundary_arn: The ARN of the policy used to set the permissions boundary. :param permissions_boundary_type: The usage type for the permissions boundary. :return: AwsIamPermissionsBoundary object @@ -1229,6 +1404,126 @@ class AwsIamPolicyDetails(ASFFBaseModel): update_date: Optional[Iso8601Timestamp] +class AwsApiGatewayV2RouteSettings(ASFFBaseModel): + """ + Contains route settings for a stage. + + :param detailed_metrics_enabled: Indicates whether detailed metrics are enabled. + :param logging_level: The logging level. The logging level affects the log entries that are pushed to CloudWatch Logs. Supported only for WebSocket APIs. If the logging level is ERROR, then the logs only include error-level entries. If the logging level is INFO, then the logs include both ERROR events and extra informational events. Valid values: OFF | ERROR | INFO + :param data_trace_enabled: Indicates whether data trace logging is enabled. Data trace logging affects the log entries that are pushed to CloudWatch Logs. Supported only for WebSocket APIs. + :param throttling_burst_limit: The throttling burst limit. + :param throttling_rate_limit: The throttling rate limit. + + :return: AwsApiGatewayV2RouteSettings object + """ + + detailed_metrics_enabled: Optional[Boolean] + logging_level: Optional[NonEmptyString] + data_trace_enabled: Optional[Boolean] + throttling_burst_limit: Optional[Integer] + throttling_rate_limit: Optional[Double] + + +class AwsApiGatewayAccessLogSettings(ASFFBaseModel): + """ + Contains information about settings for logging access for the stage. + + :param format: A single-line format of the access logs of data, as specified by selected $context variables. The format must include at least $context.requestId. + :param destination_arn: The ARN of the CloudWatch Logs log group that receives the access logs. + + :return: AwsApiGatewayAccessLogSettings object + """ + + format: Optional[NonEmptyString] + destination_arn: Optional[NonEmptyString] + + +class AwsApiGatewayV2StageDetails(ASFFBaseModel): + """ + Contains information about a version 2 stage for Amazon API Gateway. + + :param created_date: Indicates when the stage was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param description: The description of the stage. + :param default_route_settings: Default route settings for the stage. + :param deployment_id: The identifier of the deployment that the stage is associated with. + :param last_updated_date: Indicates when the stage was most recently updated. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param route_settings: The route settings for the stage. + :param stage_name: The name of the stage. + :param stage_variables: A map that defines the stage variables for the stage. Variable names can have alphanumeric and underscore characters. Variable values can contain the following characters: Uppercase and lowercase letters Numbers Special characters -._~:/?#&=, + :param access_log_settings: Information about settings for logging access for the stage. + :param auto_deploy: Indicates whether updates to an API automatically trigger a new deployment. + :param last_deployment_status_message: The status of the last deployment of a stage. Supported only if the stage has automatic deployment enabled. + :param api_gateway_managed: Indicates whether the stage is managed by API Gateway. + + :return: AwsApiGatewayV2StageDetails object + """ + + created_date: Optional[Iso8601Timestamp] + description: Optional[NonEmptyString] + default_route_settings: Optional[AwsApiGatewayV2RouteSettings] + deployment_id: Optional[NonEmptyString] + last_updated_date: Optional[NonEmptyString] + route_settings: Optional[AwsApiGatewayV2RouteSettings] + stage_name: Optional[NonEmptyString] + stage_variables: Optional[FieldMap] + access_log_settings: Optional[AwsApiGatewayAccessLogSettings] + auto_deploy: Optional[Boolean] + last_deployment_status_message: Optional[NonEmptyString] + api_gateway_managed: Optional[Boolean] + + +class AwsCorsConfiguration(ASFFBaseModel): + """ + Contains the cross-origin resource sharing (CORS) configuration for the API. CORS is only supported for HTTP APIs. + + :param allow_origins: The allowed origins for CORS requests. + :param allow_credentials: Indicates whether the CORS request includes credentials. + :param expose_headers: The exposed headers for CORS requests. + :param max_age: The number of seconds for which the browser caches preflight request results. + :param allow_methods: The allowed methods for CORS requests. + :param allow_headers: The allowed headers for CORS requests. + + :return: AwsCorsConfiguration object + """ + + allow_origins: Optional[NonEmptyStringList] + allow_credentials: Optional[Boolean] + expose_headers: Optional[NonEmptyStringList] + max_age: Optional[Integer] + allow_methods: Optional[NonEmptyStringList] + allow_headers: Optional[NonEmptyStringList] + + +class AwsApiGatewayV2ApiDetails(ASFFBaseModel): + """ + Contains information about a version 2 API in Amazon API Gateway. + + :param api_endpoint: The URI of the API. Uses the format <api-id>.execute-api.<region>.amazonaws.com The stage name is typically appended to the URI to form a complete path to a deployed API stage. + :param api_id: The identifier of the API. + :param api_key_selection_expression: An API key selection expression. Supported only for WebSocket APIs. + :param created_date: Indicates when the API was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param description: A description of the API. + :param version: The version identifier for the API. + :param name: The name of the API. + :param protocol_type: The API protocol for the API. Valid values: WEBSOCKET | HTTP + :param route_selection_expression: The route selection expression for the API. For HTTP APIs, must be ${request.method} ${request.path}. This is the default value for HTTP APIs. For WebSocket APIs, there is no default value. + :param cors_configuration: A cross-origin resource sharing (CORS) configuration. Supported only for HTTP APIs. + + :return: AwsApiGatewayV2ApiDetails object + """ + + api_endpoint: Optional[NonEmptyString] + api_id: Optional[NonEmptyString] + api_key_selection_expression: Optional[NonEmptyString] + created_date: Optional[Iso8601Timestamp] + description: Optional[NonEmptyString] + version: Optional[NonEmptyString] + name: Optional[NonEmptyString] + protocol_type: Optional[NonEmptyString] + route_selection_expression: Optional[NonEmptyString] + cors_configuration: Optional[AwsCorsConfiguration] + + class AwsDynamoDbTableAttributeDefinition(ASFFBaseModel): """ Contains a definition of an attribute for the table. @@ -1524,170 +1819,1260 @@ class AwsDynamoDbTableDetails(ASFFBaseModel): table_status: Optional[NonEmptyString] -AwsIamRoleAssumeRolePolicyDocument = constr( - regex="[\u0009\u000A\u000D\u0020-\u007E\u00A1-\u00FF]+", - min_length=1, - max_length=131072, -) +class AwsApiGatewayMethodSettings(ASFFBaseModel): + """ + Defines settings for a method for the stage. + :param metrics_enabled: Indicates whether CloudWatch metrics are enabled for the method. + :param logging_level: The logging level for this method. The logging level affects the log entries that are pushed to CloudWatch Logs. If the logging level is ERROR, then the logs only include error-level entries. If the logging level is INFO, then the logs include both ERROR events and extra informational events. Valid values: OFF | ERROR | INFO + :param data_trace_enabled: Indicates whether data trace logging is enabled for the method. Data trace logging affects the log entries that are pushed to CloudWatch Logs. + :param throttling_burst_limit: The throttling burst limit for the method. + :param throttling_rate_limit: The throttling rate limit for the method. + :param caching_enabled: Indicates whether responses are cached and returned for requests. For responses to be cached, a cache cluster must be enabled on the stage. + :param cache_ttl_in_seconds: Specifies the time to live (TTL), in seconds, for cached responses. The higher the TTL, the longer the response is cached. + :param cache_data_encrypted: Indicates whether the cached responses are encrypted. + :param require_authorization_for_cache_control: Indicates whether authorization is required for a cache invalidation request. + :param unauthorized_cache_control_header_strategy: Indicates how to handle unauthorized requests for cache invalidation. Valid values: FAIL_WITH_403 | SUCCEED_WITH_RESPONSE_HEADER | SUCCEED_WITHOUT_RESPONSE_HEADER + :param http_method: The HTTP method. You can use an asterisk (*) as a wildcard to apply method settings to multiple methods. + :param resource_path: The resource path for this method. Forward slashes (/) are encoded as ~1 . The initial slash must include a forward slash. For example, the path value /resource/subresource must be encoded as /~1resource~1subresource. To specify the root path, use only a slash (/). You can use an asterisk (*) as a wildcard to apply method settings to multiple methods. -class AwsIamRoleDetails(ASFFBaseModel): + :return: AwsApiGatewayMethodSettings object """ - Contains information about an IAM role, including all of the role's policies. - :param assume_role_policy_document: The trust policy that grants permission to assume the role. - :param create_date: Indicates when the role was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. - :param role_id: The stable and unique string identifying the role. - :param role_name: The friendly name that identifies the role. - :param max_session_duration: The maximum session duration (in seconds) that you want to set for the specified role. - :param path: The path to the role. + metrics_enabled: Optional[Boolean] + logging_level: Optional[NonEmptyString] + data_trace_enabled: Optional[Boolean] + throttling_burst_limit: Optional[Integer] + throttling_rate_limit: Optional[Double] + caching_enabled: Optional[Boolean] + cache_ttl_in_seconds: Optional[Integer] + cache_data_encrypted: Optional[Boolean] + require_authorization_for_cache_control: Optional[Boolean] + unauthorized_cache_control_header_strategy: Optional[NonEmptyString] + http_method: Optional[NonEmptyString] + resource_path: Optional[NonEmptyString] - :return: AwsIamRoleDetails object + +AwsApiGatewayMethodSettingsList = List[AwsApiGatewayMethodSettings] + + +class AwsApiGatewayCanarySettings(ASFFBaseModel): """ + Contains information about settings for canary deployment in the stage. - assume_role_policy_document: Optional[AwsIamRoleAssumeRolePolicyDocument] - create_date: Optional[Iso8601Timestamp] - role_id: Optional[NonEmptyString] - role_name: Optional[NonEmptyString] - max_session_duration: Optional[Integer] - path: Optional[NonEmptyString] + :param percent_traffic: The percentage of traffic that is diverted to a canary deployment. + :param deployment_id: The deployment identifier for the canary deployment. + :param stage_variable_overrides: Stage variables that are overridden in the canary release deployment. The variables include new stage variables that are introduced in the canary. Each variable is represented as a string-to-string map between the stage variable name and the variable value. + :param use_stage_cache: Indicates whether the canary deployment uses the stage cache. + + :return: AwsApiGatewayCanarySettings object + """ + percent_traffic: Optional[Double] + deployment_id: Optional[NonEmptyString] + stage_variable_overrides: Optional[FieldMap] + use_stage_cache: Optional[Boolean] -class AwsKmsKeyDetails(ASFFBaseModel): + +class AwsApiGatewayStageDetails(ASFFBaseModel): """ - Contains metadata about a customer master key (CMK). + Provides information about a version 1 Amazon API Gateway stage. - :param aws_account_id: The twelve-digit account ID of the AWS account that owns the CMK. - :param creation_date: Indicates when the CMK was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. - :param key_id: The globally unique identifier for the CMK. - :param key_manager: The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed. - :param key_state: The state of the CMK. - :param origin: The source of the CMK's key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material. When this value is AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store. - :param description: A description of the key. + :param deployment_id: The identifier of the deployment that the stage points to. + :param client_certificate_id: The identifier of the client certificate for the stage. + :param stage_name: The name of the stage. + :param description: A description of the stage. + :param cache_cluster_enabled: Indicates whether a cache cluster is enabled for the stage. + :param cache_cluster_size: If a cache cluster is enabled, the size of the cache cluster. + :param cache_cluster_status: If a cache cluster is enabled, the status of the cache cluster. + :param method_settings: Defines the method settings for the stage. + :param variables: A map that defines the stage variables for the stage. Variable names can have alphanumeric and underscore characters. Variable values can contain the following characters: Uppercase and lowercase letters Numbers Special characters -._~:/?#&=, + :param documentation_version: The version of the API documentation that is associated with the stage. + :param access_log_settings: Settings for logging access for the stage. + :param canary_settings: Information about settings for canary deployment in the stage. + :param tracing_enabled: Indicates whether active tracing with AWS X-Ray is enabled for the stage. + :param created_date: Indicates when the stage was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param last_updated_date: Indicates when the stage was most recently updated. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param web_acl_arn: The ARN of the web ACL associated with the stage. - :return: AwsKmsKeyDetails object + :return: AwsApiGatewayStageDetails object """ - aws_account_id: Optional[NonEmptyString] - creation_date: Optional[Iso8601Timestamp] - key_id: Optional[NonEmptyString] - key_manager: Optional[NonEmptyString] - key_state: Optional[NonEmptyString] - origin: Optional[NonEmptyString] + deployment_id: Optional[NonEmptyString] + client_certificate_id: Optional[NonEmptyString] + stage_name: Optional[NonEmptyString] description: Optional[NonEmptyString] + cache_cluster_enabled: Optional[Boolean] + cache_cluster_size: Optional[NonEmptyString] + cache_cluster_status: Optional[NonEmptyString] + method_settings: Optional[AwsApiGatewayMethodSettingsList] + variables: Optional[FieldMap] + documentation_version: Optional[NonEmptyString] + access_log_settings: Optional[AwsApiGatewayAccessLogSettings] + canary_settings: Optional[AwsApiGatewayCanarySettings] + tracing_enabled: Optional[Boolean] + created_date: Optional[Iso8601Timestamp] + last_updated_date: Optional[NonEmptyString] + web_acl_arn: Optional[NonEmptyString] -class AwsLambdaFunctionCode(ASFFBaseModel): +class AwsApiGatewayEndpointConfiguration(ASFFBaseModel): """ - The code for the Lambda function. You can specify either an object in Amazon S3, or upload a deployment package directly. + Contains information about the endpoints for the API. - :param s3_bucket: An Amazon S3 bucket in the same AWS Region as your function. The bucket can be in a different AWS account. - :param s3_key: The Amazon S3 key of the deployment package. - :param s3_object_version: For versioned objects, the version of the deployment package object to use. - :param zip_file: The base64-encoded contents of the deployment package. AWS SDK and AWS CLI clients handle the encoding for you. + :param types: A list of endpoint types for the REST API. For an edge-optimized API, the endpoint type is EDGE. For a Regional API, the endpoint type is REGIONAL. For a private API, the endpoint type is PRIVATE. - :return: AwsLambdaFunctionCode object + :return: AwsApiGatewayEndpointConfiguration object """ - s3_bucket: Optional[NonEmptyString] - s3_key: Optional[NonEmptyString] - s3_object_version: Optional[NonEmptyString] - zip_file: Optional[NonEmptyString] + types: Optional[NonEmptyStringList] -class AwsLambdaFunctionDeadLetterConfig(ASFFBaseModel): +class AwsApiGatewayRestApiDetails(ASFFBaseModel): """ - The dead-letter queue for failed asynchronous invocations. + contains information about a REST API in version 1 of Amazon API Gateway. - :param target_arn: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. + :param id: The identifier of the REST API. + :param name: The name of the REST API. + :param description: A description of the REST API. + :param created_date: Indicates when the API was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param version: The version identifier for the REST API. + :param binary_media_types: The list of binary media types supported by the REST API. + :param minimum_compression_size: The minimum size in bytes of a payload before compression is enabled. If null, then compression is disabled. If 0, then all payloads are compressed. + :param api_key_source: The source of the API key for metering requests according to a usage plan. HEADER indicates whether to read the API key from the X-API-Key header of a request. AUTHORIZER indicates whether to read the API key from the UsageIdentifierKey from a custom authorizer. + :param endpoint_configuration: The endpoint configuration of the REST API. - :return: AwsLambdaFunctionDeadLetterConfig object + :return: AwsApiGatewayRestApiDetails object """ - target_arn: Optional[NonEmptyString] + id: Optional[NonEmptyString] + name: Optional[NonEmptyString] + description: Optional[NonEmptyString] + created_date: Optional[Iso8601Timestamp] + version: Optional[NonEmptyString] + binary_media_types: Optional[NonEmptyStringList] + minimum_compression_size: Optional[Integer] + api_key_source: Optional[NonEmptyString] + endpoint_configuration: Optional[AwsApiGatewayEndpointConfiguration] + + +class AwsCloudTrailTrailDetails(ASFFBaseModel): + """ + Provides details about a CloudTrail trail. + + :param cloud_watch_logs_log_group_arn: The ARN of the log group that CloudTrail logs are delivered to. + :param cloud_watch_logs_role_arn: The ARN of the role that the CloudWatch Logs endpoint assumes when it writes to the log group. + :param has_custom_event_selectors: Indicates whether the trail has custom event selectors. + :param home_region: The Region where the trail was created. + :param include_global_service_events: Indicates whether the trail publishes events from global services such as IAM to the log files. + :param is_multi_region_trail: Indicates whether the trail applies only to the current Region or to all Regions. + :param is_organization_trail: Whether the trail is created for all accounts in an organization in AWS Organizations, or only for the current AWS account. + :param kms_key_id: The AWS KMS key ID to use to encrypt the logs. + :param log_file_validation_enabled: Indicates whether CloudTrail log file validation is enabled. + :param name: The name of the trail. + :param s3_bucket_name: The name of the S3 bucket where the log files are published. + :param s3_key_prefix: The S3 key prefix. The key prefix is added after the name of the S3 bucket where the log files are published. + :param sns_topic_arn: The ARN of the SNS topic that is used for notifications of log file delivery. + :param sns_topic_name: The name of the SNS topic that is used for notifications of log file delivery. + :param trail_arn: The ARN of the trail. + + :return: AwsCloudTrailTrailDetails object + """ + + cloud_watch_logs_log_group_arn: Optional[NonEmptyString] + cloud_watch_logs_role_arn: Optional[NonEmptyString] + has_custom_event_selectors: Optional[Boolean] + home_region: Optional[NonEmptyString] + include_global_service_events: Optional[Boolean] + is_multi_region_trail: Optional[Boolean] + is_organization_trail: Optional[Boolean] + kms_key_id: Optional[NonEmptyString] + log_file_validation_enabled: Optional[Boolean] + name: Optional[NonEmptyString] + s3_bucket_name: Optional[NonEmptyString] + s3_key_prefix: Optional[NonEmptyString] + sns_topic_arn: Optional[NonEmptyString] + sns_topic_name: Optional[NonEmptyString] + trail_arn: Optional[NonEmptyString] -class AwsLambdaFunctionEnvironmentError(ASFFBaseModel): +class AwsCertificateManagerCertificateExtendedKeyUsage(ASFFBaseModel): """ - Error messages for environment variables that couldn't be applied. + Contains information about an extended key usage X.509 v3 extension object. - :param error_code: The error code. - :param message: The error message. + :param name: The name of an extension value. Indicates the purpose for which the certificate public key can be used. + :param o_id: An object identifier (OID) for the extension value. The format is numbers separated by periods. - :return: AwsLambdaFunctionEnvironmentError object + :return: AwsCertificateManagerCertificateExtendedKeyUsage object """ - error_code: Optional[NonEmptyString] - message: Optional[NonEmptyString] + name: Optional[NonEmptyString] + o_id: Optional[NonEmptyString] -class AwsLambdaFunctionEnvironment(ASFFBaseModel): +AwsCertificateManagerCertificateExtendedKeyUsages = List[ + AwsCertificateManagerCertificateExtendedKeyUsage +] + + +class AwsCertificateManagerCertificateKeyUsage(ASFFBaseModel): """ - A function's environment variable settings. + Contains information about a key usage X.509 v3 extension object. - :param variables: Environment variable key-value pairs. - :param error: An AwsLambdaFunctionEnvironmentError object. + :param name: The key usage extension name. - :return: AwsLambdaFunctionEnvironment object + :return: AwsCertificateManagerCertificateKeyUsage object """ - variables: Optional[FieldMap] - error: Optional[AwsLambdaFunctionEnvironmentError] + name: Optional[NonEmptyString] -class AwsLambdaFunctionLayer(ASFFBaseModel): - """ - An AWS Lambda layer. +AwsCertificateManagerCertificateKeyUsages = List[ + AwsCertificateManagerCertificateKeyUsage +] - :param arn: The Amazon Resource Name (ARN) of the function layer. - :param code_size: The size of the layer archive in bytes. - :return: AwsLambdaFunctionLayer object +class AwsCertificateManagerCertificateOptions(ASFFBaseModel): """ + Contains other options for the certificate. - arn: Optional[NonEmptyString] - code_size: Optional[Integer] + :param certificate_transparency_logging_preference: Whether to add the certificate to a transparency log. Valid values: DISABLED | ENABLED + :return: AwsCertificateManagerCertificateOptions object + """ -AwsLambdaFunctionLayerList = List[AwsLambdaFunctionLayer] + certificate_transparency_logging_preference: Optional[NonEmptyString] -class AwsLambdaFunctionTracingConfig(ASFFBaseModel): +class AwsCertificateManagerCertificateResourceRecord(ASFFBaseModel): """ - The function's AWS X-Ray tracing configuration. + Provides details about the CNAME record that is added to the DNS database for domain validation. - :param mode: The tracing mode. + :param name: The name of the resource. + :param type: The type of resource. + :param value: The value of the resource. - :return: AwsLambdaFunctionTracingConfig object + :return: AwsCertificateManagerCertificateResourceRecord object """ - mode: Optional[NonEmptyString] + name: Optional[NonEmptyString] + type: Optional[NonEmptyString] + value: Optional[NonEmptyString] -class AwsLambdaFunctionVpcConfig(ASFFBaseModel): +class AwsCertificateManagerCertificateDomainValidationOption(ASFFBaseModel): """ - The VPC security groups and subnets that are attached to a Lambda function. For more information, see VPC Settings. + Contains information about one of the following: The initial validation of each domain name that occurs as a result of the RequestCertificate request The validation of each domain name in the certificate, as it pertains to AWS Certificate Manager managed renewal - :param security_group_ids: A list of VPC security groups IDs. - :param subnet_ids: A list of VPC subnet IDs. - :param vpc_id: The ID of the VPC. + :param domain_name: A fully qualified domain name (FQDN) in the certificate. + :param resource_record: The CNAME record that is added to the DNS database for domain validation. + :param validation_domain: The domain name that AWS Certificate Manager uses to send domain validation emails. + :param validation_emails: A list of email addresses that AWS Certificate Manager uses to send domain validation emails. + :param validation_method: The method used to validate the domain name. + :param validation_status: The validation status of the domain name. - :return: AwsLambdaFunctionVpcConfig object + :return: AwsCertificateManagerCertificateDomainValidationOption object """ - security_group_ids: Optional[NonEmptyStringList] - subnet_ids: Optional[NonEmptyStringList] - vpc_id: Optional[NonEmptyString] + domain_name: Optional[NonEmptyString] + resource_record: Optional[AwsCertificateManagerCertificateResourceRecord] + validation_domain: Optional[NonEmptyString] + validation_emails: Optional[StringList] + validation_method: Optional[NonEmptyString] + validation_status: Optional[NonEmptyString] -class AwsLambdaFunctionDetails(ASFFBaseModel): +AwsCertificateManagerCertificateDomainValidationOptions = List[ + AwsCertificateManagerCertificateDomainValidationOption +] + + +class AwsCertificateManagerCertificateRenewalSummary(ASFFBaseModel): """ - Details about a function's configuration. + Contains information about the AWS Certificate Manager managed renewal for an AMAZON_ISSUED certificate. - :param code: An AwsLambdaFunctionCode object. - :param code_sha256: The SHA256 hash of the function's deployment package. - :param dead_letter_config: The function's dead letter queue. - :param environment: The function's environment variables. + :param domain_validation_options: Information about the validation of each domain name in the certificate, as it pertains to AWS Certificate Manager managed renewal. Provided only when the certificate type is AMAZON_ISSUED. + :param renewal_status: The status of the AWS Certificate Manager managed renewal of the certificate. Valid values: PENDING_AUTO_RENEWAL | PENDING_VALIDATION | SUCCESS | FAILED + :param renewal_status_reason: The reason that a renewal request was unsuccessful. Valid values: NO_AVAILABLE_CONTACTS | ADDITIONAL_VERIFICATION_REQUIRED | DOMAIN_NOT_ALLOWED | INVALID_PUBLIC_DOMAIN | DOMAIN_VALIDATION_DENIED | CAA_ERROR | PCA_LIMIT_EXCEEDED | PCA_INVALID_ARN | PCA_INVALID_STATE | PCA_REQUEST_FAILED | PCA_NAME_CONSTRAINTS_VALIDATION | PCA_RESOURCE_NOT_FOUND | PCA_INVALID_ARGS | PCA_INVALID_DURATION | PCA_ACCESS_DENIED | SLR_NOT_FOUND | OTHER + :param updated_at: Indicates when the renewal summary was last updated. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + + :return: AwsCertificateManagerCertificateRenewalSummary object + """ + + domain_validation_options: Optional[ + AwsCertificateManagerCertificateDomainValidationOptions + ] + renewal_status: Optional[NonEmptyString] + renewal_status_reason: Optional[NonEmptyString] + updated_at: Optional[Iso8601Timestamp] + + +class AwsCertificateManagerCertificateDetails(ASFFBaseModel): + """ + Provides details about an AWS Certificate Manager certificate. + + :param certificate_authority_arn: The ARN of the private certificate authority (CA) that will be used to issue the certificate. + :param created_at: Indicates when the certificate was requested. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param domain_name: The fully qualified domain name (FQDN), such as www.example.com, that is secured by the certificate. + :param domain_validation_options: Contains information about the initial validation of each domain name that occurs as a result of the RequestCertificate request. Only provided if the certificate type is AMAZON_ISSUED. + :param extended_key_usages: Contains a list of Extended Key Usage X.509 v3 extension objects. Each object specifies a purpose for which the certificate public key can be used and consists of a name and an object identifier (OID). + :param failure_reason: For a failed certificate request, the reason for the failure. Valid values: NO_AVAILABLE_CONTACTS | ADDITIONAL_VERIFICATION_REQUIRED | DOMAIN_NOT_ALLOWED | INVALID_PUBLIC_DOMAIN | DOMAIN_VALIDATION_DENIED | CAA_ERROR | PCA_LIMIT_EXCEEDED | PCA_INVALID_ARN | PCA_INVALID_STATE | PCA_REQUEST_FAILED | PCA_NAME_CONSTRAINTS_VALIDATION | PCA_RESOURCE_NOT_FOUND | PCA_INVALID_ARGS | PCA_INVALID_DURATION | PCA_ACCESS_DENIED | SLR_NOT_FOUND | OTHER + :param imported_at: Indicates when the certificate was imported. Provided if the certificate type is IMPORTED. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param in_use_by: The list of ARNs for the AWS resources that use the certificate. + :param issued_at: Indicates when the certificate was issued. Provided if the certificate type is AMAZON_ISSUED. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param issuer: The name of the certificate authority that issued and signed the certificate. + :param key_algorithm: The algorithm that was used to generate the public-private key pair. Valid values: RSA_2048 | RSA_1024 | RSA_4096 | EC_prime256v1 | EC_secp384r1 | EC_secp521r1 + :param key_usages: A list of key usage X.509 v3 extension objects. + :param not_after: The time after which the certificate becomes invalid. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param not_before: The time before which the certificate is not valid. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param options: Provides a value that specifies whether to add the certificate to a transparency log. + :param renewal_eligibility: Whether the certificate is eligible for renewal. Valid values: ELIGIBLE | INELIGIBLE + :param renewal_summary: Information about the status of the AWS Certificate Manager managed renewal for the certificate. Provided only when the certificate type is AMAZON_ISSUED. + :param serial: The serial number of the certificate. + :param signature_algorithm: The algorithm that was used to sign the certificate. + :param status: The status of the certificate. Valid values: PENDING_VALIDATION | ISSUED | INACTIVE | EXPIRED | VALIDATION_TIMED_OUT | REVOKED | FAILED + :param subject: The name of the entity that is associated with the public key contained in the certificate. + :param subject_alternative_names: One or more domain names (subject alternative names) included in the certificate. This list contains the domain names that are bound to the public key that is contained in the certificate. The subject alternative names include the canonical domain name (CN) of the certificate and additional domain names that can be used to connect to the website. + :param type: The source of the certificate. For certificates that AWS Certificate Manager provides, Type is AMAZON_ISSUED. For certificates that are imported with ImportCertificate, Type is IMPORTED. Valid values: IMPORTED | AMAZON_ISSUED | PRIVATE + + :return: AwsCertificateManagerCertificateDetails object + """ + + certificate_authority_arn: Optional[NonEmptyString] + created_at: Optional[Iso8601Timestamp] + domain_name: Optional[NonEmptyString] + domain_validation_options: Optional[ + AwsCertificateManagerCertificateDomainValidationOptions + ] + extended_key_usages: Optional[AwsCertificateManagerCertificateExtendedKeyUsages] + failure_reason: Optional[NonEmptyString] + imported_at: Optional[NonEmptyString] + in_use_by: Optional[StringList] + issued_at: Optional[NonEmptyString] + issuer: Optional[NonEmptyString] + key_algorithm: Optional[NonEmptyString] + key_usages: Optional[AwsCertificateManagerCertificateKeyUsages] + not_after: Optional[NonEmptyString] + not_before: Optional[NonEmptyString] + options: Optional[AwsCertificateManagerCertificateOptions] + renewal_eligibility: Optional[NonEmptyString] + renewal_summary: Optional[AwsCertificateManagerCertificateRenewalSummary] + serial: Optional[NonEmptyString] + signature_algorithm: Optional[NonEmptyString] + status: Optional[NonEmptyString] + subject: Optional[NonEmptyString] + subject_alternative_names: Optional[StringList] + type: Optional[NonEmptyString] + + +class AwsRedshiftClusterClusterNode(ASFFBaseModel): + """ + A node in an Amazon Redshift cluster. + + :param node_role: The role of the node. A node might be a leader node or a compute node. + :param private_ip_address: The private IP address of the node. + :param public_ip_address: The public IP address of the node. + + :return: AwsRedshiftClusterClusterNode object + """ + + node_role: Optional[NonEmptyString] + private_ip_address: Optional[NonEmptyString] + public_ip_address: Optional[NonEmptyString] + + +AwsRedshiftClusterClusterNodes = List[AwsRedshiftClusterClusterNode] + + +class AwsRedshiftClusterClusterParameterStatus(ASFFBaseModel): + """ + The status of a parameter in a cluster parameter group for an Amazon Redshift cluster. + + :param parameter_name: The name of the parameter. + :param parameter_apply_status: The status of the parameter. Indicates whether the parameter is in sync with the database, waiting for a cluster reboot, or encountered an error when it was applied. Valid values: in-sync | pending-reboot | applying | invalid-parameter | apply-deferred | apply-error | unknown-error + :param parameter_apply_error_description: The error that prevented the parameter from being applied to the database. + + :return: AwsRedshiftClusterClusterParameterStatus object + """ + + parameter_name: Optional[NonEmptyString] + parameter_apply_status: Optional[NonEmptyString] + parameter_apply_error_description: Optional[NonEmptyString] + + +AwsRedshiftClusterClusterParameterStatusList = List[ + AwsRedshiftClusterClusterParameterStatus +] + + +class AwsRedshiftClusterClusterParameterGroup(ASFFBaseModel): + """ + A cluster parameter group that is associated with an Amazon Redshift cluster. + + :param cluster_parameter_status_list: The list of parameter statuses. + :param parameter_apply_status: The status of updates to the parameters. + :param parameter_group_name: The name of the parameter group. + + :return: AwsRedshiftClusterClusterParameterGroup object + """ + + cluster_parameter_status_list: Optional[ + AwsRedshiftClusterClusterParameterStatusList + ] + parameter_apply_status: Optional[NonEmptyString] + parameter_group_name: Optional[NonEmptyString] + + +AwsRedshiftClusterClusterParameterGroups = List[AwsRedshiftClusterClusterParameterGroup] + + +class AwsRedshiftClusterClusterSecurityGroup(ASFFBaseModel): + """ + A security group that is associated with the cluster. + + :param cluster_security_group_name: The name of the cluster security group. + :param status: The status of the cluster security group. + + :return: AwsRedshiftClusterClusterSecurityGroup object + """ + + cluster_security_group_name: Optional[NonEmptyString] + status: Optional[NonEmptyString] + + +AwsRedshiftClusterClusterSecurityGroups = List[AwsRedshiftClusterClusterSecurityGroup] + + +class AwsRedshiftClusterClusterSnapshotCopyStatus(ASFFBaseModel): + """ + Information about a cross-Region snapshot copy. + + :param destination_region: The destination Region that snapshots are automatically copied to when cross-Region snapshot copy is enabled. + :param manual_snapshot_retention_period: The number of days that manual snapshots are retained in the destination region after they are copied from a source region. If the value is -1, then the manual snapshot is retained indefinitely. Valid values: Either -1 or an integer between 1 and 3,653 + :param retention_period: The number of days to retain automated snapshots in the destination Region after they are copied from a source Region. + :param snapshot_copy_grant_name: The name of the snapshot copy grant. + + :return: AwsRedshiftClusterClusterSnapshotCopyStatus object + """ + + destination_region: Optional[NonEmptyString] + manual_snapshot_retention_period: Optional[Integer] + retention_period: Optional[Integer] + snapshot_copy_grant_name: Optional[NonEmptyString] + + +class AwsRedshiftClusterDeferredMaintenanceWindow(ASFFBaseModel): + """ + A time windows during which maintenance was deferred for an Amazon Redshift cluster. + + :param defer_maintenance_end_time: The end of the time window for which maintenance was deferred. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param defer_maintenance_identifier: The identifier of the maintenance window. + :param defer_maintenance_start_time: The start of the time window for which maintenance was deferred. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + + :return: AwsRedshiftClusterDeferredMaintenanceWindow object + """ + + defer_maintenance_end_time: Optional[NonEmptyString] + defer_maintenance_identifier: Optional[NonEmptyString] + defer_maintenance_start_time: Optional[NonEmptyString] + + +AwsRedshiftClusterDeferredMaintenanceWindows = List[ + AwsRedshiftClusterDeferredMaintenanceWindow +] + + +class AwsRedshiftClusterElasticIpStatus(ASFFBaseModel): + """ + The status of the elastic IP (EIP) address for an Amazon Redshift cluster. + + :param elastic_ip: The elastic IP address for the cluster. + :param status: The status of the elastic IP address. + + :return: AwsRedshiftClusterElasticIpStatus object + """ + + elastic_ip: Optional[NonEmptyString] + status: Optional[NonEmptyString] + + +class AwsRedshiftClusterEndpoint(ASFFBaseModel): + """ + The connection endpoint for an Amazon Redshift cluster. + + :param address: The DNS address of the cluster. + :param port: The port that the database engine listens on. + + :return: AwsRedshiftClusterEndpoint object + """ + + address: Optional[NonEmptyString] + port: Optional[Integer] + + +class AwsRedshiftClusterHsmStatus(ASFFBaseModel): + """ + Information about whether an Amazon Redshift cluster finished applying any hardware changes to security module (HSM) settings that were specified in a modify cluster command. + + :param hsm_client_certificate_identifier: The name of the HSM client certificate that the Amazon Redshift cluster uses to retrieve the data encryption keys that are stored in an HSM. + :param hsm_configuration_identifier: The name of the HSM configuration that contains the information that the Amazon Redshift cluster can use to retrieve and store keys in an HSM. + :param status: Indicates whether the Amazon Redshift cluster has finished applying any HSM settings changes specified in a modify cluster command. Type: String Valid values: active | applying + + :return: AwsRedshiftClusterHsmStatus object + """ + + hsm_client_certificate_identifier: Optional[NonEmptyString] + hsm_configuration_identifier: Optional[NonEmptyString] + status: Optional[NonEmptyString] + + +class AwsRedshiftClusterIamRole(ASFFBaseModel): + """ + An IAM role that the cluster can use to access other AWS services. + + :param apply_status: The status of the IAM role's association with the cluster. Valid values: in-sync | adding | removing + :param iam_role_arn: The ARN of the IAM role. + + :return: AwsRedshiftClusterIamRole object + """ + + apply_status: Optional[NonEmptyString] + iam_role_arn: Optional[NonEmptyString] + + +AwsRedshiftClusterIamRoles = List[AwsRedshiftClusterIamRole] + + +class AwsRedshiftClusterPendingModifiedValues(ASFFBaseModel): + """ + Changes to the Amazon Redshift cluster that are currently pending. + + :param automated_snapshot_retention_period: The pending or in-progress change to the automated snapshot retention period. + :param cluster_identifier: The pending or in-progress change to the identifier for the cluster. + :param cluster_type: The pending or in-progress change to the cluster type. + :param cluster_version: The pending or in-progress change to the service version. + :param encryption_type: The encryption type for a cluster. + :param enhanced_vpc_routing: Indicates whether to create the cluster with enhanced VPC routing enabled. + :param maintenance_track_name: The name of the maintenance track that the cluster changes to during the next maintenance window. + :param master_user_password: The pending or in-progress change to the master user password for the cluster. + :param node_type: The pending or in-progress change to the cluster's node type. + :param number_of_nodes: The pending or in-progress change to the number of nodes in the cluster. + :param publicly_accessible: The pending or in-progress change to whether the cluster can be connected to from the public network. + + :return: AwsRedshiftClusterPendingModifiedValues object + """ + + automated_snapshot_retention_period: Optional[Integer] + cluster_identifier: Optional[NonEmptyString] + cluster_type: Optional[NonEmptyString] + cluster_version: Optional[NonEmptyString] + encryption_type: Optional[NonEmptyString] + enhanced_vpc_routing: Optional[Boolean] + maintenance_track_name: Optional[NonEmptyString] + master_user_password: Optional[NonEmptyString] + node_type: Optional[NonEmptyString] + number_of_nodes: Optional[Integer] + publicly_accessible: Optional[Boolean] + + +class AwsRedshiftClusterResizeInfo(ASFFBaseModel): + """ + Information about the resize operation for the cluster. + + :param allow_cancel_resize: Indicates whether the resize operation can be canceled. + :param resize_type: The type of resize operation. Valid values: ClassicResize + + :return: AwsRedshiftClusterResizeInfo object + """ + + allow_cancel_resize: Optional[Boolean] + resize_type: Optional[NonEmptyString] + + +Long = int + + +class AwsRedshiftClusterRestoreStatus(ASFFBaseModel): + """ + Information about the status of a cluster restore action. It only applies if the cluster was created by restoring a snapshot. + + :param current_restore_rate_in_mega_bytes_per_second: The number of megabytes per second being transferred from the backup storage. Returns the average rate for a completed backup. This field is only updated when you restore to DC2 and DS2 node types. + :param elapsed_time_in_seconds: The amount of time an in-progress restore has been running, or the amount of time it took a completed restore to finish. This field is only updated when you restore to DC2 and DS2 node types. + :param estimated_time_to_completion_in_seconds: The estimate of the time remaining before the restore is complete. Returns 0 for a completed restore. This field is only updated when you restore to DC2 and DS2 node types. + :param progress_in_mega_bytes: The number of megabytes that were transferred from snapshot storage. This field is only updated when you restore to DC2 and DS2 node types. + :param snapshot_size_in_mega_bytes: The size of the set of snapshot data that was used to restore the cluster. This field is only updated when you restore to DC2 and DS2 node types. + :param status: The status of the restore action. Valid values: starting | restoring | completed | failed + + :return: AwsRedshiftClusterRestoreStatus object + """ + + current_restore_rate_in_mega_bytes_per_second: Optional[Double] + elapsed_time_in_seconds: Optional[Long] + estimated_time_to_completion_in_seconds: Optional[Long] + progress_in_mega_bytes: Optional[Long] + snapshot_size_in_mega_bytes: Optional[Long] + status: Optional[NonEmptyString] + + +class AwsRedshiftClusterVpcSecurityGroup(ASFFBaseModel): + """ + A VPC security group that the cluster belongs to, if the cluster is in a VPC. + + :param status: The status of the VPC security group. + :param vpc_security_group_id: The identifier of the VPC security group. + + :return: AwsRedshiftClusterVpcSecurityGroup object + """ + + status: Optional[NonEmptyString] + vpc_security_group_id: Optional[NonEmptyString] + + +AwsRedshiftClusterVpcSecurityGroups = List[AwsRedshiftClusterVpcSecurityGroup] + + +class AwsRedshiftClusterDetails(ASFFBaseModel): + """ + Details about an Amazon Redshift cluster. + + :param allow_version_upgrade: Indicates whether major version upgrades are applied automatically to the cluster during the maintenance window. + :param automated_snapshot_retention_period: The number of days that automatic cluster snapshots are retained. + :param availability_zone: The name of the Availability Zone in which the cluster is located. + :param cluster_availability_status: The availability status of the cluster for queries. Possible values are the following: Available - The cluster is available for queries. Unavailable - The cluster is not available for queries. Maintenance - The cluster is intermittently available for queries due to maintenance activities. Modifying -The cluster is intermittently available for queries due to changes that modify the cluster. Failed - The cluster failed and is not available for queries. + :param cluster_create_time: Indicates when the cluster was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param cluster_identifier: The unique identifier of the cluster. + :param cluster_nodes: The nodes in the cluster. + :param cluster_parameter_groups: The list of cluster parameter groups that are associated with this cluster. + :param cluster_public_key: The public key for the cluster. + :param cluster_revision_number: The specific revision number of the database in the cluster. + :param cluster_security_groups: A list of cluster security groups that are associated with the cluster. + :param cluster_snapshot_copy_status: Information about the destination Region and retention period for the cross-Region snapshot copy. + :param cluster_status: The current status of the cluster. Valid values: available | available, prep-for-resize | available, resize-cleanup | cancelling-resize | creating | deleting | final-snapshot | hardware-failure | incompatible-hsm | incompatible-network | incompatible-parameters | incompatible-restore | modifying | paused | rebooting | renaming | resizing | rotating-keys | storage-full | updating-hsm + :param cluster_subnet_group_name: The name of the subnet group that is associated with the cluster. This parameter is valid only when the cluster is in a VPC. + :param cluster_version: The version ID of the Amazon Redshift engine that runs on the cluster. + :param db_name: The name of the initial database that was created when the cluster was created. The same name is returned for the life of the cluster. If an initial database is not specified, a database named devdev is created by default. + :param deferred_maintenance_windows: List of time windows during which maintenance was deferred. + :param elastic_ip_status: Information about the status of the Elastic IP (EIP) address. + :param elastic_resize_number_of_node_options: The number of nodes that you can use the elastic resize method to resize the cluster to. + :param encrypted: Indicates whether the data in the cluster is encrypted at rest. + :param endpoint: The connection endpoint. + :param enhanced_vpc_routing: Indicates whether to create the cluster with enhanced VPC routing enabled. + :param expected_next_snapshot_schedule_time: Indicates when the next snapshot is expected to be taken. The cluster must have a valid snapshot schedule and have backups enabled. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param expected_next_snapshot_schedule_time_status: The status of the next expected snapshot. Valid values: OnTrack | Pending + :param hsm_status: Information about whether the Amazon Redshift cluster finished applying any changes to hardware security module (HSM) settings that were specified in a modify cluster command. + :param iam_roles: A list of IAM roles that the cluster can use to access other AWS services. + :param kms_key_id: The identifier of the AWS KMS encryption key that is used to encrypt data in the cluster. + :param maintenance_track_name: The name of the maintenance track for the cluster. + :param manual_snapshot_retention_period: The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots. Valid values: Either -1 or an integer between 1 and 3,653 + :param master_username: The master user name for the cluster. This name is used to connect to the database that is specified in as the value of DBName. + :param next_maintenance_window_start_time: Indicates the start of the next maintenance window. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param node_type: The node type for the nodes in the cluster. + :param number_of_nodes: The number of compute nodes in the cluster. + :param pending_actions: A list of cluster operations that are waiting to start. + :param pending_modified_values: A list of changes to the cluster that are currently pending. + :param preferred_maintenance_window: The weekly time range, in Universal Coordinated Time (UTC), during which system maintenance can occur. Format: <day>:HH:MM-<day>:HH:MM For the day values, use mon | tue | wed | thu | fri | sat | sun For example, sun:09:32-sun:10:02 + :param publicly_accessible: Whether the cluster can be accessed from a public network. + :param resize_info: Information about the resize operation for the cluster. + :param restore_status: Information about the status of a cluster restore action. Only applies to a cluster that was created by restoring a snapshot. + :param snapshot_schedule_identifier: A unique identifier for the cluster snapshot schedule. + :param snapshot_schedule_state: The current state of the cluster snapshot schedule. Valid values: MODIFYING | ACTIVE | FAILED + :param vpc_id: The identifier of the VPC that the cluster is in, if the cluster is in a VPC. + :param vpc_security_groups: The list of VPC security groups that the cluster belongs to, if the cluster is in a VPC. + + :return: AwsRedshiftClusterDetails object + """ + + allow_version_upgrade: Optional[Boolean] + automated_snapshot_retention_period: Optional[Integer] + availability_zone: Optional[NonEmptyString] + cluster_availability_status: Optional[NonEmptyString] + cluster_create_time: Optional[Iso8601Timestamp] + cluster_identifier: Optional[NonEmptyString] + cluster_nodes: Optional[AwsRedshiftClusterClusterNodes] + cluster_parameter_groups: Optional[AwsRedshiftClusterClusterParameterGroups] + cluster_public_key: Optional[NonEmptyString] + cluster_revision_number: Optional[NonEmptyString] + cluster_security_groups: Optional[AwsRedshiftClusterClusterSecurityGroups] + cluster_snapshot_copy_status: Optional[AwsRedshiftClusterClusterSnapshotCopyStatus] + cluster_status: Optional[NonEmptyString] + cluster_subnet_group_name: Optional[NonEmptyString] + cluster_version: Optional[NonEmptyString] + db_name: Optional[NonEmptyString] + deferred_maintenance_windows: Optional[AwsRedshiftClusterDeferredMaintenanceWindows] + elastic_ip_status: Optional[AwsRedshiftClusterElasticIpStatus] + elastic_resize_number_of_node_options: Optional[NonEmptyString] + encrypted: Optional[Boolean] + endpoint: Optional[AwsRedshiftClusterEndpoint] + enhanced_vpc_routing: Optional[Boolean] + expected_next_snapshot_schedule_time: Optional[NonEmptyString] + expected_next_snapshot_schedule_time_status: Optional[NonEmptyString] + hsm_status: Optional[AwsRedshiftClusterHsmStatus] + iam_roles: Optional[AwsRedshiftClusterIamRoles] + kms_key_id: Optional[NonEmptyString] + maintenance_track_name: Optional[NonEmptyString] + manual_snapshot_retention_period: Optional[Integer] + master_username: Optional[NonEmptyString] + next_maintenance_window_start_time: Optional[NonEmptyString] + node_type: Optional[NonEmptyString] + number_of_nodes: Optional[Integer] + pending_actions: Optional[StringList] + pending_modified_values: Optional[AwsRedshiftClusterPendingModifiedValues] + preferred_maintenance_window: Optional[NonEmptyString] + publicly_accessible: Optional[Boolean] + resize_info: Optional[AwsRedshiftClusterResizeInfo] + restore_status: Optional[AwsRedshiftClusterRestoreStatus] + snapshot_schedule_identifier: Optional[NonEmptyString] + snapshot_schedule_state: Optional[NonEmptyString] + vpc_id: Optional[NonEmptyString] + vpc_security_groups: Optional[AwsRedshiftClusterVpcSecurityGroups] + + +class AwsElbLoadBalancerBackendServerDescription(ASFFBaseModel): + """ + Provides information about the configuration of an EC2 instance for the load balancer. + + :param instance_port: The port on which the EC2 instance is listening. + :param policy_names: The names of the policies that are enabled for the EC2 instance. + + :return: AwsElbLoadBalancerBackendServerDescription object + """ + + instance_port: Optional[Integer] + policy_names: Optional[StringList] + + +AwsElbLoadBalancerBackendServerDescriptions = List[ + AwsElbLoadBalancerBackendServerDescription +] + + +class AwsElbLoadBalancerHealthCheck(ASFFBaseModel): + """ + Contains information about the health checks that are conducted on the load balancer. + + :param healthy_threshold: The number of consecutive health check successes required before the instance is moved to the Healthy state. + :param interval: The approximate interval, in seconds, between health checks of an individual instance. + :param target: The instance that is being checked. The target specifies the protocol and port. The available protocols are TCP, SSL, HTTP, and HTTPS. The range of valid ports is 1 through 65535. For the HTTP and HTTPS protocols, the target also specifies the ping path. For the TCP protocol, the target is specified as TCP: <port> . For the SSL protocol, the target is specified as SSL.<port> . For the HTTP and HTTPS protocols, the target is specified as <protocol>:<port>/<path to ping> . + :param timeout: The amount of time, in seconds, during which no response means a failed health check. + :param unhealthy_threshold: The number of consecutive health check failures that must occur before the instance is moved to the Unhealthy state. + + :return: AwsElbLoadBalancerHealthCheck object + """ + + healthy_threshold: Optional[Integer] + interval: Optional[Integer] + target: Optional[NonEmptyString] + timeout: Optional[Integer] + unhealthy_threshold: Optional[Integer] + + +class AwsElbLoadBalancerInstance(ASFFBaseModel): + """ + Provides information about an EC2 instance for a load balancer. + + :param instance_id: The instance identifier. + + :return: AwsElbLoadBalancerInstance object + """ + + instance_id: Optional[NonEmptyString] + + +AwsElbLoadBalancerInstances = List[AwsElbLoadBalancerInstance] + + +class AwsElbLoadBalancerListener(ASFFBaseModel): + """ + Information about a load balancer listener. + + :param instance_port: The port on which the instance is listening. + :param instance_protocol: The protocol to use to route traffic to instances. Valid values: HTTP | HTTPS | TCP | SSL + :param load_balancer_port: The port on which the load balancer is listening. On EC2-VPC, you can specify any port from the range 1-65535. On EC2-Classic, you can specify any port from the following list: 25, 80, 443, 465, 587, 1024-65535. + :param protocol: The load balancer transport protocol to use for routing. Valid values: HTTP | HTTPS | TCP | SSL + :param ssl_certificate_id: The ARN of the server certificate. + + :return: AwsElbLoadBalancerListener object + """ + + instance_port: Optional[Integer] + instance_protocol: Optional[NonEmptyString] + load_balancer_port: Optional[Integer] + protocol: Optional[NonEmptyString] + ssl_certificate_id: Optional[NonEmptyString] + + +class AwsElbLoadBalancerListenerDescription(ASFFBaseModel): + """ + Lists the policies that are enabled for a load balancer listener. + + :param listener: Information about the listener. + :param policy_names: The policies enabled for the listener. + + :return: AwsElbLoadBalancerListenerDescription object + """ + + listener: Optional[AwsElbLoadBalancerListener] + policy_names: Optional[StringList] + + +AwsElbLoadBalancerListenerDescriptions = List[AwsElbLoadBalancerListenerDescription] + + +class AwsElbLoadBalancerAccessLog(ASFFBaseModel): + """ + Contains information about the access log configuration for the load balancer. + + :param emit_interval: The interval in minutes for publishing the access logs. You can publish access logs either every 5 minutes or every 60 minutes. + :param enabled: Indicates whether access logs are enabled for the load balancer. + :param s3_bucket_name: The name of the S3 bucket where the access logs are stored. + :param s3_bucket_prefix: The logical hierarchy that was created for the S3 bucket. If a prefix is not provided, the log is placed at the root level of the bucket. + + :return: AwsElbLoadBalancerAccessLog object + """ + + emit_interval: Optional[Integer] + enabled: Optional[Boolean] + s3_bucket_name: Optional[NonEmptyString] + s3_bucket_prefix: Optional[NonEmptyString] + + +class AwsElbLoadBalancerConnectionDraining(ASFFBaseModel): + """ + Contains information about the connection draining configuration for the load balancer. + + :param enabled: Indicates whether connection draining is enabled for the load balancer. + :param timeout: The maximum time, in seconds, to keep the existing connections open before deregistering the instances. + + :return: AwsElbLoadBalancerConnectionDraining object + """ + + enabled: Optional[Boolean] + timeout: Optional[Integer] + + +class AwsElbLoadBalancerConnectionSettings(ASFFBaseModel): + """ + Contains connection settings for the load balancer. + + :param idle_timeout: The time, in seconds, that the connection can be idle (no data is sent over the connection) before it is closed by the load balancer. + + :return: AwsElbLoadBalancerConnectionSettings object + """ + + idle_timeout: Optional[Integer] + + +class AwsElbLoadBalancerCrossZoneLoadBalancing(ASFFBaseModel): + """ + Contains cross-zone load balancing settings for the load balancer. + + :param enabled: Indicates whether cross-zone load balancing is enabled for the load balancer. + + :return: AwsElbLoadBalancerCrossZoneLoadBalancing object + """ + + enabled: Optional[Boolean] + + +class AwsElbLoadBalancerAttributes(ASFFBaseModel): + """ + Contains attributes for the load balancer. + + :param access_log: Information about the access log configuration for the load balancer. If the access log is enabled, the load balancer captures detailed information about all requests. It delivers the information to a specified S3 bucket. + :param connection_draining: Information about the connection draining configuration for the load balancer. If connection draining is enabled, the load balancer allows existing requests to complete before it shifts traffic away from a deregistered or unhealthy instance. + :param connection_settings: Connection settings for the load balancer. If an idle timeout is configured, the load balancer allows connections to remain idle for the specified duration. When a connection is idle, no data is sent over the connection. + :param cross_zone_load_balancing: Cross-zone load balancing settings for the load balancer. If cross-zone load balancing is enabled, the load balancer routes the request traffic evenly across all instances regardless of the Availability Zones. + + :return: AwsElbLoadBalancerAttributes object + """ + + access_log: Optional[AwsElbLoadBalancerAccessLog] + connection_draining: Optional[AwsElbLoadBalancerConnectionDraining] + connection_settings: Optional[AwsElbLoadBalancerConnectionSettings] + cross_zone_load_balancing: Optional[AwsElbLoadBalancerCrossZoneLoadBalancing] + + +class AwsElbAppCookieStickinessPolicy(ASFFBaseModel): + """ + Contains information about a stickiness policy that was created using CreateAppCookieStickinessPolicy. + + :param cookie_name: The name of the application cookie used for stickiness. + :param policy_name: The mnemonic name for the policy being created. The name must be unique within the set of policies for the load balancer. + + :return: AwsElbAppCookieStickinessPolicy object + """ + + cookie_name: Optional[NonEmptyString] + policy_name: Optional[NonEmptyString] + + +AwsElbAppCookieStickinessPolicies = List[AwsElbAppCookieStickinessPolicy] + + +class AwsElbLbCookieStickinessPolicy(ASFFBaseModel): + """ + Contains information about a stickiness policy that was created using CreateLBCookieStickinessPolicy. + + :param cookie_expiration_period: The amount of time, in seconds, after which the cookie is considered stale. If an expiration period is not specified, the stickiness session lasts for the duration of the browser session. + :param policy_name: The name of the policy. The name must be unique within the set of policies for the load balancer. + + :return: AwsElbLbCookieStickinessPolicy object + """ + + cookie_expiration_period: Optional[Long] + policy_name: Optional[NonEmptyString] + + +AwsElbLbCookieStickinessPolicies = List[AwsElbLbCookieStickinessPolicy] + + +class AwsElbLoadBalancerPolicies(ASFFBaseModel): + """ + Contains information about the policies for a load balancer. + + :param app_cookie_stickiness_policies: The stickiness policies that are created using CreateAppCookieStickinessPolicy. + :param lb_cookie_stickiness_policies: The stickiness policies that are created using CreateLBCookieStickinessPolicy. + :param other_policies: The policies other than the stickiness policies. + + :return: AwsElbLoadBalancerPolicies object + """ + + app_cookie_stickiness_policies: Optional[AwsElbAppCookieStickinessPolicies] + lb_cookie_stickiness_policies: Optional[AwsElbLbCookieStickinessPolicies] + other_policies: Optional[StringList] + + +class AwsElbLoadBalancerSourceSecurityGroup(ASFFBaseModel): + """ + Contains information about the security group for the load balancer. + + :param group_name: The name of the security group. + :param owner_alias: The owner of the security group. + + :return: AwsElbLoadBalancerSourceSecurityGroup object + """ + + group_name: Optional[NonEmptyString] + owner_alias: Optional[NonEmptyString] + + +class AwsElbLoadBalancerDetails(ASFFBaseModel): + """ + Contains details about a Classic Load Balancer. + + :param availability_zones: The list of Availability Zones for the load balancer. + :param backend_server_descriptions: Information about the configuration of the EC2 instances. + :param canonical_hosted_zone_name: The name of the Amazon Route 53 hosted zone for the load balancer. + :param canonical_hosted_zone_name_id: The ID of the Amazon Route 53 hosted zone for the load balancer. + :param created_time: Indicates when the load balancer was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param dns_name: The DNS name of the load balancer. + :param health_check: Information about the health checks that are conducted on the load balancer. + :param instances: List of EC2 instances for the load balancer. + :param listener_descriptions: The policies that are enabled for the load balancer listeners. + :param load_balancer_attributes: The attributes for a load balancer. + :param load_balancer_name: The name of the load balancer. + :param policies: The policies for a load balancer. + :param scheme: The type of load balancer. Only provided if the load balancer is in a VPC. If Scheme is internet-facing, the load balancer has a public DNS name that resolves to a public IP address. If Scheme is internal, the load balancer has a public DNS name that resolves to a private IP address. + :param security_groups: The security groups for the load balancer. Only provided if the load balancer is in a VPC. + :param source_security_group: Information about the security group for the load balancer. This is the security group that is used for inbound rules. + :param subnets: The list of subnet identifiers for the load balancer. + :param vpc_id: The identifier of the VPC for the load balancer. + + :return: AwsElbLoadBalancerDetails object + """ + + availability_zones: Optional[StringList] + backend_server_descriptions: Optional[AwsElbLoadBalancerBackendServerDescriptions] + canonical_hosted_zone_name: Optional[NonEmptyString] + canonical_hosted_zone_name_id: Optional[NonEmptyString] + created_time: Optional[Iso8601Timestamp] + dns_name: Optional[NonEmptyString] + health_check: Optional[AwsElbLoadBalancerHealthCheck] + instances: Optional[AwsElbLoadBalancerInstances] + listener_descriptions: Optional[AwsElbLoadBalancerListenerDescriptions] + load_balancer_attributes: Optional[AwsElbLoadBalancerAttributes] + load_balancer_name: Optional[NonEmptyString] + policies: Optional[AwsElbLoadBalancerPolicies] + scheme: Optional[NonEmptyString] + security_groups: Optional[StringList] + source_security_group: Optional[AwsElbLoadBalancerSourceSecurityGroup] + subnets: Optional[StringList] + vpc_id: Optional[NonEmptyString] + + +class AwsIamGroupPolicy(ASFFBaseModel): + """ + A managed policy that is attached to the IAM group. + + :param policy_name: The name of the policy. + + :return: AwsIamGroupPolicy object + """ + + policy_name: Optional[NonEmptyString] + + +AwsIamGroupPolicyList = List[AwsIamGroupPolicy] + + +class AwsIamGroupDetails(ASFFBaseModel): + """ + Contains details about an IAM group. + + :param attached_managed_policies: A list of the managed policies that are attached to the IAM group. + :param create_date: Indicates when the IAM group was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param group_id: The identifier of the IAM group. + :param group_name: The name of the IAM group. + :param group_policy_list: The list of inline policies that are embedded in the group. + :param path: The path to the group. + + :return: AwsIamGroupDetails object + """ + + attached_managed_policies: Optional[AwsIamAttachedManagedPolicyList] + create_date: Optional[Iso8601Timestamp] + group_id: Optional[NonEmptyString] + group_name: Optional[NonEmptyString] + group_policy_list: Optional[AwsIamGroupPolicyList] + path: Optional[NonEmptyString] + + +AwsIamRoleAssumeRolePolicyDocument = constr( + regex="[\u0009\u000A\u000D\u0020-\u007E\u00A1-\u00FF]+", + min_length=1, + max_length=131072, +) + + +class AwsIamInstanceProfileRole(ASFFBaseModel): + """ + Information about a role associated with an instance profile. + + :param arn: The ARN of the role. + :param assume_role_policy_document: The policy that grants an entity permission to assume the role. + :param create_date: Indicates when the role was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param path: The path to the role. + :param role_id: The identifier of the role. + :param role_name: The name of the role. + + :return: AwsIamInstanceProfileRole object + """ + + arn: Optional[NonEmptyString] + assume_role_policy_document: Optional[AwsIamRoleAssumeRolePolicyDocument] + create_date: Optional[Iso8601Timestamp] + path: Optional[NonEmptyString] + role_id: Optional[NonEmptyString] + role_name: Optional[NonEmptyString] + + +AwsIamInstanceProfileRoles = List[AwsIamInstanceProfileRole] + + +class AwsIamInstanceProfile(ASFFBaseModel): + """ + Information about an instance profile. + + :param arn: The ARN of the instance profile. + :param create_date: Indicates when the instance profile was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param instance_profile_id: The identifier of the instance profile. + :param instance_profile_name: The name of the instance profile. + :param path: The path to the instance profile. + :param roles: The roles associated with the instance profile. + + :return: AwsIamInstanceProfile object + """ + + arn: Optional[NonEmptyString] + create_date: Optional[Iso8601Timestamp] + instance_profile_id: Optional[NonEmptyString] + instance_profile_name: Optional[NonEmptyString] + path: Optional[NonEmptyString] + roles: Optional[AwsIamInstanceProfileRoles] + + +AwsIamInstanceProfileList = List[AwsIamInstanceProfile] + + +class AwsIamRolePolicy(ASFFBaseModel): + """ + An inline policy that is embedded in the role. + + :param policy_name: The name of the policy. + + :return: AwsIamRolePolicy object + """ + + policy_name: Optional[NonEmptyString] + + +AwsIamRolePolicyList = List[AwsIamRolePolicy] + + +class AwsIamRoleDetails(ASFFBaseModel): + """ + Contains information about an IAM role, including all of the role's policies. + + :param assume_role_policy_document: The trust policy that grants permission to assume the role. + :param attached_managed_policies: The list of the managed policies that are attached to the role. + :param create_date: Indicates when the role was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param instance_profile_list: The list of instance profiles that contain this role. + :param role_id: The stable and unique string identifying the role. + :param role_name: The friendly name that identifies the role. + :param role_policy_list: The list of inline policies that are embedded in the role. + :param max_session_duration: The maximum session duration (in seconds) that you want to set for the specified role. + :param path: The path to the role. + + :return: AwsIamRoleDetails object + """ + + assume_role_policy_document: Optional[AwsIamRoleAssumeRolePolicyDocument] + attached_managed_policies: Optional[AwsIamAttachedManagedPolicyList] + create_date: Optional[Iso8601Timestamp] + instance_profile_list: Optional[AwsIamInstanceProfileList] + permissions_boundary: Optional[AwsIamPermissionsBoundary] + role_id: Optional[NonEmptyString] + role_name: Optional[NonEmptyString] + role_policy_list: Optional[AwsIamRolePolicyList] + max_session_duration: Optional[Integer] + path: Optional[NonEmptyString] + + +class AwsKmsKeyDetails(ASFFBaseModel): + """ + Contains metadata about a customer master key (CMK). + + :param aws_account_id: The twelve-digit account ID of the AWS account that owns the CMK. + :param creation_date: Indicates when the CMK was created. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. + :param key_id: The globally unique identifier for the CMK. + :param key_manager: The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed. + :param key_state: The state of the CMK. + :param origin: The source of the CMK's key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material. When this value is AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store. + :param description: A description of the key. + + :return: AwsKmsKeyDetails object + """ + + aws_account_id: Optional[NonEmptyString] + creation_date: Optional[Iso8601Timestamp] + key_id: Optional[NonEmptyString] + key_manager: Optional[NonEmptyString] + key_state: Optional[NonEmptyString] + origin: Optional[NonEmptyString] + description: Optional[NonEmptyString] + + +class AwsLambdaFunctionCode(ASFFBaseModel): + """ + The code for the Lambda function. You can specify either an object in Amazon S3, or upload a deployment package directly. + + :param s3_bucket: An Amazon S3 bucket in the same AWS Region as your function. The bucket can be in a different AWS account. + :param s3_key: The Amazon S3 key of the deployment package. + :param s3_object_version: For versioned objects, the version of the deployment package object to use. + :param zip_file: The base64-encoded contents of the deployment package. AWS SDK and AWS CLI clients handle the encoding for you. + + :return: AwsLambdaFunctionCode object + """ + + s3_bucket: Optional[NonEmptyString] + s3_key: Optional[NonEmptyString] + s3_object_version: Optional[NonEmptyString] + zip_file: Optional[NonEmptyString] + + +class AwsLambdaFunctionDeadLetterConfig(ASFFBaseModel): + """ + The dead-letter queue for failed asynchronous invocations. + + :param target_arn: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. + + :return: AwsLambdaFunctionDeadLetterConfig object + """ + + target_arn: Optional[NonEmptyString] + + +class AwsLambdaFunctionEnvironmentError(ASFFBaseModel): + """ + Error messages for environment variables that couldn't be applied. + + :param error_code: The error code. + :param message: The error message. + + :return: AwsLambdaFunctionEnvironmentError object + """ + + error_code: Optional[NonEmptyString] + message: Optional[NonEmptyString] + + +class AwsLambdaFunctionEnvironment(ASFFBaseModel): + """ + A function's environment variable settings. + + :param variables: Environment variable key-value pairs. + :param error: An AwsLambdaFunctionEnvironmentError object. + + :return: AwsLambdaFunctionEnvironment object + """ + + variables: Optional[FieldMap] + error: Optional[AwsLambdaFunctionEnvironmentError] + + +class AwsLambdaFunctionLayer(ASFFBaseModel): + """ + An AWS Lambda layer. + + :param arn: The Amazon Resource Name (ARN) of the function layer. + :param code_size: The size of the layer archive in bytes. + + :return: AwsLambdaFunctionLayer object + """ + + arn: Optional[NonEmptyString] + code_size: Optional[Integer] + + +AwsLambdaFunctionLayerList = List[AwsLambdaFunctionLayer] + + +class AwsLambdaFunctionTracingConfig(ASFFBaseModel): + """ + The function's AWS X-Ray tracing configuration. + + :param mode: The tracing mode. + + :return: AwsLambdaFunctionTracingConfig object + """ + + mode: Optional[NonEmptyString] + + +class AwsLambdaFunctionVpcConfig(ASFFBaseModel): + """ + The VPC security groups and subnets that are attached to a Lambda function. For more information, see VPC Settings. + + :param security_group_ids: A list of VPC security groups IDs. + :param subnet_ids: A list of VPC subnet IDs. + :param vpc_id: The ID of the VPC. + + :return: AwsLambdaFunctionVpcConfig object + """ + + security_group_ids: Optional[NonEmptyStringList] + subnet_ids: Optional[NonEmptyStringList] + vpc_id: Optional[NonEmptyString] + + +class AwsLambdaFunctionDetails(ASFFBaseModel): + """ + Details about a function's configuration. + + :param code: An AwsLambdaFunctionCode object. + :param code_sha256: The SHA256 hash of the function's deployment package. + :param dead_letter_config: The function's dead letter queue. + :param environment: The function's environment variables. :param function_name: The name of the function. :param handler: The function that Lambda calls to begin executing your function. :param kms_key_arn: The KMS key that's used to encrypt the function's environment variables. This key is only returned if you've configured a customer managed CMK. @@ -2543,7 +3928,16 @@ class ResourceDetails(ASFFBaseModel): :param aws_iam_access_key: Details about an IAM access key related to a finding. :param aws_iam_user: Details about an IAM user. :param aws_iam_policy: Details about an IAM permissions policy. + :param aws_api_gateway_v2_stage: + :param aws_api_gateway_v2_api: :param aws_dynamo_db_table: Details about a DynamoDB table. + :param aws_api_gateway_stage: + :param aws_api_gateway_rest_api: + :param aws_cloud_trail_trail: + :param aws_certificate_manager_certificate: + :param aws_redshift_cluster: + :param aws_elb_load_balancer: + :param aws_iam_group: :param aws_iam_role: Details about an IAM role. :param aws_kms_key: Details about a KMS key. :param aws_lambda_function: Details about a Lambda function. @@ -2578,7 +3972,18 @@ class ResourceDetails(ASFFBaseModel): aws_iam_access_key: Optional[AwsIamAccessKeyDetails] aws_iam_user: Optional[AwsIamUserDetails] aws_iam_policy: Optional[AwsIamPolicyDetails] + aws_api_gateway_v2_stage: Optional[AwsApiGatewayV2StageDetails] + aws_api_gateway_v2_api: Optional[AwsApiGatewayV2ApiDetails] aws_dynamo_db_table: Optional[AwsDynamoDbTableDetails] + aws_api_gateway_stage: Optional[AwsApiGatewayStageDetails] + aws_api_gateway_rest_api: Optional[AwsApiGatewayRestApiDetails] + aws_cloud_trail_trail: Optional[AwsCloudTrailTrailDetails] + aws_certificate_manager_certificate: Optional[ + AwsCertificateManagerCertificateDetails + ] + aws_redshift_cluster: Optional[AwsRedshiftClusterDetails] + aws_elb_load_balancer: Optional[AwsElbLoadBalancerDetails] + aws_iam_group: Optional[AwsIamGroupDetails] aws_iam_role: Optional[AwsIamRoleDetails] aws_kms_key: Optional[AwsKmsKeyDetails] aws_lambda_function: Optional[AwsLambdaFunctionDetails] @@ -2602,6 +4007,7 @@ class Resource(ASFFBaseModel): :param id: The canonical identifier for the given resource type. :param partition: The canonical AWS partition name that the Region is assigned to. :param region: The canonical AWS external Region name where this resource is located. + :param resource_role: :param tags: A list of AWS tags associated with a resource at the time the finding was processed. :param details: Additional details about the resource related to a finding. @@ -2612,6 +4018,7 @@ class Resource(ASFFBaseModel): id: NonEmptyString partition: Optional[Partition] region: Optional[NonEmptyString] + resource_role: Optional[NonEmptyString] tags: Optional[FieldMap] details: Optional[ResourceDetails] @@ -2806,7 +4213,7 @@ class PatchSummary(ASFFBaseModel): :param failed_count: The number of patches from the compliance standard that failed to install. :param installed_other_count: The number of installed patches that are not part of the compliance standard. :param installed_rejected_count: The number of patches that are installed but are also on a list of patches that the customer rejected. - :param installed_pending_reboot: The number of patches that were installed since the last time the instance was rebooted. + :param installed_pending_reboot: The number of patches that were applied, but that require the instance to be rebooted in order to be marked as installed. :param operation_start_time: Indicates when the operation started. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. :param operation_end_time: Indicates when the operation completed. Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z. :param reboot_option: The reboot option specified for the instance. diff --git a/tools/service-2.json b/tools/service-2.json index 54039cb..a2a40d7 100644 --- a/tools/service-2.json +++ b/tools/service-2.json @@ -27,7 +27,7 @@ {"shape":"ResourceNotFoundException"}, {"shape":"InvalidAccessException"} ], - "documentation":"

Accepts the invitation to be a member account and be monitored by the Security Hub master account that the invitation was sent from.

When the member account accepts the invitation, permission is granted to the master account to view findings generated in the member account.

" + "documentation":"

Accepts the invitation to be a member account and be monitored by the Security Hub master account that the invitation was sent from.

This operation is only used by member accounts that are not added through Organizations.

When the member account accepts the invitation, permission is granted to the master account to view findings generated in the member account.

" }, "BatchDisableStandards":{ "name":"BatchDisableStandards", @@ -75,7 +75,7 @@ {"shape":"LimitExceededException"}, {"shape":"InvalidAccessException"} ], - "documentation":"

Imports security findings generated from an integrated third-party product into Security Hub. This action is requested by the integrated product to import its findings into Security Hub.

The maximum allowed size for a finding is 240 Kb. An error is returned for any finding larger than 240 Kb.

After a finding is created, BatchImportFindings cannot be used to update the following finding fields and objects, which Security Hub customers use to manage their investigation workflow.

" + "documentation":"

Imports security findings generated from an integrated third-party product into Security Hub. This action is requested by the integrated product to import its findings into Security Hub.

The maximum allowed size for a finding is 240 Kb. An error is returned for any finding larger than 240 Kb.

After a finding is created, BatchImportFindings cannot be used to update the following finding fields and objects, which Security Hub customers use to manage their investigation workflow.

BatchImportFindings can be used to update the following finding fields and objects only if they have not been updated using BatchUpdateFindings. After they are updated using BatchUpdateFindings, these fields cannot be updated using BatchImportFindings.

" }, "BatchUpdateFindings":{ "name":"BatchUpdateFindings", @@ -91,7 +91,7 @@ {"shape":"LimitExceededException"}, {"shape":"InvalidAccessException"} ], - "documentation":"

Used by Security Hub customers to update information about their investigation into a finding. Requested by master accounts or member accounts. Master accounts can update findings for their account and their member accounts. Member accounts can update findings for their account.

Updates from BatchUpdateFindings do not affect the value of UpdatedAt for a finding.

Master accounts can use BatchUpdateFindings to update the following finding fields and objects.

Member accounts can only use BatchUpdateFindings to update the Note object.

" + "documentation":"

Used by Security Hub customers to update information about their investigation into a finding. Requested by master accounts or member accounts. Master accounts can update findings for their account and their member accounts. Member accounts can update findings for their account.

Updates from BatchUpdateFindings do not affect the value of UpdatedAt for a finding.

Master and member accounts can use BatchUpdateFindings to update the following finding fields and objects.

You can configure IAM policies to restrict access to fields and field values. For example, you might not want member accounts to be able to suppress findings or change the finding severity. See Configuring access to BatchUpdateFindings in the AWS Security Hub User Guide.

" }, "CreateActionTarget":{ "name":"CreateActionTarget", @@ -142,7 +142,7 @@ {"shape":"InvalidAccessException"}, {"shape":"ResourceConflictException"} ], - "documentation":"

Creates a member association in Security Hub between the specified accounts and the account used to make the request, which is the master account. To successfully create a member, you must use this action from an account that already has Security Hub enabled. To enable Security Hub, you can use the EnableSecurityHub operation.

After you use CreateMembers to create member account associations in Security Hub, you must use the InviteMembers operation to invite the accounts to enable Security Hub and become member accounts in Security Hub.

If the account owner accepts the invitation, the account becomes a member account in Security Hub. A permissions policy is added that permits the master account to view the findings generated in the member account. When Security Hub is enabled in the invited account, findings start to be sent to both the member and master accounts.

To remove the association between the master and member accounts, use the DisassociateFromMasterAccount or DisassociateMembers operation.

" + "documentation":"

Creates a member association in Security Hub between the specified accounts and the account used to make the request, which is the master account. If you are integrated with Organizations, then the master account is the Security Hub administrator account that is designated by the organization management account.

CreateMembers is always used to add accounts that are not organization members.

For accounts that are part of an organization, CreateMembers is only used in the following cases:

This action can only be used by an account that has Security Hub enabled. To enable Security Hub, you can use the EnableSecurityHub operation.

For accounts that are not organization members, you create the account association and then send an invitation to the member account. To send the invitation, you use the InviteMembers operation. If the account owner accepts the invitation, the account becomes a member account in Security Hub.

Accounts that are part of an organization do not receive an invitation. They automatically become a member account in Security Hub.

A permissions policy is added that permits the master account to view the findings generated in the member account. When Security Hub is enabled in a member account, findings are sent to both the member and master accounts.

To remove the association between the master and member accounts, use the DisassociateFromMasterAccount or DisassociateMembers operation.

" }, "DeclineInvitations":{ "name":"DeclineInvitations", @@ -158,7 +158,7 @@ {"shape":"InvalidAccessException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Declines invitations to become a member account.

" + "documentation":"

Declines invitations to become a member account.

This operation is only used by accounts that are not part of an organization. Organization accounts do not receive invitations.

" }, "DeleteActionTarget":{ "name":"DeleteActionTarget", @@ -208,7 +208,7 @@ {"shape":"ResourceNotFoundException"}, {"shape":"InvalidAccessException"} ], - "documentation":"

Deletes invitations received by the AWS account to become a member account.

" + "documentation":"

Deletes invitations received by the AWS account to become a member account.

This operation is only used by accounts that are not part of an organization. Organization accounts do not receive invitations.

" }, "DeleteMembers":{ "name":"DeleteMembers", @@ -225,7 +225,7 @@ {"shape":"LimitExceededException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Deletes the specified member accounts from Security Hub.

" + "documentation":"

Deletes the specified member accounts from Security Hub.

Can be used to delete member accounts that belong to an organization as well as member accounts that were invited manually.

" }, "DescribeActionTargets":{ "name":"DescribeActionTargets", @@ -260,6 +260,22 @@ ], "documentation":"

Returns details about the Hub resource in your account, including the HubArn and the time when you enabled Security Hub.

" }, + "DescribeOrganizationConfiguration":{ + "name":"DescribeOrganizationConfiguration", + "http":{ + "method":"GET", + "requestUri":"/organization/configuration" + }, + "input":{"shape":"DescribeOrganizationConfigurationRequest"}, + "output":{"shape":"DescribeOrganizationConfigurationResponse"}, + "errors":[ + {"shape":"InternalException"}, + {"shape":"InvalidInputException"}, + {"shape":"InvalidAccessException"}, + {"shape":"LimitExceededException"} + ], + "documentation":"

Returns information about the Organizations configuration for Security Hub. Can only be called from a Security Hub administrator account.

" + }, "DescribeProducts":{ "name":"DescribeProducts", "http":{ @@ -324,6 +340,22 @@ ], "documentation":"

Disables the integration of the specified product with Security Hub. After the integration is disabled, findings from that product are no longer sent to Security Hub.

" }, + "DisableOrganizationAdminAccount":{ + "name":"DisableOrganizationAdminAccount", + "http":{ + "method":"POST", + "requestUri":"/organization/admin/disable" + }, + "input":{"shape":"DisableOrganizationAdminAccountRequest"}, + "output":{"shape":"DisableOrganizationAdminAccountResponse"}, + "errors":[ + {"shape":"InternalException"}, + {"shape":"InvalidInputException"}, + {"shape":"InvalidAccessException"}, + {"shape":"LimitExceededException"} + ], + "documentation":"

Disables a Security Hub administrator account. Can only be called by the organization management account.

" + }, "DisableSecurityHub":{ "name":"DisableSecurityHub", "http":{ @@ -355,7 +387,7 @@ {"shape":"LimitExceededException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Disassociates the current Security Hub member account from the associated master account.

" + "documentation":"

Disassociates the current Security Hub member account from the associated master account.

This operation is only used by accounts that are not part of an organization. For organization accounts, only the master account (the designated Security Hub administrator) can disassociate a member account.

" }, "DisassociateMembers":{ "name":"DisassociateMembers", @@ -372,7 +404,7 @@ {"shape":"LimitExceededException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Disassociates the specified member accounts from the associated master account.

" + "documentation":"

Disassociates the specified member accounts from the associated master account.

Can be used to disassociate both accounts that are in an organization and accounts that were invited manually.

" }, "EnableImportFindingsForProduct":{ "name":"EnableImportFindingsForProduct", @@ -391,6 +423,22 @@ ], "documentation":"

Enables the integration of a partner product with Security Hub. Integrated products send findings to Security Hub.

When you enable a product integration, a permissions policy that grants permission for the product to send findings to Security Hub is applied.

" }, + "EnableOrganizationAdminAccount":{ + "name":"EnableOrganizationAdminAccount", + "http":{ + "method":"POST", + "requestUri":"/organization/admin/enable" + }, + "input":{"shape":"EnableOrganizationAdminAccountRequest"}, + "output":{"shape":"EnableOrganizationAdminAccountResponse"}, + "errors":[ + {"shape":"InternalException"}, + {"shape":"InvalidInputException"}, + {"shape":"InvalidAccessException"}, + {"shape":"LimitExceededException"} + ], + "documentation":"

Designates the Security Hub administrator account for an organization. Can only be called by the organization management account.

" + }, "EnableSecurityHub":{ "name":"EnableSecurityHub", "http":{ @@ -505,7 +553,7 @@ {"shape":"LimitExceededException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Provides the details for the Security Hub master account for the current member account.

" + "documentation":"

Provides the details for the Security Hub master account for the current member account.

Can be used by both member accounts that are in an organization and accounts that were invited manually.

" }, "GetMembers":{ "name":"GetMembers", @@ -522,7 +570,7 @@ {"shape":"LimitExceededException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Returns the details for the Security Hub member accounts for the specified account IDs.

" + "documentation":"

Returns the details for the Security Hub member accounts for the specified account IDs.

A master account can be either a delegated Security Hub administrator account for an organization or a master account that enabled Security Hub manually.

The results include both member accounts that are in an organization and accounts that were invited manually.

" }, "InviteMembers":{ "name":"InviteMembers", @@ -539,7 +587,7 @@ {"shape":"LimitExceededException"}, {"shape":"ResourceNotFoundException"} ], - "documentation":"

Invites other AWS accounts to become member accounts for the Security Hub master account that the invitation is sent from.

Before you can use this action to invite a member, you must first use the CreateMembers action to create the member account in Security Hub.

When the account owner accepts the invitation to become a member account and enables Security Hub, the master account can view the findings generated from the member account.

" + "documentation":"

Invites other AWS accounts to become member accounts for the Security Hub master account that the invitation is sent from.

This operation is only used to invite accounts that do not belong to an organization. Organization accounts do not receive invitations.

Before you can use this action to invite a member, you must first use the CreateMembers action to create the member account in Security Hub.

When the account owner enables Security Hub and accepts the invitation to become a member account, the master account can view the findings generated from the member account.

" }, "ListEnabledProductsForImport":{ "name":"ListEnabledProductsForImport", @@ -570,7 +618,7 @@ {"shape":"InvalidAccessException"}, {"shape":"LimitExceededException"} ], - "documentation":"

Lists all Security Hub membership invitations that were sent to the current AWS account.

" + "documentation":"

Lists all Security Hub membership invitations that were sent to the current AWS account.

This operation is only used by accounts that do not belong to an organization. Organization accounts do not receive invitations.

" }, "ListMembers":{ "name":"ListMembers", @@ -586,7 +634,23 @@ {"shape":"InvalidAccessException"}, {"shape":"LimitExceededException"} ], - "documentation":"

Lists details about all member accounts for the current Security Hub master account.

" + "documentation":"

Lists details about all member accounts for the current Security Hub master account.

The results include both member accounts that belong to an organization and member accounts that were invited manually.

" + }, + "ListOrganizationAdminAccounts":{ + "name":"ListOrganizationAdminAccounts", + "http":{ + "method":"GET", + "requestUri":"/organization/admin" + }, + "input":{"shape":"ListOrganizationAdminAccountsRequest"}, + "output":{"shape":"ListOrganizationAdminAccountsResponse"}, + "errors":[ + {"shape":"InternalException"}, + {"shape":"InvalidInputException"}, + {"shape":"InvalidAccessException"}, + {"shape":"LimitExceededException"} + ], + "documentation":"

Lists the Security Hub administrator accounts. Can only be called by the organization management account.

" }, "ListTagsForResource":{ "name":"ListTagsForResource", @@ -684,6 +748,22 @@ ], "documentation":"

Updates the Security Hub insight identified by the specified insight ARN.

" }, + "UpdateOrganizationConfiguration":{ + "name":"UpdateOrganizationConfiguration", + "http":{ + "method":"POST", + "requestUri":"/organization/configuration" + }, + "input":{"shape":"UpdateOrganizationConfigurationRequest"}, + "output":{"shape":"UpdateOrganizationConfigurationResponse"}, + "errors":[ + {"shape":"InternalException"}, + {"shape":"InvalidInputException"}, + {"shape":"InvalidAccessException"}, + {"shape":"LimitExceededException"} + ], + "documentation":"

Used to update the configuration related to Organizations. Can only be called from a Security Hub administrator account.

" + }, "UpdateSecurityHubConfiguration":{ "name":"UpdateSecurityHubConfiguration", "http":{ @@ -753,6 +833,7 @@ }, "AccountDetails":{ "type":"structure", + "required":["AccountId"], "members":{ "AccountId":{ "shape":"AccountId", @@ -801,6 +882,36 @@ "type":"list", "member":{"shape":"ActionTarget"} }, + "AdminAccount":{ + "type":"structure", + "members":{ + "AccountId":{ + "shape":"NonEmptyString", + "documentation":"

The AWS account identifier of the Security Hub administrator account.

" + }, + "Status":{ + "shape":"AdminStatus", + "documentation":"

The current status of the Security Hub administrator account. Indicates whether the account is currently enabled as a Security Hub administrator.

" + } + }, + "documentation":"

Represents a Security Hub administrator account designated by an organization management account.

" + }, + "AdminAccounts":{ + "type":"list", + "member":{"shape":"AdminAccount"} + }, + "AdminStatus":{ + "type":"string", + "enum":[ + "ENABLED", + "DISABLE_IN_PROGRESS" + ] + }, + "AdminsMaxResults":{ + "type":"integer", + "max":10, + "min":1 + }, "ArnList":{ "type":"list", "member":{"shape":"NonEmptyString"} @@ -823,2542 +934,4319 @@ "type":"list", "member":{"shape":"AvailabilityZone"} }, - "AwsAutoScalingAutoScalingGroupDetails":{ + "AwsApiGatewayAccessLogSettings":{ "type":"structure", "members":{ - "LaunchConfigurationName":{ - "shape":"NonEmptyString", - "documentation":"

The name of the launch configuration.

" - }, - "LoadBalancerNames":{ - "shape":"StringList", - "documentation":"

The list of load balancers associated with the group.

" - }, - "HealthCheckType":{ + "Format":{ "shape":"NonEmptyString", - "documentation":"

The service to use for the health checks.

" + "documentation":"

A single-line format of the access logs of data, as specified by selected $context variables. The format must include at least $context.requestId.

" }, - "HealthCheckGracePeriod":{ - "shape":"Integer", - "documentation":"

The amount of time, in seconds, that Amazon EC2 Auto Scaling waits before it checks the health status of an EC2 instance that has come into service.

" - }, - "CreatedTime":{ + "DestinationArn":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the auto scaling group was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The ARN of the CloudWatch Logs log group that receives the access logs.

" } }, - "documentation":"

Provides details about an auto scaling group.

" + "documentation":"

Contains information about settings for logging access for the stage.

" }, - "AwsCloudFrontDistributionDetails":{ + "AwsApiGatewayCanarySettings":{ "type":"structure", "members":{ - "DomainName":{ - "shape":"NonEmptyString", - "documentation":"

The domain name corresponding to the distribution.

" - }, - "ETag":{ - "shape":"NonEmptyString", - "documentation":"

The entity tag is a hash of the object.

" + "PercentTraffic":{ + "shape":"Double", + "documentation":"

The percentage of traffic that is diverted to a canary deployment.

" }, - "LastModifiedTime":{ + "DeploymentId":{ "shape":"NonEmptyString", - "documentation":"

Indicates when that the distribution was last modified.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "Logging":{ - "shape":"AwsCloudFrontDistributionLogging", - "documentation":"

A complex type that controls whether access logs are written for the distribution.

" - }, - "Origins":{ - "shape":"AwsCloudFrontDistributionOrigins", - "documentation":"

A complex type that contains information about origins for this distribution.

" + "documentation":"

The deployment identifier for the canary deployment.

" }, - "Status":{ - "shape":"NonEmptyString", - "documentation":"

Indicates the current status of the distribution.

" + "StageVariableOverrides":{ + "shape":"FieldMap", + "documentation":"

Stage variables that are overridden in the canary release deployment. The variables include new stage variables that are introduced in the canary.

Each variable is represented as a string-to-string map between the stage variable name and the variable value.

" }, - "WebAclId":{ - "shape":"NonEmptyString", - "documentation":"

A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution.

" + "UseStageCache":{ + "shape":"Boolean", + "documentation":"

Indicates whether the canary deployment uses the stage cache.

" } }, - "documentation":"

A distribution configuration.

" + "documentation":"

Contains information about settings for canary deployment in the stage.

" }, - "AwsCloudFrontDistributionLogging":{ + "AwsApiGatewayEndpointConfiguration":{ "type":"structure", "members":{ - "Bucket":{ + "Types":{ + "shape":"NonEmptyStringList", + "documentation":"

A list of endpoint types for the REST API.

For an edge-optimized API, the endpoint type is EDGE. For a Regional API, the endpoint type is REGIONAL. For a private API, the endpoint type is PRIVATE.

" + } + }, + "documentation":"

Contains information about the endpoints for the API.

" + }, + "AwsApiGatewayMethodSettings":{ + "type":"structure", + "members":{ + "MetricsEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether CloudWatch metrics are enabled for the method.

" + }, + "LoggingLevel":{ "shape":"NonEmptyString", - "documentation":"

The Amazon S3 bucket to store the access logs in.

" + "documentation":"

The logging level for this method. The logging level affects the log entries that are pushed to CloudWatch Logs.

If the logging level is ERROR, then the logs only include error-level entries.

If the logging level is INFO, then the logs include both ERROR events and extra informational events.

Valid values: OFF | ERROR | INFO

" }, - "Enabled":{ + "DataTraceEnabled":{ "shape":"Boolean", - "documentation":"

With this field, you can enable or disable the selected distribution.

" + "documentation":"

Indicates whether data trace logging is enabled for the method. Data trace logging affects the log entries that are pushed to CloudWatch Logs.

" }, - "IncludeCookies":{ + "ThrottlingBurstLimit":{ + "shape":"Integer", + "documentation":"

The throttling burst limit for the method.

" + }, + "ThrottlingRateLimit":{ + "shape":"Double", + "documentation":"

The throttling rate limit for the method.

" + }, + "CachingEnabled":{ "shape":"Boolean", - "documentation":"

Specifies whether you want CloudFront to include cookies in access logs.

" + "documentation":"

Indicates whether responses are cached and returned for requests. For responses to be cached, a cache cluster must be enabled on the stage.

" }, - "Prefix":{ - "shape":"NonEmptyString", - "documentation":"

An optional string that you want CloudFront to use as a prefix to the access log filenames for this distribution.

" - } - }, - "documentation":"

A complex type that controls whether access logs are written for the distribution.

" - }, - "AwsCloudFrontDistributionOriginItem":{ - "type":"structure", - "members":{ - "DomainName":{ + "CacheTtlInSeconds":{ + "shape":"Integer", + "documentation":"

Specifies the time to live (TTL), in seconds, for cached responses. The higher the TTL, the longer the response is cached.

" + }, + "CacheDataEncrypted":{ + "shape":"Boolean", + "documentation":"

Indicates whether the cached responses are encrypted.

" + }, + "RequireAuthorizationForCacheControl":{ + "shape":"Boolean", + "documentation":"

Indicates whether authorization is required for a cache invalidation request.

" + }, + "UnauthorizedCacheControlHeaderStrategy":{ "shape":"NonEmptyString", - "documentation":"

Amazon S3 origins: The DNS name of the Amazon S3 bucket from which you want CloudFront to get objects for this origin.

" + "documentation":"

Indicates how to handle unauthorized requests for cache invalidation.

Valid values: FAIL_WITH_403 | SUCCEED_WITH_RESPONSE_HEADER | SUCCEED_WITHOUT_RESPONSE_HEADER

" }, - "Id":{ + "HttpMethod":{ "shape":"NonEmptyString", - "documentation":"

A unique identifier for the origin or origin group.

" + "documentation":"

The HTTP method. You can use an asterisk (*) as a wildcard to apply method settings to multiple methods.

" }, - "OriginPath":{ + "ResourcePath":{ "shape":"NonEmptyString", - "documentation":"

An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.

" + "documentation":"

The resource path for this method. Forward slashes (/) are encoded as ~1 . The initial slash must include a forward slash.

For example, the path value /resource/subresource must be encoded as /~1resource~1subresource.

To specify the root path, use only a slash (/). You can use an asterisk (*) as a wildcard to apply method settings to multiple methods.

" } }, - "documentation":"

A complex type that describes the Amazon S3 bucket, HTTP server (for example, a web server), Amazon Elemental MediaStore, or other server from which CloudFront gets your files.

" + "documentation":"

Defines settings for a method for the stage.

" }, - "AwsCloudFrontDistributionOriginItemList":{ + "AwsApiGatewayMethodSettingsList":{ "type":"list", - "member":{"shape":"AwsCloudFrontDistributionOriginItem"} + "member":{"shape":"AwsApiGatewayMethodSettings"} }, - "AwsCloudFrontDistributionOrigins":{ - "type":"structure", - "members":{ - "Items":{ - "shape":"AwsCloudFrontDistributionOriginItemList", - "documentation":"

A complex type that contains origins or origin groups for this distribution.

" - } - }, - "documentation":"

A complex type that contains information about origins and origin groups for this distribution.

" - }, - "AwsCodeBuildProjectDetails":{ + "AwsApiGatewayRestApiDetails":{ "type":"structure", "members":{ - "EncryptionKey":{ + "Id":{ "shape":"NonEmptyString", - "documentation":"

The AWS Key Management Service (AWS KMS) customer master key (CMK) used to encrypt the build output artifacts.

You can specify either the Amazon Resource Name (ARN) of the CMK or, if available, the CMK alias (using the format alias/alias-name).

" - }, - "Environment":{ - "shape":"AwsCodeBuildProjectEnvironment", - "documentation":"

Information about the build environment for this build project.

" + "documentation":"

The identifier of the REST API.

" }, "Name":{ "shape":"NonEmptyString", - "documentation":"

The name of the build project.

" + "documentation":"

The name of the REST API.

" }, - "Source":{ - "shape":"AwsCodeBuildProjectSource", - "documentation":"

Information about the build input source code for this build project.

" + "Description":{ + "shape":"NonEmptyString", + "documentation":"

A description of the REST API.

" }, - "ServiceRole":{ + "CreatedDate":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the IAM role that enables AWS CodeBuild to interact with dependent AWS services on behalf of the AWS account.

" + "documentation":"

Indicates when the API was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "VpcConfig":{ - "shape":"AwsCodeBuildProjectVpcConfig", - "documentation":"

Information about the VPC configuration that AWS CodeBuild accesses.

" + "Version":{ + "shape":"NonEmptyString", + "documentation":"

The version identifier for the REST API.

" + }, + "BinaryMediaTypes":{ + "shape":"NonEmptyStringList", + "documentation":"

The list of binary media types supported by the REST API.

" + }, + "MinimumCompressionSize":{ + "shape":"Integer", + "documentation":"

The minimum size in bytes of a payload before compression is enabled.

If null, then compression is disabled.

If 0, then all payloads are compressed.

" + }, + "ApiKeySource":{ + "shape":"NonEmptyString", + "documentation":"

The source of the API key for metering requests according to a usage plan.

HEADER indicates whether to read the API key from the X-API-Key header of a request.

AUTHORIZER indicates whether to read the API key from the UsageIdentifierKey from a custom authorizer.

" + }, + "EndpointConfiguration":{ + "shape":"AwsApiGatewayEndpointConfiguration", + "documentation":"

The endpoint configuration of the REST API.

" } }, - "documentation":"

Information about an AWS CodeBuild project.

" + "documentation":"

contains information about a REST API in version 1 of Amazon API Gateway.

" }, - "AwsCodeBuildProjectEnvironment":{ + "AwsApiGatewayStageDetails":{ "type":"structure", "members":{ - "Certificate":{ + "DeploymentId":{ "shape":"NonEmptyString", - "documentation":"

The certificate to use with this build project.

" + "documentation":"

The identifier of the deployment that the stage points to.

" }, - "ImagePullCredentialsType":{ + "ClientCertificateId":{ "shape":"NonEmptyString", - "documentation":"

The type of credentials AWS CodeBuild uses to pull images in your build.

Valid values:

When you use a cross-account or private registry image, you must use SERVICE_ROLE credentials. When you use an AWS CodeBuild curated image, you must use CODEBUILD credentials.

" + "documentation":"

The identifier of the client certificate for the stage.

" }, - "RegistryCredential":{ - "shape":"AwsCodeBuildProjectEnvironmentRegistryCredential", - "documentation":"

The credentials for access to a private registry.

" + "StageName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the stage.

" }, - "Type":{ + "Description":{ "shape":"NonEmptyString", - "documentation":"

The type of build environment to use for related builds.

The environment type ARM_CONTAINER is available only in Regions US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Sydney), and Europe (Frankfurt).

The environment type LINUX_CONTAINER with compute type build.general1.2xlarge is available only in Regions US East (N. Virginia), US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), China (Beijing), and China (Ningxia).

The environment type LINUX_GPU_CONTAINER is available only in Regions US East (N. Virginia), US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), China (Beijing), and China (Ningxia).

Valid values: WINDOWS_CONTAINER | LINUX_CONTAINER | LINUX_GPU_CONTAINER | ARM_CONTAINER

" - } - }, - "documentation":"

Information about the build environment for this build project.

" - }, - "AwsCodeBuildProjectEnvironmentRegistryCredential":{ - "type":"structure", - "members":{ - "Credential":{ + "documentation":"

A description of the stage.

" + }, + "CacheClusterEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether a cache cluster is enabled for the stage.

" + }, + "CacheClusterSize":{ "shape":"NonEmptyString", - "documentation":"

The Amazon Resource Name (ARN) or name of credentials created using AWS Secrets Manager.

The credential can use the name of the credentials only if they exist in your current AWS Region.

" + "documentation":"

If a cache cluster is enabled, the size of the cache cluster.

" }, - "CredentialProvider":{ + "CacheClusterStatus":{ "shape":"NonEmptyString", - "documentation":"

The service that created the credentials to access a private Docker registry.

The valid value, SECRETS_MANAGER, is for AWS Secrets Manager.

" + "documentation":"

If a cache cluster is enabled, the status of the cache cluster.

" + }, + "MethodSettings":{ + "shape":"AwsApiGatewayMethodSettingsList", + "documentation":"

Defines the method settings for the stage.

" + }, + "Variables":{ + "shape":"FieldMap", + "documentation":"

A map that defines the stage variables for the stage.

Variable names can have alphanumeric and underscore characters.

Variable values can contain the following characters:

" + }, + "DocumentationVersion":{ + "shape":"NonEmptyString", + "documentation":"

The version of the API documentation that is associated with the stage.

" + }, + "AccessLogSettings":{ + "shape":"AwsApiGatewayAccessLogSettings", + "documentation":"

Settings for logging access for the stage.

" + }, + "CanarySettings":{ + "shape":"AwsApiGatewayCanarySettings", + "documentation":"

Information about settings for canary deployment in the stage.

" + }, + "TracingEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether active tracing with AWS X-Ray is enabled for the stage.

" + }, + "CreatedDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the stage was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "LastUpdatedDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the stage was most recently updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "WebAclArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the web ACL associated with the stage.

" } }, - "documentation":"

The credentials for access to a private registry.

" + "documentation":"

Provides information about a version 1 Amazon API Gateway stage.

" }, - "AwsCodeBuildProjectSource":{ + "AwsApiGatewayV2ApiDetails":{ "type":"structure", "members":{ - "Type":{ + "ApiEndpoint":{ "shape":"NonEmptyString", - "documentation":"

The type of repository that contains the source code to be built. Valid values are:

" + "documentation":"

The URI of the API.

Uses the format <api-id>.execute-api.<region>.amazonaws.com

The stage name is typically appended to the URI to form a complete path to a deployed API stage.

" }, - "Location":{ + "ApiId":{ "shape":"NonEmptyString", - "documentation":"

Information about the location of the source code to be built.

Valid values include:

" + "documentation":"

The identifier of the API.

" }, - "GitCloneDepth":{ - "shape":"Integer", - "documentation":"

Information about the Git clone depth for the build project.

" + "ApiKeySelectionExpression":{ + "shape":"NonEmptyString", + "documentation":"

An API key selection expression. Supported only for WebSocket APIs.

" }, - "InsecureSsl":{ - "shape":"Boolean", - "documentation":"

Whether to ignore SSL warnings while connecting to the project source code.

" + "CreatedDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the API was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "Description":{ + "shape":"NonEmptyString", + "documentation":"

A description of the API.

" + }, + "Version":{ + "shape":"NonEmptyString", + "documentation":"

The version identifier for the API.

" + }, + "Name":{ + "shape":"NonEmptyString", + "documentation":"

The name of the API.

" + }, + "ProtocolType":{ + "shape":"NonEmptyString", + "documentation":"

The API protocol for the API.

Valid values: WEBSOCKET | HTTP

" + }, + "RouteSelectionExpression":{ + "shape":"NonEmptyString", + "documentation":"

The route selection expression for the API.

For HTTP APIs, must be ${request.method} ${request.path}. This is the default value for HTTP APIs.

For WebSocket APIs, there is no default value.

" + }, + "CorsConfiguration":{ + "shape":"AwsCorsConfiguration", + "documentation":"

A cross-origin resource sharing (CORS) configuration. Supported only for HTTP APIs.

" } }, - "documentation":"

Information about the build input source code for this build project.

" + "documentation":"

Contains information about a version 2 API in Amazon API Gateway.

" }, - "AwsCodeBuildProjectVpcConfig":{ + "AwsApiGatewayV2RouteSettings":{ "type":"structure", "members":{ - "VpcId":{ + "DetailedMetricsEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether detailed metrics are enabled.

" + }, + "LoggingLevel":{ "shape":"NonEmptyString", - "documentation":"

The ID of the VPC.

" + "documentation":"

The logging level. The logging level affects the log entries that are pushed to CloudWatch Logs. Supported only for WebSocket APIs.

If the logging level is ERROR, then the logs only include error-level entries.

If the logging level is INFO, then the logs include both ERROR events and extra informational events.

Valid values: OFF | ERROR | INFO

" }, - "Subnets":{ - "shape":"NonEmptyStringList", - "documentation":"

A list of one or more subnet IDs in your Amazon VPC.

" + "DataTraceEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether data trace logging is enabled. Data trace logging affects the log entries that are pushed to CloudWatch Logs. Supported only for WebSocket APIs.

" }, - "SecurityGroupIds":{ - "shape":"NonEmptyStringList", - "documentation":"

A list of one or more security group IDs in your Amazon VPC.

" + "ThrottlingBurstLimit":{ + "shape":"Integer", + "documentation":"

The throttling burst limit.

" + }, + "ThrottlingRateLimit":{ + "shape":"Double", + "documentation":"

The throttling rate limit.

" } }, - "documentation":"

Information about the VPC configuration that AWS CodeBuild accesses.

" + "documentation":"

Contains route settings for a stage.

" }, - "AwsDynamoDbTableAttributeDefinition":{ + "AwsApiGatewayV2StageDetails":{ "type":"structure", "members":{ - "AttributeName":{ + "CreatedDate":{ "shape":"NonEmptyString", - "documentation":"

The name of the attribute.

" + "documentation":"

Indicates when the stage was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "AttributeType":{ + "Description":{ "shape":"NonEmptyString", - "documentation":"

The type of the attribute.

" + "documentation":"

The description of the stage.

" + }, + "DefaultRouteSettings":{ + "shape":"AwsApiGatewayV2RouteSettings", + "documentation":"

Default route settings for the stage.

" + }, + "DeploymentId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the deployment that the stage is associated with.

" + }, + "LastUpdatedDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the stage was most recently updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "RouteSettings":{ + "shape":"AwsApiGatewayV2RouteSettings", + "documentation":"

The route settings for the stage.

" + }, + "StageName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the stage.

" + }, + "StageVariables":{ + "shape":"FieldMap", + "documentation":"

A map that defines the stage variables for the stage.

Variable names can have alphanumeric and underscore characters.

Variable values can contain the following characters:

" + }, + "AccessLogSettings":{ + "shape":"AwsApiGatewayAccessLogSettings", + "documentation":"

Information about settings for logging access for the stage.

" + }, + "AutoDeploy":{ + "shape":"Boolean", + "documentation":"

Indicates whether updates to an API automatically trigger a new deployment.

" + }, + "LastDeploymentStatusMessage":{ + "shape":"NonEmptyString", + "documentation":"

The status of the last deployment of a stage. Supported only if the stage has automatic deployment enabled.

" + }, + "ApiGatewayManaged":{ + "shape":"Boolean", + "documentation":"

Indicates whether the stage is managed by API Gateway.

" } }, - "documentation":"

Contains a definition of an attribute for the table.

" - }, - "AwsDynamoDbTableAttributeDefinitionList":{ - "type":"list", - "member":{"shape":"AwsDynamoDbTableAttributeDefinition"} + "documentation":"

Contains information about a version 2 stage for Amazon API Gateway.

" }, - "AwsDynamoDbTableBillingModeSummary":{ + "AwsAutoScalingAutoScalingGroupDetails":{ "type":"structure", "members":{ - "BillingMode":{ + "LaunchConfigurationName":{ "shape":"NonEmptyString", - "documentation":"

The method used to charge for read and write throughput and to manage capacity.

" + "documentation":"

The name of the launch configuration.

" }, - "LastUpdateToPayPerRequestDateTime":{ + "LoadBalancerNames":{ + "shape":"StringList", + "documentation":"

The list of load balancers associated with the group.

" + }, + "HealthCheckType":{ "shape":"NonEmptyString", - "documentation":"

If the billing mode is PAY_PER_REQUEST, indicates when the billing mode was set to that value.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The service to use for the health checks.

" + }, + "HealthCheckGracePeriod":{ + "shape":"Integer", + "documentation":"

The amount of time, in seconds, that Amazon EC2 Auto Scaling waits before it checks the health status of an EC2 instance that has come into service.

" + }, + "CreatedTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the auto scaling group was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" } }, - "documentation":"

Provides information about the billing for read/write capacity on the table.

" + "documentation":"

Provides details about an auto scaling group.

" }, - "AwsDynamoDbTableDetails":{ + "AwsCertificateManagerCertificateDetails":{ "type":"structure", "members":{ - "AttributeDefinitions":{ - "shape":"AwsDynamoDbTableAttributeDefinitionList", - "documentation":"

A list of attribute definitions for the table.

" + "CertificateAuthorityArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the private certificate authority (CA) that will be used to issue the certificate.

" }, - "BillingModeSummary":{ - "shape":"AwsDynamoDbTableBillingModeSummary", - "documentation":"

Information about the billing for read/write capacity on the table.

" + "CreatedAt":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the certificate was requested.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "CreationDateTime":{ + "DomainName":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the table was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The fully qualified domain name (FQDN), such as www.example.com, that is secured by the certificate.

" }, - "GlobalSecondaryIndexes":{ - "shape":"AwsDynamoDbTableGlobalSecondaryIndexList", - "documentation":"

List of global secondary indexes for the table.

" + "DomainValidationOptions":{ + "shape":"AwsCertificateManagerCertificateDomainValidationOptions", + "documentation":"

Contains information about the initial validation of each domain name that occurs as a result of the RequestCertificate request.

Only provided if the certificate type is AMAZON_ISSUED.

" }, - "GlobalTableVersion":{ + "ExtendedKeyUsages":{ + "shape":"AwsCertificateManagerCertificateExtendedKeyUsages", + "documentation":"

Contains a list of Extended Key Usage X.509 v3 extension objects. Each object specifies a purpose for which the certificate public key can be used and consists of a name and an object identifier (OID).

" + }, + "FailureReason":{ "shape":"NonEmptyString", - "documentation":"

The version of global tables being used.

" + "documentation":"

For a failed certificate request, the reason for the failure.

Valid values: NO_AVAILABLE_CONTACTS | ADDITIONAL_VERIFICATION_REQUIRED | DOMAIN_NOT_ALLOWED | INVALID_PUBLIC_DOMAIN | DOMAIN_VALIDATION_DENIED | CAA_ERROR | PCA_LIMIT_EXCEEDED | PCA_INVALID_ARN | PCA_INVALID_STATE | PCA_REQUEST_FAILED | PCA_NAME_CONSTRAINTS_VALIDATION | PCA_RESOURCE_NOT_FOUND | PCA_INVALID_ARGS | PCA_INVALID_DURATION | PCA_ACCESS_DENIED | SLR_NOT_FOUND | OTHER

" }, - "ItemCount":{ - "shape":"Integer", - "documentation":"

The number of items in the table.

" + "ImportedAt":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the certificate was imported. Provided if the certificate type is IMPORTED.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "KeySchema":{ - "shape":"AwsDynamoDbTableKeySchemaList", - "documentation":"

The primary key structure for the table.

" + "InUseBy":{ + "shape":"StringList", + "documentation":"

The list of ARNs for the AWS resources that use the certificate.

" }, - "LatestStreamArn":{ + "IssuedAt":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the latest stream for the table.

" + "documentation":"

Indicates when the certificate was issued. Provided if the certificate type is AMAZON_ISSUED.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "LatestStreamLabel":{ + "Issuer":{ "shape":"NonEmptyString", - "documentation":"

The label of the latest stream. The label is not a unique identifier.

" + "documentation":"

The name of the certificate authority that issued and signed the certificate.

" }, - "LocalSecondaryIndexes":{ - "shape":"AwsDynamoDbTableLocalSecondaryIndexList", - "documentation":"

The list of local secondary indexes for the table.

" + "KeyAlgorithm":{ + "shape":"NonEmptyString", + "documentation":"

The algorithm that was used to generate the public-private key pair.

Valid values: RSA_2048 | RSA_1024 | RSA_4096 | EC_prime256v1 | EC_secp384r1 | EC_secp521r1

" }, - "ProvisionedThroughput":{ - "shape":"AwsDynamoDbTableProvisionedThroughput", - "documentation":"

Information about the provisioned throughput for the table.

" + "KeyUsages":{ + "shape":"AwsCertificateManagerCertificateKeyUsages", + "documentation":"

A list of key usage X.509 v3 extension objects.

" }, - "Replicas":{ - "shape":"AwsDynamoDbTableReplicaList", - "documentation":"

The list of replicas of this table.

" + "NotAfter":{ + "shape":"NonEmptyString", + "documentation":"

The time after which the certificate becomes invalid.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "RestoreSummary":{ - "shape":"AwsDynamoDbTableRestoreSummary", - "documentation":"

Information about the restore for the table.

" + "NotBefore":{ + "shape":"NonEmptyString", + "documentation":"

The time before which the certificate is not valid.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "SseDescription":{ - "shape":"AwsDynamoDbTableSseDescription", - "documentation":"

Information about the server-side encryption for the table.

" + "Options":{ + "shape":"AwsCertificateManagerCertificateOptions", + "documentation":"

Provides a value that specifies whether to add the certificate to a transparency log.

" }, - "StreamSpecification":{ - "shape":"AwsDynamoDbTableStreamSpecification", - "documentation":"

The current DynamoDB Streams configuration for the table.

" + "RenewalEligibility":{ + "shape":"NonEmptyString", + "documentation":"

Whether the certificate is eligible for renewal.

Valid values: ELIGIBLE | INELIGIBLE

" }, - "TableId":{ + "RenewalSummary":{ + "shape":"AwsCertificateManagerCertificateRenewalSummary", + "documentation":"

Information about the status of the AWS Certificate Manager managed renewal for the certificate. Provided only when the certificate type is AMAZON_ISSUED.

" + }, + "Serial":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the table.

" + "documentation":"

The serial number of the certificate.

" }, - "TableName":{ + "SignatureAlgorithm":{ "shape":"NonEmptyString", - "documentation":"

The name of the table.

" + "documentation":"

The algorithm that was used to sign the certificate.

" }, - "TableSizeBytes":{ - "shape":"SizeBytes", - "documentation":"

The total size of the table in bytes.

" + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The status of the certificate.

Valid values: PENDING_VALIDATION | ISSUED | INACTIVE | EXPIRED | VALIDATION_TIMED_OUT | REVOKED | FAILED

" }, - "TableStatus":{ + "Subject":{ "shape":"NonEmptyString", - "documentation":"

The current status of the table.

" + "documentation":"

The name of the entity that is associated with the public key contained in the certificate.

" + }, + "SubjectAlternativeNames":{ + "shape":"StringList", + "documentation":"

One or more domain names (subject alternative names) included in the certificate. This list contains the domain names that are bound to the public key that is contained in the certificate.

The subject alternative names include the canonical domain name (CN) of the certificate and additional domain names that can be used to connect to the website.

" + }, + "Type":{ + "shape":"NonEmptyString", + "documentation":"

The source of the certificate. For certificates that AWS Certificate Manager provides, Type is AMAZON_ISSUED. For certificates that are imported with ImportCertificate, Type is IMPORTED.

Valid values: IMPORTED | AMAZON_ISSUED | PRIVATE

" } }, - "documentation":"

Provides details about a DynamoDB table.

" + "documentation":"

Provides details about an AWS Certificate Manager certificate.

" }, - "AwsDynamoDbTableGlobalSecondaryIndex":{ + "AwsCertificateManagerCertificateDomainValidationOption":{ "type":"structure", "members":{ - "Backfilling":{ - "shape":"Boolean", - "documentation":"

Whether the index is currently backfilling.

" - }, - "IndexArn":{ - "shape":"NonEmptyString", - "documentation":"

The ARN of the index.

" - }, - "IndexName":{ + "DomainName":{ "shape":"NonEmptyString", - "documentation":"

The name of the index.

" + "documentation":"

A fully qualified domain name (FQDN) in the certificate.

" }, - "IndexSizeBytes":{ - "shape":"SizeBytes", - "documentation":"

The total size in bytes of the index.

" + "ResourceRecord":{ + "shape":"AwsCertificateManagerCertificateResourceRecord", + "documentation":"

The CNAME record that is added to the DNS database for domain validation.

" }, - "IndexStatus":{ + "ValidationDomain":{ "shape":"NonEmptyString", - "documentation":"

The current status of the index.

" - }, - "ItemCount":{ - "shape":"Integer", - "documentation":"

The number of items in the index.

" + "documentation":"

The domain name that AWS Certificate Manager uses to send domain validation emails.

" }, - "KeySchema":{ - "shape":"AwsDynamoDbTableKeySchemaList", - "documentation":"

The key schema for the index.

" + "ValidationEmails":{ + "shape":"StringList", + "documentation":"

A list of email addresses that AWS Certificate Manager uses to send domain validation emails.

" }, - "Projection":{ - "shape":"AwsDynamoDbTableProjection", - "documentation":"

Attributes that are copied from the table into an index.

" + "ValidationMethod":{ + "shape":"NonEmptyString", + "documentation":"

The method used to validate the domain name.

" }, - "ProvisionedThroughput":{ - "shape":"AwsDynamoDbTableProvisionedThroughput", - "documentation":"

Information about the provisioned throughput settings for the indexes.

" + "ValidationStatus":{ + "shape":"NonEmptyString", + "documentation":"

The validation status of the domain name.

" } }, - "documentation":"

Information abut a global secondary index for the table.

" + "documentation":"

Contains information about one of the following:

" }, - "AwsDynamoDbTableGlobalSecondaryIndexList":{ + "AwsCertificateManagerCertificateDomainValidationOptions":{ "type":"list", - "member":{"shape":"AwsDynamoDbTableGlobalSecondaryIndex"} + "member":{"shape":"AwsCertificateManagerCertificateDomainValidationOption"} }, - "AwsDynamoDbTableKeySchema":{ + "AwsCertificateManagerCertificateExtendedKeyUsage":{ "type":"structure", "members":{ - "AttributeName":{ + "Name":{ "shape":"NonEmptyString", - "documentation":"

The name of the key schema attribute.

" + "documentation":"

The name of an extension value. Indicates the purpose for which the certificate public key can be used.

" }, - "KeyType":{ + "OId":{ "shape":"NonEmptyString", - "documentation":"

The type of key used for the key schema attribute.

" + "documentation":"

An object identifier (OID) for the extension value.

The format is numbers separated by periods.

" } }, - "documentation":"

A component of the key schema for the DynamoDB table, a global secondary index, or a local secondary index.

" + "documentation":"

Contains information about an extended key usage X.509 v3 extension object.

" }, - "AwsDynamoDbTableKeySchemaList":{ + "AwsCertificateManagerCertificateExtendedKeyUsages":{ "type":"list", - "member":{"shape":"AwsDynamoDbTableKeySchema"} + "member":{"shape":"AwsCertificateManagerCertificateExtendedKeyUsage"} }, - "AwsDynamoDbTableLocalSecondaryIndex":{ + "AwsCertificateManagerCertificateKeyUsage":{ "type":"structure", "members":{ - "IndexArn":{ - "shape":"NonEmptyString", - "documentation":"

The ARN of the index.

" - }, - "IndexName":{ + "Name":{ "shape":"NonEmptyString", - "documentation":"

The name of the index.

" - }, - "KeySchema":{ - "shape":"AwsDynamoDbTableKeySchemaList", - "documentation":"

The complete key schema for the index.

" - }, - "Projection":{ - "shape":"AwsDynamoDbTableProjection", - "documentation":"

Attributes that are copied from the table into the index. These are in addition to the primary key attributes and index key attributes, which are automatically projected.

" + "documentation":"

The key usage extension name.

" } }, - "documentation":"

Information about a local secondary index for a DynamoDB table.

" + "documentation":"

Contains information about a key usage X.509 v3 extension object.

" }, - "AwsDynamoDbTableLocalSecondaryIndexList":{ + "AwsCertificateManagerCertificateKeyUsages":{ "type":"list", - "member":{"shape":"AwsDynamoDbTableLocalSecondaryIndex"} + "member":{"shape":"AwsCertificateManagerCertificateKeyUsage"} }, - "AwsDynamoDbTableProjection":{ + "AwsCertificateManagerCertificateOptions":{ "type":"structure", "members":{ - "NonKeyAttributes":{ - "shape":"StringList", - "documentation":"

The nonkey attributes that are projected into the index. For each attribute, provide the attribute name.

" - }, - "ProjectionType":{ + "CertificateTransparencyLoggingPreference":{ "shape":"NonEmptyString", - "documentation":"

The types of attributes that are projected into the index.

" + "documentation":"

Whether to add the certificate to a transparency log.

Valid values: DISABLED | ENABLED

" } }, - "documentation":"

For global and local secondary indexes, identifies the attributes that are copied from the table into the index.

" + "documentation":"

Contains other options for the certificate.

" }, - "AwsDynamoDbTableProvisionedThroughput":{ + "AwsCertificateManagerCertificateRenewalSummary":{ "type":"structure", "members":{ - "LastDecreaseDateTime":{ - "shape":"NonEmptyString", - "documentation":"

Indicates when the provisioned throughput was last decreased.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "DomainValidationOptions":{ + "shape":"AwsCertificateManagerCertificateDomainValidationOptions", + "documentation":"

Information about the validation of each domain name in the certificate, as it pertains to AWS Certificate Manager managed renewal. Provided only when the certificate type is AMAZON_ISSUED.

" }, - "LastIncreaseDateTime":{ + "RenewalStatus":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the provisioned throughput was last increased.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "NumberOfDecreasesToday":{ - "shape":"Integer", - "documentation":"

The number of times during the current UTC calendar day that the provisioned throughput was decreased.

" + "documentation":"

The status of the AWS Certificate Manager managed renewal of the certificate.

Valid values: PENDING_AUTO_RENEWAL | PENDING_VALIDATION | SUCCESS | FAILED

" }, - "ReadCapacityUnits":{ - "shape":"Integer", - "documentation":"

The maximum number of strongly consistent reads consumed per second before DynamoDB returns a ThrottlingException.

" + "RenewalStatusReason":{ + "shape":"NonEmptyString", + "documentation":"

The reason that a renewal request was unsuccessful.

Valid values: NO_AVAILABLE_CONTACTS | ADDITIONAL_VERIFICATION_REQUIRED | DOMAIN_NOT_ALLOWED | INVALID_PUBLIC_DOMAIN | DOMAIN_VALIDATION_DENIED | CAA_ERROR | PCA_LIMIT_EXCEEDED | PCA_INVALID_ARN | PCA_INVALID_STATE | PCA_REQUEST_FAILED | PCA_NAME_CONSTRAINTS_VALIDATION | PCA_RESOURCE_NOT_FOUND | PCA_INVALID_ARGS | PCA_INVALID_DURATION | PCA_ACCESS_DENIED | SLR_NOT_FOUND | OTHER

" }, - "WriteCapacityUnits":{ - "shape":"Integer", - "documentation":"

The maximum number of writes consumed per second before DynamoDB returns a ThrottlingException.

" + "UpdatedAt":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the renewal summary was last updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" } }, - "documentation":"

Information about the provisioned throughput for the table or for a global secondary index.

" + "documentation":"

Contains information about the AWS Certificate Manager managed renewal for an AMAZON_ISSUED certificate.

" }, - "AwsDynamoDbTableProvisionedThroughputOverride":{ + "AwsCertificateManagerCertificateResourceRecord":{ "type":"structure", "members":{ - "ReadCapacityUnits":{ - "shape":"Integer", - "documentation":"

The read capacity units for the replica.

" - } - }, - "documentation":"

Replica-specific configuration for the provisioned throughput.

" + "Name":{ + "shape":"NonEmptyString", + "documentation":"

The name of the resource.

" + }, + "Type":{ + "shape":"NonEmptyString", + "documentation":"

The type of resource.

" + }, + "Value":{ + "shape":"NonEmptyString", + "documentation":"

The value of the resource.

" + } + }, + "documentation":"

Provides details about the CNAME record that is added to the DNS database for domain validation.

" }, - "AwsDynamoDbTableReplica":{ + "AwsCloudFrontDistributionCacheBehavior":{ "type":"structure", "members":{ - "GlobalSecondaryIndexes":{ - "shape":"AwsDynamoDbTableReplicaGlobalSecondaryIndexList", - "documentation":"

List of global secondary indexes for the replica.

" + "ViewerProtocolPolicy":{ + "shape":"NonEmptyString", + "documentation":"

The protocol that viewers can use to access the files in an origin. You can specify the following options:

" + } + }, + "documentation":"

Information about a cache behavior for the distribution.

" + }, + "AwsCloudFrontDistributionCacheBehaviors":{ + "type":"structure", + "members":{ + "Items":{ + "shape":"AwsCloudFrontDistributionCacheBehaviorsItemList", + "documentation":"

The cache behaviors for the distribution.

" + } + }, + "documentation":"

Provides information about caching for the distribution.

" + }, + "AwsCloudFrontDistributionCacheBehaviorsItemList":{ + "type":"list", + "member":{"shape":"AwsCloudFrontDistributionCacheBehavior"} + }, + "AwsCloudFrontDistributionDefaultCacheBehavior":{ + "type":"structure", + "members":{ + "ViewerProtocolPolicy":{ + "shape":"NonEmptyString", + "documentation":"

The protocol that viewers can use to access the files in an origin. You can specify the following options:

" + } + }, + "documentation":"

Contains information about the default cache configuration for the distribution.

" + }, + "AwsCloudFrontDistributionDetails":{ + "type":"structure", + "members":{ + "CacheBehaviors":{ + "shape":"AwsCloudFrontDistributionCacheBehaviors", + "documentation":"

Provides information about the cache configuration for the distribution.

" }, - "KmsMasterKeyId":{ + "DefaultCacheBehavior":{ + "shape":"AwsCloudFrontDistributionDefaultCacheBehavior", + "documentation":"

The default cache behavior for the configuration.

" + }, + "DefaultRootObject":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the AWS KMS customer master key (CMK) that will be used for AWS KMS encryption for the replica.

" + "documentation":"

The object that CloudFront sends in response to requests from the origin (for example, index.html) when a viewer requests the root URL for the distribution (http://www.example.com) instead of an object in your distribution (http://www.example.com/product-description.html).

" }, - "ProvisionedThroughputOverride":{ - "shape":"AwsDynamoDbTableProvisionedThroughputOverride", - "documentation":"

Replica-specific configuration for the provisioned throughput.

" + "DomainName":{ + "shape":"NonEmptyString", + "documentation":"

The domain name corresponding to the distribution.

" }, - "RegionName":{ + "ETag":{ "shape":"NonEmptyString", - "documentation":"

The name of the Region where the replica is located.

" + "documentation":"

The entity tag is a hash of the object.

" }, - "ReplicaStatus":{ + "LastModifiedTime":{ "shape":"NonEmptyString", - "documentation":"

The current status of the replica.

" + "documentation":"

Indicates when that the distribution was last modified.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "ReplicaStatusDescription":{ + "Logging":{ + "shape":"AwsCloudFrontDistributionLogging", + "documentation":"

A complex type that controls whether access logs are written for the distribution.

" + }, + "Origins":{ + "shape":"AwsCloudFrontDistributionOrigins", + "documentation":"

A complex type that contains information about origins for this distribution.

" + }, + "OriginGroups":{ + "shape":"AwsCloudFrontDistributionOriginGroups", + "documentation":"

Provides information about the origin groups in the distribution.

" + }, + "Status":{ "shape":"NonEmptyString", - "documentation":"

Detailed information about the replica status.

" + "documentation":"

Indicates the current status of the distribution.

" + }, + "WebAclId":{ + "shape":"NonEmptyString", + "documentation":"

A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution.

" } }, - "documentation":"

Information about a replica of a DynamoDB table.

" + "documentation":"

A distribution configuration.

" }, - "AwsDynamoDbTableReplicaGlobalSecondaryIndex":{ + "AwsCloudFrontDistributionLogging":{ "type":"structure", "members":{ - "IndexName":{ + "Bucket":{ "shape":"NonEmptyString", - "documentation":"

The name of the index.

" + "documentation":"

The Amazon S3 bucket to store the access logs in.

" }, - "ProvisionedThroughputOverride":{ - "shape":"AwsDynamoDbTableProvisionedThroughputOverride", - "documentation":"

Replica-specific configuration for the provisioned throughput for the index.

" + "Enabled":{ + "shape":"Boolean", + "documentation":"

With this field, you can enable or disable the selected distribution.

" + }, + "IncludeCookies":{ + "shape":"Boolean", + "documentation":"

Specifies whether you want CloudFront to include cookies in access logs.

" + }, + "Prefix":{ + "shape":"NonEmptyString", + "documentation":"

An optional string that you want CloudFront to use as a prefix to the access log filenames for this distribution.

" } }, - "documentation":"

Information about a global secondary index for a DynamoDB table replica.

" + "documentation":"

A complex type that controls whether access logs are written for the distribution.

" }, - "AwsDynamoDbTableReplicaGlobalSecondaryIndexList":{ + "AwsCloudFrontDistributionOriginGroup":{ + "type":"structure", + "members":{ + "FailoverCriteria":{ + "shape":"AwsCloudFrontDistributionOriginGroupFailover", + "documentation":"

Provides the criteria for an origin group to fail over.

" + } + }, + "documentation":"

Information about an origin group for the distribution.

" + }, + "AwsCloudFrontDistributionOriginGroupFailover":{ + "type":"structure", + "members":{ + "StatusCodes":{ + "shape":"AwsCloudFrontDistributionOriginGroupFailoverStatusCodes", + "documentation":"

Information about the status codes that cause an origin group to fail over.

" + } + }, + "documentation":"

Provides information about when an origin group fails over.

" + }, + "AwsCloudFrontDistributionOriginGroupFailoverStatusCodes":{ + "type":"structure", + "members":{ + "Items":{ + "shape":"AwsCloudFrontDistributionOriginGroupFailoverStatusCodesItemList", + "documentation":"

The list of status code values that can cause a failover to the next origin.

" + }, + "Quantity":{ + "shape":"Integer", + "documentation":"

The number of status codes that can cause a failover.

" + } + }, + "documentation":"

The status codes that cause an origin group to fail over.

" + }, + "AwsCloudFrontDistributionOriginGroupFailoverStatusCodesItemList":{ "type":"list", - "member":{"shape":"AwsDynamoDbTableReplicaGlobalSecondaryIndex"} + "member":{"shape":"Integer"} }, - "AwsDynamoDbTableReplicaList":{ + "AwsCloudFrontDistributionOriginGroups":{ + "type":"structure", + "members":{ + "Items":{ + "shape":"AwsCloudFrontDistributionOriginGroupsItemList", + "documentation":"

The list of origin groups.

" + } + }, + "documentation":"

Provides information about origin groups that are associated with the distribution.

" + }, + "AwsCloudFrontDistributionOriginGroupsItemList":{ "type":"list", - "member":{"shape":"AwsDynamoDbTableReplica"} + "member":{"shape":"AwsCloudFrontDistributionOriginGroup"} }, - "AwsDynamoDbTableRestoreSummary":{ + "AwsCloudFrontDistributionOriginItem":{ "type":"structure", "members":{ - "SourceBackupArn":{ + "DomainName":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the source backup from which the table was restored.

" + "documentation":"

Amazon S3 origins: The DNS name of the Amazon S3 bucket from which you want CloudFront to get objects for this origin.

" }, - "SourceTableArn":{ + "Id":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the source table for the backup.

" + "documentation":"

A unique identifier for the origin or origin group.

" }, - "RestoreDateTime":{ + "OriginPath":{ "shape":"NonEmptyString", - "documentation":"

Indicates the point in time that the table was restored to.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.

" }, - "RestoreInProgress":{ - "shape":"Boolean", - "documentation":"

Whether a restore is currently in progress.

" + "S3OriginConfig":{ + "shape":"AwsCloudFrontDistributionOriginS3OriginConfig", + "documentation":"

An origin that is an S3 bucket that is not configured with static website hosting.

" } }, - "documentation":"

Information about the restore for the table.

" + "documentation":"

A complex type that describes the Amazon S3 bucket, HTTP server (for example, a web server), Amazon Elemental MediaStore, or other server from which CloudFront gets your files.

" }, - "AwsDynamoDbTableSseDescription":{ + "AwsCloudFrontDistributionOriginItemList":{ + "type":"list", + "member":{"shape":"AwsCloudFrontDistributionOriginItem"} + }, + "AwsCloudFrontDistributionOriginS3OriginConfig":{ "type":"structure", "members":{ - "InaccessibleEncryptionDateTime":{ - "shape":"NonEmptyString", - "documentation":"

If the key is inaccessible, the date and time when DynamoDB detected that the key was inaccessible.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "Status":{ - "shape":"NonEmptyString", - "documentation":"

The status of the server-side encryption.

" - }, - "SseType":{ - "shape":"NonEmptyString", - "documentation":"

The type of server-side encryption.

" - }, - "KmsMasterKeyArn":{ + "OriginAccessIdentity":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the AWS KMS customer master key (CMK) that is used for the AWS KMS encryption.

" + "documentation":"

The CloudFront origin access identity to associate with the origin.

" } }, - "documentation":"

Information about the server-side encryption for the table.

" + "documentation":"

Information about an origin that is an S3 bucket that is not configured with static website hosting.

" }, - "AwsDynamoDbTableStreamSpecification":{ + "AwsCloudFrontDistributionOrigins":{ "type":"structure", "members":{ - "StreamEnabled":{ - "shape":"Boolean", - "documentation":"

Indicates whether DynamoDB Streams is enabled on the table.

" - }, - "StreamViewType":{ - "shape":"NonEmptyString", - "documentation":"

Determines the information that is written to the table.

" + "Items":{ + "shape":"AwsCloudFrontDistributionOriginItemList", + "documentation":"

A complex type that contains origins or origin groups for this distribution.

" } }, - "documentation":"

The current DynamoDB Streams configuration for the table.

" + "documentation":"

A complex type that contains information about origins and origin groups for this distribution.

" }, - "AwsEc2EipDetails":{ + "AwsCloudTrailTrailDetails":{ "type":"structure", "members":{ - "InstanceId":{ + "CloudWatchLogsLogGroupArn":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the EC2 instance.

" + "documentation":"

The ARN of the log group that CloudTrail logs are delivered to.

" }, - "PublicIp":{ + "CloudWatchLogsRoleArn":{ "shape":"NonEmptyString", - "documentation":"

A public IP address that is associated with the EC2 instance.

" + "documentation":"

The ARN of the role that the CloudWatch Logs endpoint assumes when it writes to the log group.

" }, - "AllocationId":{ + "HasCustomEventSelectors":{ + "shape":"Boolean", + "documentation":"

Indicates whether the trail has custom event selectors.

" + }, + "HomeRegion":{ "shape":"NonEmptyString", - "documentation":"

The identifier that AWS assigns to represent the allocation of the Elastic IP address for use with Amazon VPC.

" + "documentation":"

The Region where the trail was created.

" }, - "AssociationId":{ + "IncludeGlobalServiceEvents":{ + "shape":"Boolean", + "documentation":"

Indicates whether the trail publishes events from global services such as IAM to the log files.

" + }, + "IsMultiRegionTrail":{ + "shape":"Boolean", + "documentation":"

Indicates whether the trail applies only to the current Region or to all Regions.

" + }, + "IsOrganizationTrail":{ + "shape":"Boolean", + "documentation":"

Whether the trail is created for all accounts in an organization in AWS Organizations, or only for the current AWS account.

" + }, + "KmsKeyId":{ "shape":"NonEmptyString", - "documentation":"

The identifier that represents the association of the Elastic IP address with an EC2 instance.

" + "documentation":"

The AWS KMS key ID to use to encrypt the logs.

" }, - "Domain":{ + "LogFileValidationEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether CloudTrail log file validation is enabled.

" + }, + "Name":{ "shape":"NonEmptyString", - "documentation":"

The domain in which to allocate the address.

If the address is for use with EC2 instances in a VPC, then Domain is vpc. Otherwise, Domain is standard.

" + "documentation":"

The name of the trail.

" }, - "PublicIpv4Pool":{ + "S3BucketName":{ "shape":"NonEmptyString", - "documentation":"

The identifier of an IP address pool. This parameter allows Amazon EC2 to select an IP address from the address pool.

" + "documentation":"

The name of the S3 bucket where the log files are published.

" }, - "NetworkBorderGroup":{ + "S3KeyPrefix":{ "shape":"NonEmptyString", - "documentation":"

The name of the location from which the Elastic IP address is advertised.

" + "documentation":"

The S3 key prefix. The key prefix is added after the name of the S3 bucket where the log files are published.

" }, - "NetworkInterfaceId":{ + "SnsTopicArn":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the network interface.

" + "documentation":"

The ARN of the SNS topic that is used for notifications of log file delivery.

" }, - "NetworkInterfaceOwnerId":{ + "SnsTopicName":{ "shape":"NonEmptyString", - "documentation":"

The AWS account ID of the owner of the network interface.

" + "documentation":"

The name of the SNS topic that is used for notifications of log file delivery.

" }, - "PrivateIpAddress":{ + "TrailArn":{ "shape":"NonEmptyString", - "documentation":"

The private IP address that is associated with the Elastic IP address.

" + "documentation":"

The ARN of the trail.

" } }, - "documentation":"

Information about an Elastic IP address.

" + "documentation":"

Provides details about a CloudTrail trail.

" }, - "AwsEc2InstanceDetails":{ + "AwsCodeBuildProjectDetails":{ "type":"structure", "members":{ - "Type":{ - "shape":"NonEmptyString", - "documentation":"

The instance type of the instance.

" - }, - "ImageId":{ + "EncryptionKey":{ "shape":"NonEmptyString", - "documentation":"

The Amazon Machine Image (AMI) ID of the instance.

" - }, - "IpV4Addresses":{ - "shape":"StringList", - "documentation":"

The IPv4 addresses associated with the instance.

" - }, - "IpV6Addresses":{ - "shape":"StringList", - "documentation":"

The IPv6 addresses associated with the instance.

" + "documentation":"

The AWS Key Management Service (AWS KMS) customer master key (CMK) used to encrypt the build output artifacts.

You can specify either the Amazon Resource Name (ARN) of the CMK or, if available, the CMK alias (using the format alias/alias-name).

" }, - "KeyName":{ - "shape":"NonEmptyString", - "documentation":"

The key name associated with the instance.

" + "Environment":{ + "shape":"AwsCodeBuildProjectEnvironment", + "documentation":"

Information about the build environment for this build project.

" }, - "IamInstanceProfileArn":{ + "Name":{ "shape":"NonEmptyString", - "documentation":"

The IAM profile ARN of the instance.

" + "documentation":"

The name of the build project.

" }, - "VpcId":{ - "shape":"NonEmptyString", - "documentation":"

The identifier of the VPC that the instance was launched in.

" + "Source":{ + "shape":"AwsCodeBuildProjectSource", + "documentation":"

Information about the build input source code for this build project.

" }, - "SubnetId":{ + "ServiceRole":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the subnet that the instance was launched in.

" + "documentation":"

The ARN of the IAM role that enables AWS CodeBuild to interact with dependent AWS services on behalf of the AWS account.

" }, - "LaunchedAt":{ - "shape":"NonEmptyString", - "documentation":"

Indicates when the instance was launched.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "VpcConfig":{ + "shape":"AwsCodeBuildProjectVpcConfig", + "documentation":"

Information about the VPC configuration that AWS CodeBuild accesses.

" } }, - "documentation":"

The details of an Amazon EC2 instance.

" + "documentation":"

Information about an AWS CodeBuild project.

" }, - "AwsEc2NetworkInterfaceAttachment":{ + "AwsCodeBuildProjectEnvironment":{ "type":"structure", "members":{ - "AttachTime":{ - "shape":"NonEmptyString", - "documentation":"

Indicates when the attachment initiated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "AttachmentId":{ + "Certificate":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the network interface attachment

" - }, - "DeleteOnTermination":{ - "shape":"Boolean", - "documentation":"

Indicates whether the network interface is deleted when the instance is terminated.

" - }, - "DeviceIndex":{ - "shape":"Integer", - "documentation":"

The device index of the network interface attachment on the instance.

" + "documentation":"

The certificate to use with this build project.

" }, - "InstanceId":{ + "ImagePullCredentialsType":{ "shape":"NonEmptyString", - "documentation":"

The ID of the instance.

" + "documentation":"

The type of credentials AWS CodeBuild uses to pull images in your build.

Valid values:

When you use a cross-account or private registry image, you must use SERVICE_ROLE credentials. When you use an AWS CodeBuild curated image, you must use CODEBUILD credentials.

" }, - "InstanceOwnerId":{ - "shape":"NonEmptyString", - "documentation":"

The AWS account ID of the owner of the instance.

" + "RegistryCredential":{ + "shape":"AwsCodeBuildProjectEnvironmentRegistryCredential", + "documentation":"

The credentials for access to a private registry.

" }, - "Status":{ + "Type":{ "shape":"NonEmptyString", - "documentation":"

The attachment state.

Valid values: attaching | attached | detaching | detached

" + "documentation":"

The type of build environment to use for related builds.

The environment type ARM_CONTAINER is available only in Regions US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Sydney), and Europe (Frankfurt).

The environment type LINUX_CONTAINER with compute type build.general1.2xlarge is available only in Regions US East (N. Virginia), US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), China (Beijing), and China (Ningxia).

The environment type LINUX_GPU_CONTAINER is available only in Regions US East (N. Virginia), US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), China (Beijing), and China (Ningxia).

Valid values: WINDOWS_CONTAINER | LINUX_CONTAINER | LINUX_GPU_CONTAINER | ARM_CONTAINER

" } }, - "documentation":"

Information about the network interface attachment.

" + "documentation":"

Information about the build environment for this build project.

" }, - "AwsEc2NetworkInterfaceDetails":{ + "AwsCodeBuildProjectEnvironmentRegistryCredential":{ "type":"structure", "members":{ - "Attachment":{ - "shape":"AwsEc2NetworkInterfaceAttachment", - "documentation":"

The network interface attachment.

" - }, - "NetworkInterfaceId":{ + "Credential":{ "shape":"NonEmptyString", - "documentation":"

The ID of the network interface.

" - }, - "SecurityGroups":{ - "shape":"AwsEc2NetworkInterfaceSecurityGroupList", - "documentation":"

Security groups for the network interface.

" + "documentation":"

The Amazon Resource Name (ARN) or name of credentials created using AWS Secrets Manager.

The credential can use the name of the credentials only if they exist in your current AWS Region.

" }, - "SourceDestCheck":{ - "shape":"Boolean", - "documentation":"

Indicates whether traffic to or from the instance is validated.

" + "CredentialProvider":{ + "shape":"NonEmptyString", + "documentation":"

The service that created the credentials to access a private Docker registry.

The valid value, SECRETS_MANAGER, is for AWS Secrets Manager.

" } }, - "documentation":"

Details about the network interface

" + "documentation":"

The credentials for access to a private registry.

" }, - "AwsEc2NetworkInterfaceSecurityGroup":{ + "AwsCodeBuildProjectSource":{ "type":"structure", "members":{ - "GroupName":{ + "Type":{ "shape":"NonEmptyString", - "documentation":"

The name of the security group.

" + "documentation":"

The type of repository that contains the source code to be built. Valid values are:

" }, - "GroupId":{ + "Location":{ "shape":"NonEmptyString", - "documentation":"

The ID of the security group.

" + "documentation":"

Information about the location of the source code to be built.

Valid values include:

" + }, + "GitCloneDepth":{ + "shape":"Integer", + "documentation":"

Information about the Git clone depth for the build project.

" + }, + "InsecureSsl":{ + "shape":"Boolean", + "documentation":"

Whether to ignore SSL warnings while connecting to the project source code.

" } }, - "documentation":"

A security group associated with the network interface.

" - }, - "AwsEc2NetworkInterfaceSecurityGroupList":{ - "type":"list", - "member":{"shape":"AwsEc2NetworkInterfaceSecurityGroup"} + "documentation":"

Information about the build input source code for this build project.

" }, - "AwsEc2SecurityGroupDetails":{ + "AwsCodeBuildProjectVpcConfig":{ "type":"structure", "members":{ - "GroupName":{ - "shape":"NonEmptyString", - "documentation":"

The name of the security group.

" - }, - "GroupId":{ - "shape":"NonEmptyString", - "documentation":"

The ID of the security group.

" - }, - "OwnerId":{ - "shape":"NonEmptyString", - "documentation":"

The AWS account ID of the owner of the security group.

" - }, "VpcId":{ "shape":"NonEmptyString", - "documentation":"

[VPC only] The ID of the VPC for the security group.

" + "documentation":"

The ID of the VPC.

" }, - "IpPermissions":{ - "shape":"AwsEc2SecurityGroupIpPermissionList", - "documentation":"

The inbound rules associated with the security group.

" + "Subnets":{ + "shape":"NonEmptyStringList", + "documentation":"

A list of one or more subnet IDs in your Amazon VPC.

" }, - "IpPermissionsEgress":{ - "shape":"AwsEc2SecurityGroupIpPermissionList", - "documentation":"

[VPC only] The outbound rules associated with the security group.

" + "SecurityGroupIds":{ + "shape":"NonEmptyStringList", + "documentation":"

A list of one or more security group IDs in your Amazon VPC.

" } }, - "documentation":"

Details about an EC2 security group.

" + "documentation":"

Information about the VPC configuration that AWS CodeBuild accesses.

" }, - "AwsEc2SecurityGroupIpPermission":{ + "AwsCorsConfiguration":{ "type":"structure", "members":{ - "IpProtocol":{ - "shape":"NonEmptyString", - "documentation":"

The IP protocol name (tcp, udp, icmp, icmpv6) or number.

[VPC only] Use -1 to specify all protocols.

When authorizing security group rules, specifying -1 or a protocol number other than tcp, udp, icmp, or icmpv6 allows traffic on all ports, regardless of any port range you specify.

For tcp, udp, and icmp, you must specify a port range.

For icmpv6, the port range is optional. If you omit the port range, traffic for all types and codes is allowed.

" - }, - "FromPort":{ - "shape":"Integer", - "documentation":"

The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.

A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.

" + "AllowOrigins":{ + "shape":"NonEmptyStringList", + "documentation":"

The allowed origins for CORS requests.

" }, - "ToPort":{ - "shape":"Integer", - "documentation":"

The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.

A value of -1 indicates all ICMP/ICMPv6 codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.

" + "AllowCredentials":{ + "shape":"Boolean", + "documentation":"

Indicates whether the CORS request includes credentials.

" }, - "UserIdGroupPairs":{ - "shape":"AwsEc2SecurityGroupUserIdGroupPairList", - "documentation":"

The security group and AWS account ID pairs.

" + "ExposeHeaders":{ + "shape":"NonEmptyStringList", + "documentation":"

The exposed headers for CORS requests.

" }, - "IpRanges":{ - "shape":"AwsEc2SecurityGroupIpRangeList", - "documentation":"

The IPv4 ranges.

" + "MaxAge":{ + "shape":"Integer", + "documentation":"

The number of seconds for which the browser caches preflight request results.

" }, - "Ipv6Ranges":{ - "shape":"AwsEc2SecurityGroupIpv6RangeList", - "documentation":"

The IPv6 ranges.

" + "AllowMethods":{ + "shape":"NonEmptyStringList", + "documentation":"

The allowed methods for CORS requests.

" }, - "PrefixListIds":{ - "shape":"AwsEc2SecurityGroupPrefixListIdList", - "documentation":"

[VPC only] The prefix list IDs for an AWS service. With outbound rules, this is the AWS service to access through a VPC endpoint from instances associated with the security group.

" + "AllowHeaders":{ + "shape":"NonEmptyStringList", + "documentation":"

The allowed headers for CORS requests.

" } }, - "documentation":"

An IP permission for an EC2 security group.

" - }, - "AwsEc2SecurityGroupIpPermissionList":{ - "type":"list", - "member":{"shape":"AwsEc2SecurityGroupIpPermission"} + "documentation":"

Contains the cross-origin resource sharing (CORS) configuration for the API. CORS is only supported for HTTP APIs.

" }, - "AwsEc2SecurityGroupIpRange":{ + "AwsDynamoDbTableAttributeDefinition":{ "type":"structure", "members":{ - "CidrIp":{ + "AttributeName":{ "shape":"NonEmptyString", - "documentation":"

The IPv4 CIDR range. You can specify either a CIDR range or a source security group, but not both. To specify a single IPv4 address, use the /32 prefix length.

" - } - }, - "documentation":"

A range of IPv4 addresses.

" - }, - "AwsEc2SecurityGroupIpRangeList":{ - "type":"list", - "member":{"shape":"AwsEc2SecurityGroupIpRange"} - }, - "AwsEc2SecurityGroupIpv6Range":{ - "type":"structure", - "members":{ - "CidrIpv6":{ + "documentation":"

The name of the attribute.

" + }, + "AttributeType":{ "shape":"NonEmptyString", - "documentation":"

The IPv6 CIDR range. You can specify either a CIDR range or a source security group, but not both. To specify a single IPv6 address, use the /128 prefix length.

" + "documentation":"

The type of the attribute.

" } }, - "documentation":"

A range of IPv6 addresses.

" + "documentation":"

Contains a definition of an attribute for the table.

" }, - "AwsEc2SecurityGroupIpv6RangeList":{ + "AwsDynamoDbTableAttributeDefinitionList":{ "type":"list", - "member":{"shape":"AwsEc2SecurityGroupIpv6Range"} + "member":{"shape":"AwsDynamoDbTableAttributeDefinition"} }, - "AwsEc2SecurityGroupPrefixListId":{ + "AwsDynamoDbTableBillingModeSummary":{ "type":"structure", "members":{ - "PrefixListId":{ + "BillingMode":{ "shape":"NonEmptyString", - "documentation":"

The ID of the prefix.

" + "documentation":"

The method used to charge for read and write throughput and to manage capacity.

" + }, + "LastUpdateToPayPerRequestDateTime":{ + "shape":"NonEmptyString", + "documentation":"

If the billing mode is PAY_PER_REQUEST, indicates when the billing mode was set to that value.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" } }, - "documentation":"

A prefix list ID.

" - }, - "AwsEc2SecurityGroupPrefixListIdList":{ - "type":"list", - "member":{"shape":"AwsEc2SecurityGroupPrefixListId"} + "documentation":"

Provides information about the billing for read/write capacity on the table.

" }, - "AwsEc2SecurityGroupUserIdGroupPair":{ + "AwsDynamoDbTableDetails":{ "type":"structure", "members":{ - "GroupId":{ - "shape":"NonEmptyString", - "documentation":"

The ID of the security group.

" + "AttributeDefinitions":{ + "shape":"AwsDynamoDbTableAttributeDefinitionList", + "documentation":"

A list of attribute definitions for the table.

" }, - "GroupName":{ - "shape":"NonEmptyString", - "documentation":"

The name of the security group.

" + "BillingModeSummary":{ + "shape":"AwsDynamoDbTableBillingModeSummary", + "documentation":"

Information about the billing for read/write capacity on the table.

" }, - "PeeringStatus":{ + "CreationDateTime":{ "shape":"NonEmptyString", - "documentation":"

The status of a VPC peering connection, if applicable.

" + "documentation":"

Indicates when the table was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "UserId":{ - "shape":"NonEmptyString", - "documentation":"

The ID of an AWS account.

For a referenced security group in another VPC, the account ID of the referenced security group is returned in the response. If the referenced security group is deleted, this value is not returned.

[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS.

" + "GlobalSecondaryIndexes":{ + "shape":"AwsDynamoDbTableGlobalSecondaryIndexList", + "documentation":"

List of global secondary indexes for the table.

" }, - "VpcId":{ + "GlobalTableVersion":{ "shape":"NonEmptyString", - "documentation":"

The ID of the VPC for the referenced security group, if applicable.

" + "documentation":"

The version of global tables being used.

" }, - "VpcPeeringConnectionId":{ - "shape":"NonEmptyString", - "documentation":"

The ID of the VPC peering connection, if applicable.

" - } - }, - "documentation":"

A relationship between a security group and a user.

" - }, - "AwsEc2SecurityGroupUserIdGroupPairList":{ - "type":"list", - "member":{"shape":"AwsEc2SecurityGroupUserIdGroupPair"} - }, - "AwsEc2VolumeAttachment":{ - "type":"structure", - "members":{ - "AttachTime":{ - "shape":"NonEmptyString", - "documentation":"

The datetime when the attachment initiated.

" + "ItemCount":{ + "shape":"Integer", + "documentation":"

The number of items in the table.

" }, - "DeleteOnTermination":{ - "shape":"Boolean", - "documentation":"

Whether the EBS volume is deleted when the EC2 instance is terminated.

" + "KeySchema":{ + "shape":"AwsDynamoDbTableKeySchemaList", + "documentation":"

The primary key structure for the table.

" }, - "InstanceId":{ + "LatestStreamArn":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the EC2 instance.

" + "documentation":"

The ARN of the latest stream for the table.

" }, - "Status":{ + "LatestStreamLabel":{ "shape":"NonEmptyString", - "documentation":"

The attachment state of the volume.

" - } - }, - "documentation":"

An attachment to an AWS EC2 volume.

" - }, - "AwsEc2VolumeAttachmentList":{ - "type":"list", - "member":{"shape":"AwsEc2VolumeAttachment"} - }, - "AwsEc2VolumeDetails":{ - "type":"structure", - "members":{ - "CreateTime":{ - "shape":"NonEmptyString", - "documentation":"

Indicates when the volume was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The label of the latest stream. The label is not a unique identifier.

" }, - "Encrypted":{ - "shape":"Boolean", - "documentation":"

Whether the volume is encrypted.

" + "LocalSecondaryIndexes":{ + "shape":"AwsDynamoDbTableLocalSecondaryIndexList", + "documentation":"

The list of local secondary indexes for the table.

" }, - "Size":{ - "shape":"Integer", - "documentation":"

The size of the volume, in GiBs.

" + "ProvisionedThroughput":{ + "shape":"AwsDynamoDbTableProvisionedThroughput", + "documentation":"

Information about the provisioned throughput for the table.

" }, - "SnapshotId":{ - "shape":"NonEmptyString", - "documentation":"

The snapshot from which the volume was created.

" + "Replicas":{ + "shape":"AwsDynamoDbTableReplicaList", + "documentation":"

The list of replicas of this table.

" }, - "Status":{ - "shape":"NonEmptyString", - "documentation":"

The volume state.

" + "RestoreSummary":{ + "shape":"AwsDynamoDbTableRestoreSummary", + "documentation":"

Information about the restore for the table.

" }, - "KmsKeyId":{ - "shape":"NonEmptyString", - "documentation":"

The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the volume.

" + "SseDescription":{ + "shape":"AwsDynamoDbTableSseDescription", + "documentation":"

Information about the server-side encryption for the table.

" }, - "Attachments":{ - "shape":"AwsEc2VolumeAttachmentList", - "documentation":"

The volume attachments.

" - } - }, - "documentation":"

Details about an EC2 volume.

" - }, - "AwsEc2VpcDetails":{ - "type":"structure", - "members":{ - "CidrBlockAssociationSet":{ - "shape":"CidrBlockAssociationList", - "documentation":"

Information about the IPv4 CIDR blocks associated with the VPC.

" + "StreamSpecification":{ + "shape":"AwsDynamoDbTableStreamSpecification", + "documentation":"

The current DynamoDB Streams configuration for the table.

" }, - "Ipv6CidrBlockAssociationSet":{ - "shape":"Ipv6CidrBlockAssociationList", - "documentation":"

Information about the IPv6 CIDR blocks associated with the VPC.

" + "TableId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the table.

" }, - "DhcpOptionsId":{ + "TableName":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the set of Dynamic Host Configuration Protocol (DHCP) options that are associated with the VPC. If the default options are associated with the VPC, then this is default.

" + "documentation":"

The name of the table.

" }, - "State":{ + "TableSizeBytes":{ + "shape":"SizeBytes", + "documentation":"

The total size of the table in bytes.

" + }, + "TableStatus":{ "shape":"NonEmptyString", - "documentation":"

The current state of the VPC.

" + "documentation":"

The current status of the table.

" } }, - "documentation":"

Details about an EC2 VPC.

" + "documentation":"

Provides details about a DynamoDB table.

" }, - "AwsElasticsearchDomainDetails":{ + "AwsDynamoDbTableGlobalSecondaryIndex":{ "type":"structure", "members":{ - "AccessPolicies":{ - "shape":"NonEmptyString", - "documentation":"

IAM policy document specifying the access policies for the new Amazon ES domain.

" - }, - "DomainEndpointOptions":{ - "shape":"AwsElasticsearchDomainDomainEndpointOptions", - "documentation":"

Additional options for the domain endpoint.

" - }, - "DomainId":{ - "shape":"NonEmptyString", - "documentation":"

Unique identifier for an Amazon ES domain.

" + "Backfilling":{ + "shape":"Boolean", + "documentation":"

Whether the index is currently backfilling.

" }, - "DomainName":{ + "IndexArn":{ "shape":"NonEmptyString", - "documentation":"

Name of an Amazon ES domain.

Domain names are unique across all domains owned by the same account within an AWS Region.

Domain names must start with a lowercase letter and must be between 3 and 28 characters.

Valid characters are a-z (lowercase only), 0-9, and – (hyphen).

" + "documentation":"

The ARN of the index.

" }, - "Endpoint":{ + "IndexName":{ "shape":"NonEmptyString", - "documentation":"

Domain-specific endpoint used to submit index, search, and data upload requests to an Amazon ES domain.

The endpoint is a service URL.

" + "documentation":"

The name of the index.

" }, - "Endpoints":{ - "shape":"FieldMap", - "documentation":"

The key-value pair that exists if the Amazon ES domain uses VPC endpoints.

" + "IndexSizeBytes":{ + "shape":"SizeBytes", + "documentation":"

The total size in bytes of the index.

" }, - "ElasticsearchVersion":{ + "IndexStatus":{ "shape":"NonEmptyString", - "documentation":"

Elasticsearch version.

" + "documentation":"

The current status of the index.

" }, - "EncryptionAtRestOptions":{ - "shape":"AwsElasticsearchDomainEncryptionAtRestOptions", - "documentation":"

Details about the configuration for encryption at rest.

" + "ItemCount":{ + "shape":"Integer", + "documentation":"

The number of items in the index.

" }, - "NodeToNodeEncryptionOptions":{ - "shape":"AwsElasticsearchDomainNodeToNodeEncryptionOptions", - "documentation":"

Details about the configuration for node-to-node encryption.

" + "KeySchema":{ + "shape":"AwsDynamoDbTableKeySchemaList", + "documentation":"

The key schema for the index.

" }, - "VPCOptions":{ - "shape":"AwsElasticsearchDomainVPCOptions", - "documentation":"

Information that Amazon ES derives based on VPCOptions for the domain.

" + "Projection":{ + "shape":"AwsDynamoDbTableProjection", + "documentation":"

Attributes that are copied from the table into an index.

" + }, + "ProvisionedThroughput":{ + "shape":"AwsDynamoDbTableProvisionedThroughput", + "documentation":"

Information about the provisioned throughput settings for the indexes.

" } }, - "documentation":"

Information about an Elasticsearch domain.

" + "documentation":"

Information abut a global secondary index for the table.

" }, - "AwsElasticsearchDomainDomainEndpointOptions":{ + "AwsDynamoDbTableGlobalSecondaryIndexList":{ + "type":"list", + "member":{"shape":"AwsDynamoDbTableGlobalSecondaryIndex"} + }, + "AwsDynamoDbTableKeySchema":{ "type":"structure", "members":{ - "EnforceHTTPS":{ - "shape":"Boolean", - "documentation":"

Whether to require that all traffic to the domain arrive over HTTPS.

" + "AttributeName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the key schema attribute.

" }, - "TLSSecurityPolicy":{ + "KeyType":{ "shape":"NonEmptyString", - "documentation":"

The TLS security policy to apply to the HTTPS endpoint of the Elasticsearch domain.

Valid values:

" + "documentation":"

The type of key used for the key schema attribute.

" } }, - "documentation":"

Additional options for the domain endpoint, such as whether to require HTTPS for all traffic.

" + "documentation":"

A component of the key schema for the DynamoDB table, a global secondary index, or a local secondary index.

" }, - "AwsElasticsearchDomainEncryptionAtRestOptions":{ + "AwsDynamoDbTableKeySchemaList":{ + "type":"list", + "member":{"shape":"AwsDynamoDbTableKeySchema"} + }, + "AwsDynamoDbTableLocalSecondaryIndex":{ "type":"structure", "members":{ - "Enabled":{ - "shape":"Boolean", - "documentation":"

Whether encryption at rest is enabled.

" + "IndexArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the index.

" }, - "KmsKeyId":{ + "IndexName":{ "shape":"NonEmptyString", - "documentation":"

The KMS key ID. Takes the form 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a.

" + "documentation":"

The name of the index.

" + }, + "KeySchema":{ + "shape":"AwsDynamoDbTableKeySchemaList", + "documentation":"

The complete key schema for the index.

" + }, + "Projection":{ + "shape":"AwsDynamoDbTableProjection", + "documentation":"

Attributes that are copied from the table into the index. These are in addition to the primary key attributes and index key attributes, which are automatically projected.

" } }, - "documentation":"

Details about the configuration for encryption at rest.

" + "documentation":"

Information about a local secondary index for a DynamoDB table.

" }, - "AwsElasticsearchDomainNodeToNodeEncryptionOptions":{ + "AwsDynamoDbTableLocalSecondaryIndexList":{ + "type":"list", + "member":{"shape":"AwsDynamoDbTableLocalSecondaryIndex"} + }, + "AwsDynamoDbTableProjection":{ "type":"structure", "members":{ - "Enabled":{ - "shape":"Boolean", - "documentation":"

Whether node-to-node encryption is enabled.

" + "NonKeyAttributes":{ + "shape":"StringList", + "documentation":"

The nonkey attributes that are projected into the index. For each attribute, provide the attribute name.

" + }, + "ProjectionType":{ + "shape":"NonEmptyString", + "documentation":"

The types of attributes that are projected into the index.

" } }, - "documentation":"

Details about the configuration for node-to-node encryption.

" + "documentation":"

For global and local secondary indexes, identifies the attributes that are copied from the table into the index.

" }, - "AwsElasticsearchDomainVPCOptions":{ + "AwsDynamoDbTableProvisionedThroughput":{ "type":"structure", "members":{ - "AvailabilityZones":{ - "shape":"NonEmptyStringList", - "documentation":"

The list of Availability Zones associated with the VPC subnets.

" + "LastDecreaseDateTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the provisioned throughput was last decreased.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "SecurityGroupIds":{ - "shape":"NonEmptyStringList", - "documentation":"

The list of security group IDs associated with the VPC endpoints for the domain.

" + "LastIncreaseDateTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the provisioned throughput was last increased.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "SubnetIds":{ - "shape":"NonEmptyStringList", - "documentation":"

A list of subnet IDs associated with the VPC endpoints for the domain.

" + "NumberOfDecreasesToday":{ + "shape":"Integer", + "documentation":"

The number of times during the current UTC calendar day that the provisioned throughput was decreased.

" }, - "VPCId":{ - "shape":"NonEmptyString", - "documentation":"

ID for the VPC.

" + "ReadCapacityUnits":{ + "shape":"Integer", + "documentation":"

The maximum number of strongly consistent reads consumed per second before DynamoDB returns a ThrottlingException.

" + }, + "WriteCapacityUnits":{ + "shape":"Integer", + "documentation":"

The maximum number of writes consumed per second before DynamoDB returns a ThrottlingException.

" } }, - "documentation":"

Information that Amazon ES derives based on VPCOptions for the domain.

" + "documentation":"

Information about the provisioned throughput for the table or for a global secondary index.

" }, - "AwsElbv2LoadBalancerDetails":{ + "AwsDynamoDbTableProvisionedThroughputOverride":{ "type":"structure", "members":{ - "AvailabilityZones":{ - "shape":"AvailabilityZones", - "documentation":"

The Availability Zones for the load balancer.

" + "ReadCapacityUnits":{ + "shape":"Integer", + "documentation":"

The read capacity units for the replica.

" + } + }, + "documentation":"

Replica-specific configuration for the provisioned throughput.

" + }, + "AwsDynamoDbTableReplica":{ + "type":"structure", + "members":{ + "GlobalSecondaryIndexes":{ + "shape":"AwsDynamoDbTableReplicaGlobalSecondaryIndexList", + "documentation":"

List of global secondary indexes for the replica.

" }, - "CanonicalHostedZoneId":{ + "KmsMasterKeyId":{ "shape":"NonEmptyString", - "documentation":"

The ID of the Amazon Route 53 hosted zone associated with the load balancer.

" + "documentation":"

The identifier of the AWS KMS customer master key (CMK) that will be used for AWS KMS encryption for the replica.

" }, - "CreatedTime":{ - "shape":"NonEmptyString", - "documentation":"

Indicates when the load balancer was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "ProvisionedThroughputOverride":{ + "shape":"AwsDynamoDbTableProvisionedThroughputOverride", + "documentation":"

Replica-specific configuration for the provisioned throughput.

" }, - "DNSName":{ + "RegionName":{ "shape":"NonEmptyString", - "documentation":"

The public DNS name of the load balancer.

" + "documentation":"

The name of the Region where the replica is located.

" }, - "IpAddressType":{ - "shape":"NonEmptyString", - "documentation":"

The type of IP addresses used by the subnets for your load balancer. The possible values are ipv4 (for IPv4 addresses) and dualstack (for IPv4 and IPv6 addresses).

" - }, - "Scheme":{ - "shape":"NonEmptyString", - "documentation":"

The nodes of an Internet-facing load balancer have public IP addresses.

" - }, - "SecurityGroups":{ - "shape":"SecurityGroups", - "documentation":"

The IDs of the security groups for the load balancer.

" - }, - "State":{ - "shape":"LoadBalancerState", - "documentation":"

The state of the load balancer.

" - }, - "Type":{ + "ReplicaStatus":{ "shape":"NonEmptyString", - "documentation":"

The type of load balancer.

" + "documentation":"

The current status of the replica.

" }, - "VpcId":{ + "ReplicaStatusDescription":{ "shape":"NonEmptyString", - "documentation":"

The ID of the VPC for the load balancer.

" + "documentation":"

Detailed information about the replica status.

" } }, - "documentation":"

Information about a load balancer.

" + "documentation":"

Information about a replica of a DynamoDB table.

" }, - "AwsIamAccessKeyDetails":{ + "AwsDynamoDbTableReplicaGlobalSecondaryIndex":{ "type":"structure", "members":{ - "UserName":{ + "IndexName":{ "shape":"NonEmptyString", - "documentation":"

The user associated with the IAM access key related to a finding.

The UserName parameter has been replaced with the PrincipalName parameter because access keys can also be assigned to principals that are not IAM users.

", - "deprecated":true, - "deprecatedMessage":"This field is deprecated, use PrincipalName instead." - }, - "Status":{ - "shape":"AwsIamAccessKeyStatus", - "documentation":"

The status of the IAM access key related to a finding.

" + "documentation":"

The name of the index.

" }, - "CreatedAt":{ + "ProvisionedThroughputOverride":{ + "shape":"AwsDynamoDbTableProvisionedThroughputOverride", + "documentation":"

Replica-specific configuration for the provisioned throughput for the index.

" + } + }, + "documentation":"

Information about a global secondary index for a DynamoDB table replica.

" + }, + "AwsDynamoDbTableReplicaGlobalSecondaryIndexList":{ + "type":"list", + "member":{"shape":"AwsDynamoDbTableReplicaGlobalSecondaryIndex"} + }, + "AwsDynamoDbTableReplicaList":{ + "type":"list", + "member":{"shape":"AwsDynamoDbTableReplica"} + }, + "AwsDynamoDbTableRestoreSummary":{ + "type":"structure", + "members":{ + "SourceBackupArn":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the IAM access key was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The ARN of the source backup from which the table was restored.

" }, - "PrincipalId":{ + "SourceTableArn":{ "shape":"NonEmptyString", - "documentation":"

The ID of the principal associated with an access key.

" + "documentation":"

The ARN of the source table for the backup.

" }, - "PrincipalType":{ + "RestoreDateTime":{ "shape":"NonEmptyString", - "documentation":"

The type of principal associated with an access key.

" + "documentation":"

Indicates the point in time that the table was restored to.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "PrincipalName":{ - "shape":"NonEmptyString", - "documentation":"

The name of the principal.

" + "RestoreInProgress":{ + "shape":"Boolean", + "documentation":"

Whether a restore is currently in progress.

" } }, - "documentation":"

IAM access key details related to a finding.

" - }, - "AwsIamAccessKeyStatus":{ - "type":"string", - "enum":[ - "Active", - "Inactive" - ] + "documentation":"

Information about the restore for the table.

" }, - "AwsIamAttachedManagedPolicy":{ + "AwsDynamoDbTableSseDescription":{ "type":"structure", "members":{ - "PolicyName":{ + "InaccessibleEncryptionDateTime":{ "shape":"NonEmptyString", - "documentation":"

The name of the policy.

" + "documentation":"

If the key is inaccessible, the date and time when DynamoDB detected that the key was inaccessible.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "PolicyArn":{ + "Status":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the policy.

" + "documentation":"

The status of the server-side encryption.

" + }, + "SseType":{ + "shape":"NonEmptyString", + "documentation":"

The type of server-side encryption.

" + }, + "KmsMasterKeyArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the AWS KMS customer master key (CMK) that is used for the AWS KMS encryption.

" } }, - "documentation":"

A managed policy that is attached to an IAM user.

" - }, - "AwsIamAttachedManagedPolicyList":{ - "type":"list", - "member":{"shape":"AwsIamAttachedManagedPolicy"} + "documentation":"

Information about the server-side encryption for the table.

" }, - "AwsIamPermissionsBoundary":{ + "AwsDynamoDbTableStreamSpecification":{ "type":"structure", "members":{ - "PermissionsBoundaryArn":{ - "shape":"NonEmptyString", - "documentation":"

The ARN of the policy used to set the permissions boundary for the user.

" + "StreamEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether DynamoDB Streams is enabled on the table.

" }, - "PermissionsBoundaryType":{ + "StreamViewType":{ "shape":"NonEmptyString", - "documentation":"

The usage type for the permissions boundary.

" + "documentation":"

Determines the information that is written to the table.

" } }, - "documentation":"

Information about the policy used to set the permissions boundary for an IAM user.

" + "documentation":"

The current DynamoDB Streams configuration for the table.

" }, - "AwsIamPolicyDetails":{ + "AwsEc2EipDetails":{ "type":"structure", "members":{ - "AttachmentCount":{ - "shape":"Integer", - "documentation":"

The number of users, groups, and roles that the policy is attached to.

" - }, - "CreateDate":{ + "InstanceId":{ "shape":"NonEmptyString", - "documentation":"

When the policy was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The identifier of the EC2 instance.

" }, - "DefaultVersionId":{ + "PublicIp":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the default version of the policy.

" + "documentation":"

A public IP address that is associated with the EC2 instance.

" }, - "Description":{ + "AllocationId":{ "shape":"NonEmptyString", - "documentation":"

A description of the policy.

" + "documentation":"

The identifier that AWS assigns to represent the allocation of the Elastic IP address for use with Amazon VPC.

" }, - "IsAttachable":{ - "shape":"Boolean", - "documentation":"

Whether the policy can be attached to a user, group, or role.

" + "AssociationId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier that represents the association of the Elastic IP address with an EC2 instance.

" }, - "Path":{ + "Domain":{ "shape":"NonEmptyString", - "documentation":"

The path to the policy.

" + "documentation":"

The domain in which to allocate the address.

If the address is for use with EC2 instances in a VPC, then Domain is vpc. Otherwise, Domain is standard.

" }, - "PermissionsBoundaryUsageCount":{ - "shape":"Integer", - "documentation":"

The number of users and roles that use the policy to set the permissions boundary.

" + "PublicIpv4Pool":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of an IP address pool. This parameter allows Amazon EC2 to select an IP address from the address pool.

" }, - "PolicyId":{ + "NetworkBorderGroup":{ "shape":"NonEmptyString", - "documentation":"

The unique identifier of the policy.

" + "documentation":"

The name of the location from which the Elastic IP address is advertised.

" }, - "PolicyName":{ + "NetworkInterfaceId":{ "shape":"NonEmptyString", - "documentation":"

The name of the policy.

" + "documentation":"

The identifier of the network interface.

" }, - "PolicyVersionList":{ - "shape":"AwsIamPolicyVersionList", - "documentation":"

List of versions of the policy.

" + "NetworkInterfaceOwnerId":{ + "shape":"NonEmptyString", + "documentation":"

The AWS account ID of the owner of the network interface.

" }, - "UpdateDate":{ + "PrivateIpAddress":{ "shape":"NonEmptyString", - "documentation":"

When the policy was most recently updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The private IP address that is associated with the Elastic IP address.

" } }, - "documentation":"

Represents an IAM permissions policy.

" + "documentation":"

Information about an Elastic IP address.

" }, - "AwsIamPolicyVersion":{ + "AwsEc2InstanceDetails":{ "type":"structure", "members":{ - "VersionId":{ + "Type":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the policy version.

" - }, - "IsDefaultVersion":{ - "shape":"Boolean", - "documentation":"

Whether the version is the default version.

" + "documentation":"

The instance type of the instance.

" }, - "CreateDate":{ + "ImageId":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the version was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - } - }, - "documentation":"

A version of an IAM policy.

" - }, - "AwsIamPolicyVersionList":{ - "type":"list", - "member":{"shape":"AwsIamPolicyVersion"} - }, - "AwsIamRoleAssumeRolePolicyDocument":{ - "type":"string", - "max":131072, - "min":1, - "pattern":"[\\u0009\\u000A\\u000D\\u0020-\\u007E\\u00A1-\\u00FF]+" - }, - "AwsIamRoleDetails":{ - "type":"structure", - "members":{ - "AssumeRolePolicyDocument":{ - "shape":"AwsIamRoleAssumeRolePolicyDocument", - "documentation":"

The trust policy that grants permission to assume the role.

" + "documentation":"

The Amazon Machine Image (AMI) ID of the instance.

" }, - "CreateDate":{ + "IpV4Addresses":{ + "shape":"StringList", + "documentation":"

The IPv4 addresses associated with the instance.

" + }, + "IpV6Addresses":{ + "shape":"StringList", + "documentation":"

The IPv6 addresses associated with the instance.

" + }, + "KeyName":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the role was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The key name associated with the instance.

" }, - "RoleId":{ + "IamInstanceProfileArn":{ "shape":"NonEmptyString", - "documentation":"

The stable and unique string identifying the role.

" + "documentation":"

The IAM profile ARN of the instance.

" }, - "RoleName":{ + "VpcId":{ "shape":"NonEmptyString", - "documentation":"

The friendly name that identifies the role.

" + "documentation":"

The identifier of the VPC that the instance was launched in.

" }, - "MaxSessionDuration":{ - "shape":"Integer", - "documentation":"

The maximum session duration (in seconds) that you want to set for the specified role.

" + "SubnetId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the subnet that the instance was launched in.

" }, - "Path":{ + "LaunchedAt":{ "shape":"NonEmptyString", - "documentation":"

The path to the role.

" + "documentation":"

Indicates when the instance was launched.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" } }, - "documentation":"

Contains information about an IAM role, including all of the role's policies.

" + "documentation":"

The details of an Amazon EC2 instance.

" }, - "AwsIamUserDetails":{ + "AwsEc2NetworkInterfaceAttachment":{ "type":"structure", "members":{ - "AttachedManagedPolicies":{ - "shape":"AwsIamAttachedManagedPolicyList", - "documentation":"

A list of the managed policies that are attached to the user.

" - }, - "CreateDate":{ + "AttachTime":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the user was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "GroupList":{ - "shape":"StringList", - "documentation":"

A list of IAM groups that the user belongs to.

" + "documentation":"

Indicates when the attachment initiated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "Path":{ + "AttachmentId":{ "shape":"NonEmptyString", - "documentation":"

The path to the user.

" + "documentation":"

The identifier of the network interface attachment

" }, - "PermissionsBoundary":{ - "shape":"AwsIamPermissionsBoundary", - "documentation":"

The permissions boundary for the user.

" + "DeleteOnTermination":{ + "shape":"Boolean", + "documentation":"

Indicates whether the network interface is deleted when the instance is terminated.

" }, - "UserId":{ + "DeviceIndex":{ + "shape":"Integer", + "documentation":"

The device index of the network interface attachment on the instance.

" + }, + "InstanceId":{ "shape":"NonEmptyString", - "documentation":"

The unique identifier for the user.

" + "documentation":"

The ID of the instance.

" }, - "UserName":{ + "InstanceOwnerId":{ "shape":"NonEmptyString", - "documentation":"

The name of the user.

" + "documentation":"

The AWS account ID of the owner of the instance.

" }, - "UserPolicyList":{ - "shape":"AwsIamUserPolicyList", - "documentation":"

The list of inline policies that are embedded in the user.

" + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The attachment state.

Valid values: attaching | attached | detaching | detached

" } }, - "documentation":"

Information about an IAM user.

" + "documentation":"

Information about the network interface attachment.

" }, - "AwsIamUserPolicy":{ + "AwsEc2NetworkInterfaceDetails":{ "type":"structure", "members":{ - "PolicyName":{ + "Attachment":{ + "shape":"AwsEc2NetworkInterfaceAttachment", + "documentation":"

The network interface attachment.

" + }, + "NetworkInterfaceId":{ "shape":"NonEmptyString", - "documentation":"

The name of the policy.

" + "documentation":"

The ID of the network interface.

" + }, + "SecurityGroups":{ + "shape":"AwsEc2NetworkInterfaceSecurityGroupList", + "documentation":"

Security groups for the network interface.

" + }, + "SourceDestCheck":{ + "shape":"Boolean", + "documentation":"

Indicates whether traffic to or from the instance is validated.

" } }, - "documentation":"

Information about an inline policy that is embedded in the user.

" + "documentation":"

Details about the network interface

" }, - "AwsIamUserPolicyList":{ + "AwsEc2NetworkInterfaceSecurityGroup":{ + "type":"structure", + "members":{ + "GroupName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the security group.

" + }, + "GroupId":{ + "shape":"NonEmptyString", + "documentation":"

The ID of the security group.

" + } + }, + "documentation":"

A security group associated with the network interface.

" + }, + "AwsEc2NetworkInterfaceSecurityGroupList":{ "type":"list", - "member":{"shape":"AwsIamUserPolicy"} + "member":{"shape":"AwsEc2NetworkInterfaceSecurityGroup"} }, - "AwsKmsKeyDetails":{ + "AwsEc2SecurityGroupDetails":{ "type":"structure", "members":{ - "AWSAccountId":{ + "GroupName":{ "shape":"NonEmptyString", - "documentation":"

The twelve-digit account ID of the AWS account that owns the CMK.

" - }, - "CreationDate":{ - "shape":"Double", - "documentation":"

Indicates when the CMK was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The name of the security group.

" }, - "KeyId":{ + "GroupId":{ "shape":"NonEmptyString", - "documentation":"

The globally unique identifier for the CMK.

" + "documentation":"

The ID of the security group.

" }, - "KeyManager":{ + "OwnerId":{ "shape":"NonEmptyString", - "documentation":"

The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed.

" + "documentation":"

The AWS account ID of the owner of the security group.

" }, - "KeyState":{ + "VpcId":{ "shape":"NonEmptyString", - "documentation":"

The state of the CMK.

" + "documentation":"

[VPC only] The ID of the VPC for the security group.

" }, - "Origin":{ - "shape":"NonEmptyString", - "documentation":"

The source of the CMK's key material.

When this value is AWS_KMS, AWS KMS created the key material.

When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.

When this value is AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store.

" + "IpPermissions":{ + "shape":"AwsEc2SecurityGroupIpPermissionList", + "documentation":"

The inbound rules associated with the security group.

" }, - "Description":{ - "shape":"NonEmptyString", - "documentation":"

A description of the key.

" + "IpPermissionsEgress":{ + "shape":"AwsEc2SecurityGroupIpPermissionList", + "documentation":"

[VPC only] The outbound rules associated with the security group.

" } }, - "documentation":"

Contains metadata about a customer master key (CMK).

" + "documentation":"

Details about an EC2 security group.

" }, - "AwsLambdaFunctionCode":{ + "AwsEc2SecurityGroupIpPermission":{ "type":"structure", "members":{ - "S3Bucket":{ + "IpProtocol":{ "shape":"NonEmptyString", - "documentation":"

An Amazon S3 bucket in the same AWS Region as your function. The bucket can be in a different AWS account.

" + "documentation":"

The IP protocol name (tcp, udp, icmp, icmpv6) or number.

[VPC only] Use -1 to specify all protocols.

When authorizing security group rules, specifying -1 or a protocol number other than tcp, udp, icmp, or icmpv6 allows traffic on all ports, regardless of any port range you specify.

For tcp, udp, and icmp, you must specify a port range.

For icmpv6, the port range is optional. If you omit the port range, traffic for all types and codes is allowed.

" }, - "S3Key":{ - "shape":"NonEmptyString", - "documentation":"

The Amazon S3 key of the deployment package.

" + "FromPort":{ + "shape":"Integer", + "documentation":"

The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.

A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.

" }, - "S3ObjectVersion":{ - "shape":"NonEmptyString", - "documentation":"

For versioned objects, the version of the deployment package object to use.

" + "ToPort":{ + "shape":"Integer", + "documentation":"

The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.

A value of -1 indicates all ICMP/ICMPv6 codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.

" }, - "ZipFile":{ + "UserIdGroupPairs":{ + "shape":"AwsEc2SecurityGroupUserIdGroupPairList", + "documentation":"

The security group and AWS account ID pairs.

" + }, + "IpRanges":{ + "shape":"AwsEc2SecurityGroupIpRangeList", + "documentation":"

The IPv4 ranges.

" + }, + "Ipv6Ranges":{ + "shape":"AwsEc2SecurityGroupIpv6RangeList", + "documentation":"

The IPv6 ranges.

" + }, + "PrefixListIds":{ + "shape":"AwsEc2SecurityGroupPrefixListIdList", + "documentation":"

[VPC only] The prefix list IDs for an AWS service. With outbound rules, this is the AWS service to access through a VPC endpoint from instances associated with the security group.

" + } + }, + "documentation":"

An IP permission for an EC2 security group.

" + }, + "AwsEc2SecurityGroupIpPermissionList":{ + "type":"list", + "member":{"shape":"AwsEc2SecurityGroupIpPermission"} + }, + "AwsEc2SecurityGroupIpRange":{ + "type":"structure", + "members":{ + "CidrIp":{ "shape":"NonEmptyString", - "documentation":"

The base64-encoded contents of the deployment package. AWS SDK and AWS CLI clients handle the encoding for you.

" + "documentation":"

The IPv4 CIDR range. You can specify either a CIDR range or a source security group, but not both. To specify a single IPv4 address, use the /32 prefix length.

" } }, - "documentation":"

The code for the Lambda function. You can specify either an object in Amazon S3, or upload a deployment package directly.

" + "documentation":"

A range of IPv4 addresses.

" }, - "AwsLambdaFunctionDeadLetterConfig":{ + "AwsEc2SecurityGroupIpRangeList":{ + "type":"list", + "member":{"shape":"AwsEc2SecurityGroupIpRange"} + }, + "AwsEc2SecurityGroupIpv6Range":{ "type":"structure", "members":{ - "TargetArn":{ + "CidrIpv6":{ "shape":"NonEmptyString", - "documentation":"

The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic.

" + "documentation":"

The IPv6 CIDR range. You can specify either a CIDR range or a source security group, but not both. To specify a single IPv6 address, use the /128 prefix length.

" } }, - "documentation":"

The dead-letter queue for failed asynchronous invocations.

" + "documentation":"

A range of IPv6 addresses.

" }, - "AwsLambdaFunctionDetails":{ + "AwsEc2SecurityGroupIpv6RangeList":{ + "type":"list", + "member":{"shape":"AwsEc2SecurityGroupIpv6Range"} + }, + "AwsEc2SecurityGroupPrefixListId":{ "type":"structure", "members":{ - "Code":{ - "shape":"AwsLambdaFunctionCode", - "documentation":"

An AwsLambdaFunctionCode object.

" - }, - "CodeSha256":{ + "PrefixListId":{ "shape":"NonEmptyString", - "documentation":"

The SHA256 hash of the function's deployment package.

" - }, - "DeadLetterConfig":{ - "shape":"AwsLambdaFunctionDeadLetterConfig", - "documentation":"

The function's dead letter queue.

" - }, - "Environment":{ - "shape":"AwsLambdaFunctionEnvironment", - "documentation":"

The function's environment variables.

" - }, - "FunctionName":{ + "documentation":"

The ID of the prefix.

" + } + }, + "documentation":"

A prefix list ID.

" + }, + "AwsEc2SecurityGroupPrefixListIdList":{ + "type":"list", + "member":{"shape":"AwsEc2SecurityGroupPrefixListId"} + }, + "AwsEc2SecurityGroupUserIdGroupPair":{ + "type":"structure", + "members":{ + "GroupId":{ "shape":"NonEmptyString", - "documentation":"

The name of the function.

" + "documentation":"

The ID of the security group.

" }, - "Handler":{ + "GroupName":{ "shape":"NonEmptyString", - "documentation":"

The function that Lambda calls to begin executing your function.

" + "documentation":"

The name of the security group.

" }, - "KmsKeyArn":{ + "PeeringStatus":{ "shape":"NonEmptyString", - "documentation":"

The KMS key that's used to encrypt the function's environment variables. This key is only returned if you've configured a customer managed CMK.

" + "documentation":"

The status of a VPC peering connection, if applicable.

" }, - "LastModified":{ + "UserId":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the function was last updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "Layers":{ - "shape":"AwsLambdaFunctionLayerList", - "documentation":"

The function's layers.

" + "documentation":"

The ID of an AWS account.

For a referenced security group in another VPC, the account ID of the referenced security group is returned in the response. If the referenced security group is deleted, this value is not returned.

[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS.

" }, - "MasterArn":{ + "VpcId":{ "shape":"NonEmptyString", - "documentation":"

For Lambda@Edge functions, the ARN of the master function.

" - }, - "MemorySize":{ - "shape":"Integer", - "documentation":"

The memory that's allocated to the function.

" + "documentation":"

The ID of the VPC for the referenced security group, if applicable.

" }, - "RevisionId":{ + "VpcPeeringConnectionId":{ "shape":"NonEmptyString", - "documentation":"

The latest updated revision of the function or alias.

" - }, - "Role":{ + "documentation":"

The ID of the VPC peering connection, if applicable.

" + } + }, + "documentation":"

A relationship between a security group and a user.

" + }, + "AwsEc2SecurityGroupUserIdGroupPairList":{ + "type":"list", + "member":{"shape":"AwsEc2SecurityGroupUserIdGroupPair"} + }, + "AwsEc2VolumeAttachment":{ + "type":"structure", + "members":{ + "AttachTime":{ "shape":"NonEmptyString", - "documentation":"

The function's execution role.

" + "documentation":"

The datetime when the attachment initiated.

" }, - "Runtime":{ - "shape":"NonEmptyString", - "documentation":"

The runtime environment for the Lambda function.

" + "DeleteOnTermination":{ + "shape":"Boolean", + "documentation":"

Whether the EBS volume is deleted when the EC2 instance is terminated.

" }, - "Timeout":{ - "shape":"Integer", - "documentation":"

The amount of time that Lambda allows a function to run before stopping it.

" + "InstanceId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the EC2 instance.

" }, - "TracingConfig":{ - "shape":"AwsLambdaFunctionTracingConfig", - "documentation":"

The function's AWS X-Ray tracing configuration.

" + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The attachment state of the volume.

" + } + }, + "documentation":"

An attachment to an AWS EC2 volume.

" + }, + "AwsEc2VolumeAttachmentList":{ + "type":"list", + "member":{"shape":"AwsEc2VolumeAttachment"} + }, + "AwsEc2VolumeDetails":{ + "type":"structure", + "members":{ + "CreateTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the volume was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "VpcConfig":{ - "shape":"AwsLambdaFunctionVpcConfig", - "documentation":"

The function's networking configuration.

" + "Encrypted":{ + "shape":"Boolean", + "documentation":"

Whether the volume is encrypted.

" }, - "Version":{ + "Size":{ + "shape":"Integer", + "documentation":"

The size of the volume, in GiBs.

" + }, + "SnapshotId":{ "shape":"NonEmptyString", - "documentation":"

The version of the Lambda function.

" + "documentation":"

The snapshot from which the volume was created.

" + }, + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The volume state.

" + }, + "KmsKeyId":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the volume.

" + }, + "Attachments":{ + "shape":"AwsEc2VolumeAttachmentList", + "documentation":"

The volume attachments.

" } }, - "documentation":"

Details about a function's configuration.

" + "documentation":"

Details about an EC2 volume.

" }, - "AwsLambdaFunctionEnvironment":{ + "AwsEc2VpcDetails":{ "type":"structure", "members":{ - "Variables":{ + "CidrBlockAssociationSet":{ + "shape":"CidrBlockAssociationList", + "documentation":"

Information about the IPv4 CIDR blocks associated with the VPC.

" + }, + "Ipv6CidrBlockAssociationSet":{ + "shape":"Ipv6CidrBlockAssociationList", + "documentation":"

Information about the IPv6 CIDR blocks associated with the VPC.

" + }, + "DhcpOptionsId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the set of Dynamic Host Configuration Protocol (DHCP) options that are associated with the VPC. If the default options are associated with the VPC, then this is default.

" + }, + "State":{ + "shape":"NonEmptyString", + "documentation":"

The current state of the VPC.

" + } + }, + "documentation":"

Details about an EC2 VPC.

" + }, + "AwsElasticsearchDomainDetails":{ + "type":"structure", + "members":{ + "AccessPolicies":{ + "shape":"NonEmptyString", + "documentation":"

IAM policy document specifying the access policies for the new Amazon ES domain.

" + }, + "DomainEndpointOptions":{ + "shape":"AwsElasticsearchDomainDomainEndpointOptions", + "documentation":"

Additional options for the domain endpoint.

" + }, + "DomainId":{ + "shape":"NonEmptyString", + "documentation":"

Unique identifier for an Amazon ES domain.

" + }, + "DomainName":{ + "shape":"NonEmptyString", + "documentation":"

Name of an Amazon ES domain.

Domain names are unique across all domains owned by the same account within an AWS Region.

Domain names must start with a lowercase letter and must be between 3 and 28 characters.

Valid characters are a-z (lowercase only), 0-9, and – (hyphen).

" + }, + "Endpoint":{ + "shape":"NonEmptyString", + "documentation":"

Domain-specific endpoint used to submit index, search, and data upload requests to an Amazon ES domain.

The endpoint is a service URL.

" + }, + "Endpoints":{ "shape":"FieldMap", - "documentation":"

Environment variable key-value pairs.

" + "documentation":"

The key-value pair that exists if the Amazon ES domain uses VPC endpoints.

" }, - "Error":{ - "shape":"AwsLambdaFunctionEnvironmentError", - "documentation":"

An AwsLambdaFunctionEnvironmentError object.

" + "ElasticsearchVersion":{ + "shape":"NonEmptyString", + "documentation":"

Elasticsearch version.

" + }, + "EncryptionAtRestOptions":{ + "shape":"AwsElasticsearchDomainEncryptionAtRestOptions", + "documentation":"

Details about the configuration for encryption at rest.

" + }, + "NodeToNodeEncryptionOptions":{ + "shape":"AwsElasticsearchDomainNodeToNodeEncryptionOptions", + "documentation":"

Details about the configuration for node-to-node encryption.

" + }, + "VPCOptions":{ + "shape":"AwsElasticsearchDomainVPCOptions", + "documentation":"

Information that Amazon ES derives based on VPCOptions for the domain.

" } }, - "documentation":"

A function's environment variable settings.

" + "documentation":"

Information about an Elasticsearch domain.

" }, - "AwsLambdaFunctionEnvironmentError":{ + "AwsElasticsearchDomainDomainEndpointOptions":{ "type":"structure", "members":{ - "ErrorCode":{ + "EnforceHTTPS":{ + "shape":"Boolean", + "documentation":"

Whether to require that all traffic to the domain arrive over HTTPS.

" + }, + "TLSSecurityPolicy":{ + "shape":"NonEmptyString", + "documentation":"

The TLS security policy to apply to the HTTPS endpoint of the Elasticsearch domain.

Valid values:

" + } + }, + "documentation":"

Additional options for the domain endpoint, such as whether to require HTTPS for all traffic.

" + }, + "AwsElasticsearchDomainEncryptionAtRestOptions":{ + "type":"structure", + "members":{ + "Enabled":{ + "shape":"Boolean", + "documentation":"

Whether encryption at rest is enabled.

" + }, + "KmsKeyId":{ + "shape":"NonEmptyString", + "documentation":"

The KMS key ID. Takes the form 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a.

" + } + }, + "documentation":"

Details about the configuration for encryption at rest.

" + }, + "AwsElasticsearchDomainNodeToNodeEncryptionOptions":{ + "type":"structure", + "members":{ + "Enabled":{ + "shape":"Boolean", + "documentation":"

Whether node-to-node encryption is enabled.

" + } + }, + "documentation":"

Details about the configuration for node-to-node encryption.

" + }, + "AwsElasticsearchDomainVPCOptions":{ + "type":"structure", + "members":{ + "AvailabilityZones":{ + "shape":"NonEmptyStringList", + "documentation":"

The list of Availability Zones associated with the VPC subnets.

" + }, + "SecurityGroupIds":{ + "shape":"NonEmptyStringList", + "documentation":"

The list of security group IDs associated with the VPC endpoints for the domain.

" + }, + "SubnetIds":{ + "shape":"NonEmptyStringList", + "documentation":"

A list of subnet IDs associated with the VPC endpoints for the domain.

" + }, + "VPCId":{ + "shape":"NonEmptyString", + "documentation":"

ID for the VPC.

" + } + }, + "documentation":"

Information that Amazon ES derives based on VPCOptions for the domain.

" + }, + "AwsElbAppCookieStickinessPolicies":{ + "type":"list", + "member":{"shape":"AwsElbAppCookieStickinessPolicy"} + }, + "AwsElbAppCookieStickinessPolicy":{ + "type":"structure", + "members":{ + "CookieName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the application cookie used for stickiness.

" + }, + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The mnemonic name for the policy being created. The name must be unique within the set of policies for the load balancer.

" + } + }, + "documentation":"

Contains information about a stickiness policy that was created using CreateAppCookieStickinessPolicy.

" + }, + "AwsElbLbCookieStickinessPolicies":{ + "type":"list", + "member":{"shape":"AwsElbLbCookieStickinessPolicy"} + }, + "AwsElbLbCookieStickinessPolicy":{ + "type":"structure", + "members":{ + "CookieExpirationPeriod":{ + "shape":"Long", + "documentation":"

The amount of time, in seconds, after which the cookie is considered stale. If an expiration period is not specified, the stickiness session lasts for the duration of the browser session.

" + }, + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the policy. The name must be unique within the set of policies for the load balancer.

" + } + }, + "documentation":"

Contains information about a stickiness policy that was created using CreateLBCookieStickinessPolicy.

" + }, + "AwsElbLoadBalancerAccessLog":{ + "type":"structure", + "members":{ + "EmitInterval":{ + "shape":"Integer", + "documentation":"

The interval in minutes for publishing the access logs.

You can publish access logs either every 5 minutes or every 60 minutes.

" + }, + "Enabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether access logs are enabled for the load balancer.

" + }, + "S3BucketName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the S3 bucket where the access logs are stored.

" + }, + "S3BucketPrefix":{ + "shape":"NonEmptyString", + "documentation":"

The logical hierarchy that was created for the S3 bucket.

If a prefix is not provided, the log is placed at the root level of the bucket.

" + } + }, + "documentation":"

Contains information about the access log configuration for the load balancer.

" + }, + "AwsElbLoadBalancerAttributes":{ + "type":"structure", + "members":{ + "AccessLog":{ + "shape":"AwsElbLoadBalancerAccessLog", + "documentation":"

Information about the access log configuration for the load balancer.

If the access log is enabled, the load balancer captures detailed information about all requests. It delivers the information to a specified S3 bucket.

" + }, + "ConnectionDraining":{ + "shape":"AwsElbLoadBalancerConnectionDraining", + "documentation":"

Information about the connection draining configuration for the load balancer.

If connection draining is enabled, the load balancer allows existing requests to complete before it shifts traffic away from a deregistered or unhealthy instance.

" + }, + "ConnectionSettings":{ + "shape":"AwsElbLoadBalancerConnectionSettings", + "documentation":"

Connection settings for the load balancer.

If an idle timeout is configured, the load balancer allows connections to remain idle for the specified duration. When a connection is idle, no data is sent over the connection.

" + }, + "CrossZoneLoadBalancing":{ + "shape":"AwsElbLoadBalancerCrossZoneLoadBalancing", + "documentation":"

Cross-zone load balancing settings for the load balancer.

If cross-zone load balancing is enabled, the load balancer routes the request traffic evenly across all instances regardless of the Availability Zones.

" + } + }, + "documentation":"

Contains attributes for the load balancer.

" + }, + "AwsElbLoadBalancerBackendServerDescription":{ + "type":"structure", + "members":{ + "InstancePort":{ + "shape":"Integer", + "documentation":"

The port on which the EC2 instance is listening.

" + }, + "PolicyNames":{ + "shape":"StringList", + "documentation":"

The names of the policies that are enabled for the EC2 instance.

" + } + }, + "documentation":"

Provides information about the configuration of an EC2 instance for the load balancer.

" + }, + "AwsElbLoadBalancerBackendServerDescriptions":{ + "type":"list", + "member":{"shape":"AwsElbLoadBalancerBackendServerDescription"} + }, + "AwsElbLoadBalancerConnectionDraining":{ + "type":"structure", + "members":{ + "Enabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether connection draining is enabled for the load balancer.

" + }, + "Timeout":{ + "shape":"Integer", + "documentation":"

The maximum time, in seconds, to keep the existing connections open before deregistering the instances.

" + } + }, + "documentation":"

Contains information about the connection draining configuration for the load balancer.

" + }, + "AwsElbLoadBalancerConnectionSettings":{ + "type":"structure", + "members":{ + "IdleTimeout":{ + "shape":"Integer", + "documentation":"

The time, in seconds, that the connection can be idle (no data is sent over the connection) before it is closed by the load balancer.

" + } + }, + "documentation":"

Contains connection settings for the load balancer.

" + }, + "AwsElbLoadBalancerCrossZoneLoadBalancing":{ + "type":"structure", + "members":{ + "Enabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether cross-zone load balancing is enabled for the load balancer.

" + } + }, + "documentation":"

Contains cross-zone load balancing settings for the load balancer.

" + }, + "AwsElbLoadBalancerDetails":{ + "type":"structure", + "members":{ + "AvailabilityZones":{ + "shape":"StringList", + "documentation":"

The list of Availability Zones for the load balancer.

" + }, + "BackendServerDescriptions":{ + "shape":"AwsElbLoadBalancerBackendServerDescriptions", + "documentation":"

Information about the configuration of the EC2 instances.

" + }, + "CanonicalHostedZoneName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the Amazon Route 53 hosted zone for the load balancer.

" + }, + "CanonicalHostedZoneNameID":{ + "shape":"NonEmptyString", + "documentation":"

The ID of the Amazon Route 53 hosted zone for the load balancer.

" + }, + "CreatedTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the load balancer was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "DnsName":{ + "shape":"NonEmptyString", + "documentation":"

The DNS name of the load balancer.

" + }, + "HealthCheck":{ + "shape":"AwsElbLoadBalancerHealthCheck", + "documentation":"

Information about the health checks that are conducted on the load balancer.

" + }, + "Instances":{ + "shape":"AwsElbLoadBalancerInstances", + "documentation":"

List of EC2 instances for the load balancer.

" + }, + "ListenerDescriptions":{ + "shape":"AwsElbLoadBalancerListenerDescriptions", + "documentation":"

The policies that are enabled for the load balancer listeners.

" + }, + "LoadBalancerAttributes":{ + "shape":"AwsElbLoadBalancerAttributes", + "documentation":"

The attributes for a load balancer.

" + }, + "LoadBalancerName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the load balancer.

" + }, + "Policies":{ + "shape":"AwsElbLoadBalancerPolicies", + "documentation":"

The policies for a load balancer.

" + }, + "Scheme":{ + "shape":"NonEmptyString", + "documentation":"

The type of load balancer. Only provided if the load balancer is in a VPC.

If Scheme is internet-facing, the load balancer has a public DNS name that resolves to a public IP address.

If Scheme is internal, the load balancer has a public DNS name that resolves to a private IP address.

" + }, + "SecurityGroups":{ + "shape":"StringList", + "documentation":"

The security groups for the load balancer. Only provided if the load balancer is in a VPC.

" + }, + "SourceSecurityGroup":{ + "shape":"AwsElbLoadBalancerSourceSecurityGroup", + "documentation":"

Information about the security group for the load balancer. This is the security group that is used for inbound rules.

" + }, + "Subnets":{ + "shape":"StringList", + "documentation":"

The list of subnet identifiers for the load balancer.

" + }, + "VpcId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the VPC for the load balancer.

" + } + }, + "documentation":"

Contains details about a Classic Load Balancer.

" + }, + "AwsElbLoadBalancerHealthCheck":{ + "type":"structure", + "members":{ + "HealthyThreshold":{ + "shape":"Integer", + "documentation":"

The number of consecutive health check successes required before the instance is moved to the Healthy state.

" + }, + "Interval":{ + "shape":"Integer", + "documentation":"

The approximate interval, in seconds, between health checks of an individual instance.

" + }, + "Target":{ + "shape":"NonEmptyString", + "documentation":"

The instance that is being checked. The target specifies the protocol and port. The available protocols are TCP, SSL, HTTP, and HTTPS. The range of valid ports is 1 through 65535.

For the HTTP and HTTPS protocols, the target also specifies the ping path.

For the TCP protocol, the target is specified as TCP: <port> .

For the SSL protocol, the target is specified as SSL.<port> .

For the HTTP and HTTPS protocols, the target is specified as <protocol>:<port>/<path to ping> .

" + }, + "Timeout":{ + "shape":"Integer", + "documentation":"

The amount of time, in seconds, during which no response means a failed health check.

" + }, + "UnhealthyThreshold":{ + "shape":"Integer", + "documentation":"

The number of consecutive health check failures that must occur before the instance is moved to the Unhealthy state.

" + } + }, + "documentation":"

Contains information about the health checks that are conducted on the load balancer.

" + }, + "AwsElbLoadBalancerInstance":{ + "type":"structure", + "members":{ + "InstanceId":{ + "shape":"NonEmptyString", + "documentation":"

The instance identifier.

" + } + }, + "documentation":"

Provides information about an EC2 instance for a load balancer.

" + }, + "AwsElbLoadBalancerInstances":{ + "type":"list", + "member":{"shape":"AwsElbLoadBalancerInstance"} + }, + "AwsElbLoadBalancerListener":{ + "type":"structure", + "members":{ + "InstancePort":{ + "shape":"Integer", + "documentation":"

The port on which the instance is listening.

" + }, + "InstanceProtocol":{ + "shape":"NonEmptyString", + "documentation":"

The protocol to use to route traffic to instances.

Valid values: HTTP | HTTPS | TCP | SSL

" + }, + "LoadBalancerPort":{ + "shape":"Integer", + "documentation":"

The port on which the load balancer is listening.

On EC2-VPC, you can specify any port from the range 1-65535.

On EC2-Classic, you can specify any port from the following list: 25, 80, 443, 465, 587, 1024-65535.

" + }, + "Protocol":{ + "shape":"NonEmptyString", + "documentation":"

The load balancer transport protocol to use for routing.

Valid values: HTTP | HTTPS | TCP | SSL

" + }, + "SslCertificateId":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the server certificate.

" + } + }, + "documentation":"

Information about a load balancer listener.

" + }, + "AwsElbLoadBalancerListenerDescription":{ + "type":"structure", + "members":{ + "Listener":{ + "shape":"AwsElbLoadBalancerListener", + "documentation":"

Information about the listener.

" + }, + "PolicyNames":{ + "shape":"StringList", + "documentation":"

The policies enabled for the listener.

" + } + }, + "documentation":"

Lists the policies that are enabled for a load balancer listener.

" + }, + "AwsElbLoadBalancerListenerDescriptions":{ + "type":"list", + "member":{"shape":"AwsElbLoadBalancerListenerDescription"} + }, + "AwsElbLoadBalancerPolicies":{ + "type":"structure", + "members":{ + "AppCookieStickinessPolicies":{ + "shape":"AwsElbAppCookieStickinessPolicies", + "documentation":"

The stickiness policies that are created using CreateAppCookieStickinessPolicy.

" + }, + "LbCookieStickinessPolicies":{ + "shape":"AwsElbLbCookieStickinessPolicies", + "documentation":"

The stickiness policies that are created using CreateLBCookieStickinessPolicy.

" + }, + "OtherPolicies":{ + "shape":"StringList", + "documentation":"

The policies other than the stickiness policies.

" + } + }, + "documentation":"

Contains information about the policies for a load balancer.

" + }, + "AwsElbLoadBalancerSourceSecurityGroup":{ + "type":"structure", + "members":{ + "GroupName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the security group.

" + }, + "OwnerAlias":{ + "shape":"NonEmptyString", + "documentation":"

The owner of the security group.

" + } + }, + "documentation":"

Contains information about the security group for the load balancer.

" + }, + "AwsElbv2LoadBalancerDetails":{ + "type":"structure", + "members":{ + "AvailabilityZones":{ + "shape":"AvailabilityZones", + "documentation":"

The Availability Zones for the load balancer.

" + }, + "CanonicalHostedZoneId":{ + "shape":"NonEmptyString", + "documentation":"

The ID of the Amazon Route 53 hosted zone associated with the load balancer.

" + }, + "CreatedTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the load balancer was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "DNSName":{ + "shape":"NonEmptyString", + "documentation":"

The public DNS name of the load balancer.

" + }, + "IpAddressType":{ + "shape":"NonEmptyString", + "documentation":"

The type of IP addresses used by the subnets for your load balancer. The possible values are ipv4 (for IPv4 addresses) and dualstack (for IPv4 and IPv6 addresses).

" + }, + "Scheme":{ + "shape":"NonEmptyString", + "documentation":"

The nodes of an Internet-facing load balancer have public IP addresses.

" + }, + "SecurityGroups":{ + "shape":"SecurityGroups", + "documentation":"

The IDs of the security groups for the load balancer.

" + }, + "State":{ + "shape":"LoadBalancerState", + "documentation":"

The state of the load balancer.

" + }, + "Type":{ + "shape":"NonEmptyString", + "documentation":"

The type of load balancer.

" + }, + "VpcId":{ + "shape":"NonEmptyString", + "documentation":"

The ID of the VPC for the load balancer.

" + } + }, + "documentation":"

Information about a load balancer.

" + }, + "AwsIamAccessKeyDetails":{ + "type":"structure", + "members":{ + "UserName":{ + "shape":"NonEmptyString", + "documentation":"

The user associated with the IAM access key related to a finding.

The UserName parameter has been replaced with the PrincipalName parameter because access keys can also be assigned to principals that are not IAM users.

", + "deprecated":true, + "deprecatedMessage":"This field is deprecated, use PrincipalName instead." + }, + "Status":{ + "shape":"AwsIamAccessKeyStatus", + "documentation":"

The status of the IAM access key related to a finding.

" + }, + "CreatedAt":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the IAM access key was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "PrincipalId":{ + "shape":"NonEmptyString", + "documentation":"

The ID of the principal associated with an access key.

" + }, + "PrincipalType":{ + "shape":"NonEmptyString", + "documentation":"

The type of principal associated with an access key.

" + }, + "PrincipalName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the principal.

" + }, + "AccountId":{ + "shape":"NonEmptyString", + "documentation":"

The AWS account ID of the account for the key.

" + }, + "AccessKeyId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the access key.

" + }, + "SessionContext":{ + "shape":"AwsIamAccessKeySessionContext", + "documentation":"

Information about the session that the key was used for.

" + } + }, + "documentation":"

IAM access key details related to a finding.

" + }, + "AwsIamAccessKeySessionContext":{ + "type":"structure", + "members":{ + "Attributes":{ + "shape":"AwsIamAccessKeySessionContextAttributes", + "documentation":"

Attributes of the session that the key was used for.

" + }, + "SessionIssuer":{ + "shape":"AwsIamAccessKeySessionContextSessionIssuer", + "documentation":"

Information about the entity that created the session.

" + } + }, + "documentation":"

Provides information about the session that the key was used for.

" + }, + "AwsIamAccessKeySessionContextAttributes":{ + "type":"structure", + "members":{ + "MfaAuthenticated":{ + "shape":"Boolean", + "documentation":"

Indicates whether the session used multi-factor authentication (MFA).

" + }, + "CreationDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the session was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + } + }, + "documentation":"

Attributes of the session that the key was used for.

" + }, + "AwsIamAccessKeySessionContextSessionIssuer":{ + "type":"structure", + "members":{ + "Type":{ + "shape":"NonEmptyString", + "documentation":"

The type of principal (user, role, or group) that created the session.

" + }, + "PrincipalId":{ + "shape":"NonEmptyString", + "documentation":"

The principal ID of the principal (user, role, or group) that created the session.

" + }, + "Arn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the session.

" + }, + "AccountId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the AWS account that created the session.

" + }, + "UserName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the principal that created the session.

" + } + }, + "documentation":"

Information about the entity that created the session.

" + }, + "AwsIamAccessKeyStatus":{ + "type":"string", + "enum":[ + "Active", + "Inactive" + ] + }, + "AwsIamAttachedManagedPolicy":{ + "type":"structure", + "members":{ + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the policy.

" + }, + "PolicyArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the policy.

" + } + }, + "documentation":"

A managed policy that is attached to an IAM principal.

" + }, + "AwsIamAttachedManagedPolicyList":{ + "type":"list", + "member":{"shape":"AwsIamAttachedManagedPolicy"} + }, + "AwsIamGroupDetails":{ + "type":"structure", + "members":{ + "AttachedManagedPolicies":{ + "shape":"AwsIamAttachedManagedPolicyList", + "documentation":"

A list of the managed policies that are attached to the IAM group.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the IAM group was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "GroupId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the IAM group.

" + }, + "GroupName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the IAM group.

" + }, + "GroupPolicyList":{ + "shape":"AwsIamGroupPolicyList", + "documentation":"

The list of inline policies that are embedded in the group.

" + }, + "Path":{ + "shape":"NonEmptyString", + "documentation":"

The path to the group.

" + } + }, + "documentation":"

Contains details about an IAM group.

" + }, + "AwsIamGroupPolicy":{ + "type":"structure", + "members":{ + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the policy.

" + } + }, + "documentation":"

A managed policy that is attached to the IAM group.

" + }, + "AwsIamGroupPolicyList":{ + "type":"list", + "member":{"shape":"AwsIamGroupPolicy"} + }, + "AwsIamInstanceProfile":{ + "type":"structure", + "members":{ + "Arn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the instance profile.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the instance profile was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "InstanceProfileId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the instance profile.

" + }, + "InstanceProfileName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the instance profile.

" + }, + "Path":{ + "shape":"NonEmptyString", + "documentation":"

The path to the instance profile.

" + }, + "Roles":{ + "shape":"AwsIamInstanceProfileRoles", + "documentation":"

The roles associated with the instance profile.

" + } + }, + "documentation":"

Information about an instance profile.

" + }, + "AwsIamInstanceProfileList":{ + "type":"list", + "member":{"shape":"AwsIamInstanceProfile"} + }, + "AwsIamInstanceProfileRole":{ + "type":"structure", + "members":{ + "Arn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the role.

" + }, + "AssumeRolePolicyDocument":{ + "shape":"AwsIamRoleAssumeRolePolicyDocument", + "documentation":"

The policy that grants an entity permission to assume the role.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the role was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "Path":{ + "shape":"NonEmptyString", + "documentation":"

The path to the role.

" + }, + "RoleId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the role.

" + }, + "RoleName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the role.

" + } + }, + "documentation":"

Information about a role associated with an instance profile.

" + }, + "AwsIamInstanceProfileRoles":{ + "type":"list", + "member":{"shape":"AwsIamInstanceProfileRole"} + }, + "AwsIamPermissionsBoundary":{ + "type":"structure", + "members":{ + "PermissionsBoundaryArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the policy used to set the permissions boundary.

" + }, + "PermissionsBoundaryType":{ + "shape":"NonEmptyString", + "documentation":"

The usage type for the permissions boundary.

" + } + }, + "documentation":"

Information about the policy used to set the permissions boundary for an IAM principal.

" + }, + "AwsIamPolicyDetails":{ + "type":"structure", + "members":{ + "AttachmentCount":{ + "shape":"Integer", + "documentation":"

The number of users, groups, and roles that the policy is attached to.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

When the policy was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "DefaultVersionId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the default version of the policy.

" + }, + "Description":{ + "shape":"NonEmptyString", + "documentation":"

A description of the policy.

" + }, + "IsAttachable":{ + "shape":"Boolean", + "documentation":"

Whether the policy can be attached to a user, group, or role.

" + }, + "Path":{ + "shape":"NonEmptyString", + "documentation":"

The path to the policy.

" + }, + "PermissionsBoundaryUsageCount":{ + "shape":"Integer", + "documentation":"

The number of users and roles that use the policy to set the permissions boundary.

" + }, + "PolicyId":{ + "shape":"NonEmptyString", + "documentation":"

The unique identifier of the policy.

" + }, + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the policy.

" + }, + "PolicyVersionList":{ + "shape":"AwsIamPolicyVersionList", + "documentation":"

List of versions of the policy.

" + }, + "UpdateDate":{ + "shape":"NonEmptyString", + "documentation":"

When the policy was most recently updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + } + }, + "documentation":"

Represents an IAM permissions policy.

" + }, + "AwsIamPolicyVersion":{ + "type":"structure", + "members":{ + "VersionId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the policy version.

" + }, + "IsDefaultVersion":{ + "shape":"Boolean", + "documentation":"

Whether the version is the default version.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the version was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + } + }, + "documentation":"

A version of an IAM policy.

" + }, + "AwsIamPolicyVersionList":{ + "type":"list", + "member":{"shape":"AwsIamPolicyVersion"} + }, + "AwsIamRoleAssumeRolePolicyDocument":{ + "type":"string", + "max":131072, + "min":1, + "pattern":"[\\u0009\\u000A\\u000D\\u0020-\\u007E\\u00A1-\\u00FF]+" + }, + "AwsIamRoleDetails":{ + "type":"structure", + "members":{ + "AssumeRolePolicyDocument":{ + "shape":"AwsIamRoleAssumeRolePolicyDocument", + "documentation":"

The trust policy that grants permission to assume the role.

" + }, + "AttachedManagedPolicies":{ + "shape":"AwsIamAttachedManagedPolicyList", + "documentation":"

The list of the managed policies that are attached to the role.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the role was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "InstanceProfileList":{ + "shape":"AwsIamInstanceProfileList", + "documentation":"

The list of instance profiles that contain this role.

" + }, + "PermissionsBoundary":{"shape":"AwsIamPermissionsBoundary"}, + "RoleId":{ + "shape":"NonEmptyString", + "documentation":"

The stable and unique string identifying the role.

" + }, + "RoleName":{ + "shape":"NonEmptyString", + "documentation":"

The friendly name that identifies the role.

" + }, + "RolePolicyList":{ + "shape":"AwsIamRolePolicyList", + "documentation":"

The list of inline policies that are embedded in the role.

" + }, + "MaxSessionDuration":{ + "shape":"Integer", + "documentation":"

The maximum session duration (in seconds) that you want to set for the specified role.

" + }, + "Path":{ + "shape":"NonEmptyString", + "documentation":"

The path to the role.

" + } + }, + "documentation":"

Contains information about an IAM role, including all of the role's policies.

" + }, + "AwsIamRolePolicy":{ + "type":"structure", + "members":{ + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the policy.

" + } + }, + "documentation":"

An inline policy that is embedded in the role.

" + }, + "AwsIamRolePolicyList":{ + "type":"list", + "member":{"shape":"AwsIamRolePolicy"} + }, + "AwsIamUserDetails":{ + "type":"structure", + "members":{ + "AttachedManagedPolicies":{ + "shape":"AwsIamAttachedManagedPolicyList", + "documentation":"

A list of the managed policies that are attached to the user.

" + }, + "CreateDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the user was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "GroupList":{ + "shape":"StringList", + "documentation":"

A list of IAM groups that the user belongs to.

" + }, + "Path":{ + "shape":"NonEmptyString", + "documentation":"

The path to the user.

" + }, + "PermissionsBoundary":{ + "shape":"AwsIamPermissionsBoundary", + "documentation":"

The permissions boundary for the user.

" + }, + "UserId":{ + "shape":"NonEmptyString", + "documentation":"

The unique identifier for the user.

" + }, + "UserName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the user.

" + }, + "UserPolicyList":{ + "shape":"AwsIamUserPolicyList", + "documentation":"

The list of inline policies that are embedded in the user.

" + } + }, + "documentation":"

Information about an IAM user.

" + }, + "AwsIamUserPolicy":{ + "type":"structure", + "members":{ + "PolicyName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the policy.

" + } + }, + "documentation":"

Information about an inline policy that is embedded in the user.

" + }, + "AwsIamUserPolicyList":{ + "type":"list", + "member":{"shape":"AwsIamUserPolicy"} + }, + "AwsKmsKeyDetails":{ + "type":"structure", + "members":{ + "AWSAccountId":{ + "shape":"NonEmptyString", + "documentation":"

The twelve-digit account ID of the AWS account that owns the CMK.

" + }, + "CreationDate":{ + "shape":"Double", + "documentation":"

Indicates when the CMK was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "KeyId":{ + "shape":"NonEmptyString", + "documentation":"

The globally unique identifier for the CMK.

" + }, + "KeyManager":{ + "shape":"NonEmptyString", + "documentation":"

The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed.

" + }, + "KeyState":{ + "shape":"NonEmptyString", + "documentation":"

The state of the CMK.

" + }, + "Origin":{ + "shape":"NonEmptyString", + "documentation":"

The source of the CMK's key material.

When this value is AWS_KMS, AWS KMS created the key material.

When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.

When this value is AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store.

" + }, + "Description":{ + "shape":"NonEmptyString", + "documentation":"

A description of the key.

" + } + }, + "documentation":"

Contains metadata about a customer master key (CMK).

" + }, + "AwsLambdaFunctionCode":{ + "type":"structure", + "members":{ + "S3Bucket":{ + "shape":"NonEmptyString", + "documentation":"

An Amazon S3 bucket in the same AWS Region as your function. The bucket can be in a different AWS account.

" + }, + "S3Key":{ + "shape":"NonEmptyString", + "documentation":"

The Amazon S3 key of the deployment package.

" + }, + "S3ObjectVersion":{ + "shape":"NonEmptyString", + "documentation":"

For versioned objects, the version of the deployment package object to use.

" + }, + "ZipFile":{ + "shape":"NonEmptyString", + "documentation":"

The base64-encoded contents of the deployment package. AWS SDK and AWS CLI clients handle the encoding for you.

" + } + }, + "documentation":"

The code for the Lambda function. You can specify either an object in Amazon S3, or upload a deployment package directly.

" + }, + "AwsLambdaFunctionDeadLetterConfig":{ + "type":"structure", + "members":{ + "TargetArn":{ + "shape":"NonEmptyString", + "documentation":"

The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic.

" + } + }, + "documentation":"

The dead-letter queue for failed asynchronous invocations.

" + }, + "AwsLambdaFunctionDetails":{ + "type":"structure", + "members":{ + "Code":{ + "shape":"AwsLambdaFunctionCode", + "documentation":"

An AwsLambdaFunctionCode object.

" + }, + "CodeSha256":{ + "shape":"NonEmptyString", + "documentation":"

The SHA256 hash of the function's deployment package.

" + }, + "DeadLetterConfig":{ + "shape":"AwsLambdaFunctionDeadLetterConfig", + "documentation":"

The function's dead letter queue.

" + }, + "Environment":{ + "shape":"AwsLambdaFunctionEnvironment", + "documentation":"

The function's environment variables.

" + }, + "FunctionName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the function.

" + }, + "Handler":{ + "shape":"NonEmptyString", + "documentation":"

The function that Lambda calls to begin executing your function.

" + }, + "KmsKeyArn":{ + "shape":"NonEmptyString", + "documentation":"

The KMS key that's used to encrypt the function's environment variables. This key is only returned if you've configured a customer managed CMK.

" + }, + "LastModified":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the function was last updated.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "Layers":{ + "shape":"AwsLambdaFunctionLayerList", + "documentation":"

The function's layers.

" + }, + "MasterArn":{ + "shape":"NonEmptyString", + "documentation":"

For Lambda@Edge functions, the ARN of the master function.

" + }, + "MemorySize":{ + "shape":"Integer", + "documentation":"

The memory that's allocated to the function.

" + }, + "RevisionId":{ + "shape":"NonEmptyString", + "documentation":"

The latest updated revision of the function or alias.

" + }, + "Role":{ + "shape":"NonEmptyString", + "documentation":"

The function's execution role.

" + }, + "Runtime":{ + "shape":"NonEmptyString", + "documentation":"

The runtime environment for the Lambda function.

" + }, + "Timeout":{ + "shape":"Integer", + "documentation":"

The amount of time that Lambda allows a function to run before stopping it.

" + }, + "TracingConfig":{ + "shape":"AwsLambdaFunctionTracingConfig", + "documentation":"

The function's AWS X-Ray tracing configuration.

" + }, + "VpcConfig":{ + "shape":"AwsLambdaFunctionVpcConfig", + "documentation":"

The function's networking configuration.

" + }, + "Version":{ + "shape":"NonEmptyString", + "documentation":"

The version of the Lambda function.

" + } + }, + "documentation":"

Details about a function's configuration.

" + }, + "AwsLambdaFunctionEnvironment":{ + "type":"structure", + "members":{ + "Variables":{ + "shape":"FieldMap", + "documentation":"

Environment variable key-value pairs.

" + }, + "Error":{ + "shape":"AwsLambdaFunctionEnvironmentError", + "documentation":"

An AwsLambdaFunctionEnvironmentError object.

" + } + }, + "documentation":"

A function's environment variable settings.

" + }, + "AwsLambdaFunctionEnvironmentError":{ + "type":"structure", + "members":{ + "ErrorCode":{ + "shape":"NonEmptyString", + "documentation":"

The error code.

" + }, + "Message":{ + "shape":"NonEmptyString", + "documentation":"

The error message.

" + } + }, + "documentation":"

Error messages for environment variables that couldn't be applied.

" + }, + "AwsLambdaFunctionLayer":{ + "type":"structure", + "members":{ + "Arn":{ + "shape":"NonEmptyString", + "documentation":"

The Amazon Resource Name (ARN) of the function layer.

" + }, + "CodeSize":{ + "shape":"Integer", + "documentation":"

The size of the layer archive in bytes.

" + } + }, + "documentation":"

An AWS Lambda layer.

" + }, + "AwsLambdaFunctionLayerList":{ + "type":"list", + "member":{"shape":"AwsLambdaFunctionLayer"} + }, + "AwsLambdaFunctionTracingConfig":{ + "type":"structure", + "members":{ + "Mode":{ + "shape":"NonEmptyString", + "documentation":"

The tracing mode.

" + } + }, + "documentation":"

The function's AWS X-Ray tracing configuration.

" + }, + "AwsLambdaFunctionVpcConfig":{ + "type":"structure", + "members":{ + "SecurityGroupIds":{ + "shape":"NonEmptyStringList", + "documentation":"

A list of VPC security groups IDs.

" + }, + "SubnetIds":{ + "shape":"NonEmptyStringList", + "documentation":"

A list of VPC subnet IDs.

" + }, + "VpcId":{ + "shape":"NonEmptyString", + "documentation":"

The ID of the VPC.

" + } + }, + "documentation":"

The VPC security groups and subnets that are attached to a Lambda function. For more information, see VPC Settings.

" + }, + "AwsLambdaLayerVersionDetails":{ + "type":"structure", + "members":{ + "Version":{ + "shape":"AwsLambdaLayerVersionNumber", + "documentation":"

The version number.

" + }, + "CompatibleRuntimes":{ + "shape":"NonEmptyStringList", + "documentation":"

The layer's compatible runtimes. Maximum number of five items.

Valid values: nodejs10.x | nodejs12.x | java8 | java11 | python2.7 | python3.6 | python3.7 | python3.8 | dotnetcore1.0 | dotnetcore2.1 | go1.x | ruby2.5 | provided

" + }, + "CreatedDate":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the version was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + } + }, + "documentation":"

Details about a Lambda layer version.

" + }, + "AwsLambdaLayerVersionNumber":{"type":"long"}, + "AwsRdsDbClusterAssociatedRole":{ + "type":"structure", + "members":{ + "RoleArn":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the IAM role.

" + }, + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The status of the association between the IAM role and the DB cluster.

" + } + }, + "documentation":"

An IAM role that is associated with the Amazon RDS DB cluster.

" + }, + "AwsRdsDbClusterAssociatedRoles":{ + "type":"list", + "member":{"shape":"AwsRdsDbClusterAssociatedRole"} + }, + "AwsRdsDbClusterDetails":{ + "type":"structure", + "members":{ + "AllocatedStorage":{ + "shape":"Integer", + "documentation":"

For all database engines except Aurora, specifies the allocated storage size in gibibytes (GiB).

" + }, + "AvailabilityZones":{ + "shape":"StringList", + "documentation":"

A list of Availability Zones (AZs) where instances in the DB cluster can be created.

" + }, + "BackupRetentionPeriod":{ + "shape":"Integer", + "documentation":"

The number of days for which automated backups are retained.

" + }, + "DatabaseName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the database.

" + }, + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The current status of this DB cluster.

" + }, + "Endpoint":{ + "shape":"NonEmptyString", + "documentation":"

The connection endpoint for the primary instance of the DB cluster.

" + }, + "ReaderEndpoint":{ + "shape":"NonEmptyString", + "documentation":"

The reader endpoint for the DB cluster.

" + }, + "CustomEndpoints":{ + "shape":"StringList", + "documentation":"

A list of custom endpoints for the DB cluster.

" + }, + "MultiAz":{ + "shape":"Boolean", + "documentation":"

Whether the DB cluster has instances in multiple Availability Zones.

" + }, + "Engine":{ + "shape":"NonEmptyString", + "documentation":"

The name of the database engine to use for this DB cluster.

" + }, + "EngineVersion":{ + "shape":"NonEmptyString", + "documentation":"

The version number of the database engine to use.

" + }, + "Port":{ + "shape":"Integer", + "documentation":"

The port number on which the DB instances in the DB cluster accept connections.

" + }, + "MasterUsername":{ + "shape":"NonEmptyString", + "documentation":"

The name of the master user for the DB cluster.

" + }, + "PreferredBackupWindow":{ + "shape":"NonEmptyString", + "documentation":"

The range of time each day when automated backups are created, if automated backups are enabled.

Uses the format HH:MM-HH:MM. For example, 04:52-05:22.

" + }, + "PreferredMaintenanceWindow":{ + "shape":"NonEmptyString", + "documentation":"

The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).

Uses the format <day>:HH:MM-<day>:HH:MM.

For the day values, use mon|tue|wed|thu|fri|sat|sun.

For example, sun:09:32-sun:10:02.

" + }, + "ReadReplicaIdentifiers":{ + "shape":"StringList", + "documentation":"

The identifiers of the read replicas that are associated with this DB cluster.

" + }, + "VpcSecurityGroups":{ + "shape":"AwsRdsDbInstanceVpcSecurityGroups", + "documentation":"

A list of VPC security groups that the DB cluster belongs to.

" + }, + "HostedZoneId":{ + "shape":"NonEmptyString", + "documentation":"

Specifies the identifier that Amazon Route 53 assigns when you create a hosted zone.

" + }, + "StorageEncrypted":{ + "shape":"Boolean", + "documentation":"

Whether the DB cluster is encrypted.

" + }, + "KmsKeyId":{ + "shape":"NonEmptyString", + "documentation":"

The ARN of the AWS KMS master key that is used to encrypt the database instances in the DB cluster.

" + }, + "DbClusterResourceId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the DB cluster. The identifier must be unique within each AWS Region and is immutable.

" + }, + "AssociatedRoles":{ + "shape":"AwsRdsDbClusterAssociatedRoles", + "documentation":"

A list of the IAM roles that are associated with the DB cluster.

" + }, + "ClusterCreateTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the DB cluster was created, in Universal Coordinated Time (UTC).

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "EnabledCloudWatchLogsExports":{ + "shape":"StringList", + "documentation":"

A list of log types that this DB cluster is configured to export to CloudWatch Logs.

" + }, + "EngineMode":{ + "shape":"NonEmptyString", + "documentation":"

The database engine mode of the DB cluster.

" + }, + "DeletionProtection":{ + "shape":"Boolean", + "documentation":"

Whether the DB cluster has deletion protection enabled.

" + }, + "HttpEndpointEnabled":{ + "shape":"Boolean", + "documentation":"

Whether the HTTP endpoint for an Aurora Serverless DB cluster is enabled.

" + }, + "ActivityStreamStatus":{ + "shape":"NonEmptyString", + "documentation":"

The status of the database activity stream.

" + }, + "CopyTagsToSnapshot":{ + "shape":"Boolean", + "documentation":"

Whether tags are copied from the DB cluster to snapshots of the DB cluster.

" + }, + "CrossAccountClone":{ + "shape":"Boolean", + "documentation":"

Whether the DB cluster is a clone of a DB cluster owned by a different AWS account.

" + }, + "DomainMemberships":{ + "shape":"AwsRdsDbDomainMemberships", + "documentation":"

The Active Directory domain membership records that are associated with the DB cluster.

" + }, + "DbClusterParameterGroup":{ + "shape":"NonEmptyString", + "documentation":"

The name of the DB cluster parameter group for the DB cluster.

" + }, + "DbSubnetGroup":{ + "shape":"NonEmptyString", + "documentation":"

The subnet group that is associated with the DB cluster, including the name, description, and subnets in the subnet group.

" + }, + "DbClusterOptionGroupMemberships":{ + "shape":"AwsRdsDbClusterOptionGroupMemberships", + "documentation":"

The list of option group memberships for this DB cluster.

" + }, + "DbClusterIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The DB cluster identifier that the user assigned to the cluster. This identifier is the unique key that identifies a DB cluster.

" + }, + "DbClusterMembers":{ + "shape":"AwsRdsDbClusterMembers", + "documentation":"

The list of instances that make up the DB cluster.

" + }, + "IamDatabaseAuthenticationEnabled":{ + "shape":"Boolean", + "documentation":"

Whether the mapping of IAM accounts to database accounts is enabled.

" + } + }, + "documentation":"

Information about an Amazon RDS DB cluster.

" + }, + "AwsRdsDbClusterMember":{ + "type":"structure", + "members":{ + "IsClusterWriter":{ + "shape":"Boolean", + "documentation":"

Whether the cluster member is the primary instance for the DB cluster.

" + }, + "PromotionTier":{ + "shape":"Integer", + "documentation":"

Specifies the order in which an Aurora replica is promoted to the primary instance when the existing primary instance fails.

" + }, + "DbInstanceIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The instance identifier for this member of the DB cluster.

" + }, + "DbClusterParameterGroupStatus":{ + "shape":"NonEmptyString", + "documentation":"

The status of the DB cluster parameter group for this member of the DB cluster.

" + } + }, + "documentation":"

Information about an instance in the DB cluster.

" + }, + "AwsRdsDbClusterMembers":{ + "type":"list", + "member":{"shape":"AwsRdsDbClusterMember"} + }, + "AwsRdsDbClusterOptionGroupMembership":{ + "type":"structure", + "members":{ + "DbClusterOptionGroupName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the DB cluster option group.

" + }, + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The status of the DB cluster option group.

" + } + }, + "documentation":"

Information about an option group membership for a DB cluster.

" + }, + "AwsRdsDbClusterOptionGroupMemberships":{ + "type":"list", + "member":{"shape":"AwsRdsDbClusterOptionGroupMembership"} + }, + "AwsRdsDbClusterSnapshotDetails":{ + "type":"structure", + "members":{ + "AvailabilityZones":{ + "shape":"StringList", + "documentation":"

A list of Availability Zones where instances in the DB cluster can be created.

" + }, + "SnapshotCreateTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the snapshot was taken.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "Engine":{ + "shape":"NonEmptyString", + "documentation":"

" + }, + "AllocatedStorage":{ + "shape":"Integer", + "documentation":"

Specifies the allocated storage size in gibibytes (GiB).

" + }, + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The status of this DB cluster snapshot.

" + }, + "Port":{ + "shape":"Integer", + "documentation":"

The port number on which the DB instances in the DB cluster accept connections.

" + }, + "VpcId":{ + "shape":"NonEmptyString", + "documentation":"

The VPC ID that is associated with the DB cluster snapshot.

" + }, + "ClusterCreateTime":{ "shape":"NonEmptyString", - "documentation":"

The error code.

" + "documentation":"

Indicates when the DB cluster was created, in Universal Coordinated Time (UTC).

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "Message":{ + "MasterUsername":{ "shape":"NonEmptyString", - "documentation":"

The error message.

" - } - }, - "documentation":"

Error messages for environment variables that couldn't be applied.

" - }, - "AwsLambdaFunctionLayer":{ - "type":"structure", - "members":{ - "Arn":{ + "documentation":"

The name of the master user for the DB cluster.

" + }, + "EngineVersion":{ "shape":"NonEmptyString", - "documentation":"

The Amazon Resource Name (ARN) of the function layer.

" + "documentation":"

The version of the database engine to use.

" }, - "CodeSize":{ + "LicenseModel":{ + "shape":"NonEmptyString", + "documentation":"

The license model information for this DB cluster snapshot.

" + }, + "SnapshotType":{ + "shape":"NonEmptyString", + "documentation":"

The type of DB cluster snapshot.

" + }, + "PercentProgress":{ "shape":"Integer", - "documentation":"

The size of the layer archive in bytes.

" - } - }, - "documentation":"

An AWS Lambda layer.

" - }, - "AwsLambdaFunctionLayerList":{ - "type":"list", - "member":{"shape":"AwsLambdaFunctionLayer"} - }, - "AwsLambdaFunctionTracingConfig":{ - "type":"structure", - "members":{ - "Mode":{ + "documentation":"

Specifies the percentage of the estimated data that has been transferred.

" + }, + "StorageEncrypted":{ + "shape":"Boolean", + "documentation":"

Whether the DB cluster is encrypted.

" + }, + "KmsKeyId":{ "shape":"NonEmptyString", - "documentation":"

The tracing mode.

" - } - }, - "documentation":"

The function's AWS X-Ray tracing configuration.

" - }, - "AwsLambdaFunctionVpcConfig":{ - "type":"structure", - "members":{ - "SecurityGroupIds":{ - "shape":"NonEmptyStringList", - "documentation":"

A list of VPC security groups IDs.

" + "documentation":"

The ARN of the AWS KMS master key that is used to encrypt the database instances in the DB cluster.

" }, - "SubnetIds":{ - "shape":"NonEmptyStringList", - "documentation":"

A list of VPC subnet IDs.

" + "DbClusterIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The DB cluster identifier.

" }, - "VpcId":{ + "DbClusterSnapshotIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The ID of the VPC.

" + "documentation":"

The identifier of the DB cluster snapshot.

" + }, + "IamDatabaseAuthenticationEnabled":{ + "shape":"Boolean", + "documentation":"

Whether mapping of IAM accounts to database accounts is enabled.

" } }, - "documentation":"

The VPC security groups and subnets that are attached to a Lambda function. For more information, see VPC Settings.

" + "documentation":"

Information about an Amazon RDS DB cluster snapshot.

" }, - "AwsLambdaLayerVersionDetails":{ + "AwsRdsDbDomainMembership":{ "type":"structure", "members":{ - "Version":{ - "shape":"AwsLambdaLayerVersionNumber", - "documentation":"

The version number.

" + "Domain":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the Active Directory domain.

" }, - "CompatibleRuntimes":{ - "shape":"NonEmptyStringList", - "documentation":"

The layer's compatible runtimes. Maximum number of five items.

Valid values: nodejs10.x | nodejs12.x | java8 | java11 | python2.7 | python3.6 | python3.7 | python3.8 | dotnetcore1.0 | dotnetcore2.1 | go1.x | ruby2.5 | provided

" + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The status of the Active Directory Domain membership for the DB instance.

" }, - "CreatedDate":{ + "Fqdn":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the version was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

The fully qualified domain name of the Active Directory domain.

" + }, + "IamRoleName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the IAM role to use when making API calls to the Directory Service.

" } }, - "documentation":"

Details about a Lambda layer version.

" + "documentation":"

Information about an Active Directory domain membership record associated with the DB instance.

" }, - "AwsLambdaLayerVersionNumber":{"type":"long"}, - "AwsRdsDbClusterAssociatedRole":{ + "AwsRdsDbDomainMemberships":{ + "type":"list", + "member":{"shape":"AwsRdsDbDomainMembership"} + }, + "AwsRdsDbInstanceAssociatedRole":{ "type":"structure", "members":{ "RoleArn":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the IAM role.

" + "documentation":"

The Amazon Resource Name (ARN) of the IAM role that is associated with the DB instance.

" + }, + "FeatureName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the feature associated with the IAM)role.

" }, "Status":{ "shape":"NonEmptyString", - "documentation":"

The status of the association between the IAM role and the DB cluster.

" + "documentation":"

Describes the state of the association between the IAM role and the DB instance. The Status property returns one of the following values:

" } }, - "documentation":"

An IAM role that is associated with the Amazon RDS DB cluster.

" + "documentation":"

An AWS Identity and Access Management (IAM) role associated with the DB instance.

" }, - "AwsRdsDbClusterAssociatedRoles":{ + "AwsRdsDbInstanceAssociatedRoles":{ "type":"list", - "member":{"shape":"AwsRdsDbClusterAssociatedRole"} + "member":{"shape":"AwsRdsDbInstanceAssociatedRole"} }, - "AwsRdsDbClusterDetails":{ + "AwsRdsDbInstanceDetails":{ "type":"structure", "members":{ - "AllocatedStorage":{ - "shape":"Integer", - "documentation":"

For all database engines except Aurora, specifies the allocated storage size in gibibytes (GiB).

" + "AssociatedRoles":{ + "shape":"AwsRdsDbInstanceAssociatedRoles", + "documentation":"

The AWS Identity and Access Management (IAM) roles associated with the DB instance.

" }, - "AvailabilityZones":{ - "shape":"StringList", - "documentation":"

A list of Availability Zones (AZs) where instances in the DB cluster can be created.

" + "CACertificateIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the CA certificate for this DB instance.

" }, - "BackupRetentionPeriod":{ + "DBClusterIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

If the DB instance is a member of a DB cluster, contains the name of the DB cluster that the DB instance is a member of.

" + }, + "DBInstanceIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

Contains a user-supplied database identifier. This identifier is the unique key that identifies a DB instance.

" + }, + "DBInstanceClass":{ + "shape":"NonEmptyString", + "documentation":"

Contains the name of the compute and memory capacity class of the DB instance.

" + }, + "DbInstancePort":{ "shape":"Integer", - "documentation":"

The number of days for which automated backups are retained.

" + "documentation":"

Specifies the port that the DB instance listens on. If the DB instance is part of a DB cluster, this can be a different port than the DB cluster port.

" }, - "DatabaseName":{ + "DbiResourceId":{ "shape":"NonEmptyString", - "documentation":"

The name of the database.

" + "documentation":"

The AWS Region-unique, immutable identifier for the DB instance. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB instance is accessed.

" }, - "Status":{ + "DBName":{ "shape":"NonEmptyString", - "documentation":"

The current status of this DB cluster.

" + "documentation":"

The meaning of this parameter differs according to the database engine you use.

MySQL, MariaDB, SQL Server, PostgreSQL

Contains the name of the initial database of this instance that was provided at create time, if one was specified when the DB instance was created. This same name is returned for the life of the DB instance.

Oracle

Contains the Oracle System ID (SID) of the created DB instance. Not shown when the returned parameters do not apply to an Oracle DB instance.

" + }, + "DeletionProtection":{ + "shape":"Boolean", + "documentation":"

Indicates whether the DB instance has deletion protection enabled.

When deletion protection is enabled, the database cannot be deleted.

" }, "Endpoint":{ + "shape":"AwsRdsDbInstanceEndpoint", + "documentation":"

Specifies the connection endpoint.

" + }, + "Engine":{ "shape":"NonEmptyString", - "documentation":"

The connection endpoint for the primary instance of the DB cluster.

" + "documentation":"

Provides the name of the database engine to use for this DB instance.

" }, - "ReaderEndpoint":{ + "EngineVersion":{ "shape":"NonEmptyString", - "documentation":"

The reader endpoint for the DB cluster.

" + "documentation":"

Indicates the database engine version.

" }, - "CustomEndpoints":{ - "shape":"StringList", - "documentation":"

A list of custom endpoints for the DB cluster.

" + "IAMDatabaseAuthenticationEnabled":{ + "shape":"Boolean", + "documentation":"

True if mapping of AWS Identity and Access Management (IAM) accounts to database accounts is enabled, and otherwise false.

IAM database authentication can be enabled for the following database engines.

" }, - "MultiAz":{ + "InstanceCreateTime":{ + "shape":"NonEmptyString", + "documentation":"

Indicates when the DB instance was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + }, + "KmsKeyId":{ + "shape":"NonEmptyString", + "documentation":"

If StorageEncrypted is true, the AWS KMS key identifier for the encrypted DB instance.

" + }, + "PubliclyAccessible":{ "shape":"Boolean", - "documentation":"

Whether the DB cluster has instances in multiple Availability Zones.

" + "documentation":"

Specifies the accessibility options for the DB instance.

A value of true specifies an Internet-facing instance with a publicly resolvable DNS name, which resolves to a public IP address.

A value of false specifies an internal instance with a DNS name that resolves to a private IP address.

" }, - "Engine":{ + "StorageEncrypted":{ + "shape":"Boolean", + "documentation":"

Specifies whether the DB instance is encrypted.

" + }, + "TdeCredentialArn":{ "shape":"NonEmptyString", - "documentation":"

The name of the database engine to use for this DB cluster.

" + "documentation":"

The ARN from the key store with which the instance is associated for TDE encryption.

" }, - "EngineVersion":{ + "VpcSecurityGroups":{ + "shape":"AwsRdsDbInstanceVpcSecurityGroups", + "documentation":"

A list of VPC security groups that the DB instance belongs to.

" + }, + "MultiAz":{ + "shape":"Boolean", + "documentation":"

Whether the DB instance is a multiple Availability Zone deployment.

" + }, + "EnhancedMonitoringResourceArn":{ "shape":"NonEmptyString", - "documentation":"

The version number of the database engine to use.

" + "documentation":"

The ARN of the CloudWatch Logs log stream that receives the enhanced monitoring metrics data for the DB instance.

" }, - "Port":{ - "shape":"Integer", - "documentation":"

The port number on which the DB instances in the DB cluster accept connections.

" + "DbInstanceStatus":{ + "shape":"NonEmptyString", + "documentation":"

The current status of the DB instance.

" }, "MasterUsername":{ "shape":"NonEmptyString", - "documentation":"

The name of the master user for the DB cluster.

" + "documentation":"

The master user name of the DB instance.

" + }, + "AllocatedStorage":{ + "shape":"Integer", + "documentation":"

The amount of storage (in gigabytes) to initially allocate for the DB instance.

" }, "PreferredBackupWindow":{ "shape":"NonEmptyString", "documentation":"

The range of time each day when automated backups are created, if automated backups are enabled.

Uses the format HH:MM-HH:MM. For example, 04:52-05:22.

" }, + "BackupRetentionPeriod":{ + "shape":"Integer", + "documentation":"

The number of days for which to retain automated backups.

" + }, + "DbSecurityGroups":{ + "shape":"StringList", + "documentation":"

A list of the DB security groups to assign to the DB instance.

" + }, + "DbParameterGroups":{ + "shape":"AwsRdsDbParameterGroups", + "documentation":"

A list of the DB parameter groups to assign to the DB instance.

" + }, + "AvailabilityZone":{ + "shape":"NonEmptyString", + "documentation":"

The Availability Zone where the DB instance will be created.

" + }, + "DbSubnetGroup":{ + "shape":"AwsRdsDbSubnetGroup", + "documentation":"

Information about the subnet group that is associated with the DB instance.

" + }, "PreferredMaintenanceWindow":{ "shape":"NonEmptyString", "documentation":"

The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).

Uses the format <day>:HH:MM-<day>:HH:MM.

For the day values, use mon|tue|wed|thu|fri|sat|sun.

For example, sun:09:32-sun:10:02.

" }, - "ReadReplicaIdentifiers":{ - "shape":"StringList", - "documentation":"

The identifiers of the read replicas that are associated with this DB cluster.

" - }, - "VpcSecurityGroups":{ - "shape":"AwsRdsDbInstanceVpcSecurityGroups", - "documentation":"

A list of VPC security groups that the DB cluster belongs to.

" + "PendingModifiedValues":{ + "shape":"AwsRdsDbPendingModifiedValues", + "documentation":"

Changes to the DB instance that are currently pending.

" }, - "HostedZoneId":{ + "LatestRestorableTime":{ "shape":"NonEmptyString", - "documentation":"

Specifies the identifier that Amazon Route 53 assigns when you create a hosted zone.

" + "documentation":"

Specifies the latest time to which a database can be restored with point-in-time restore.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "StorageEncrypted":{ + "AutoMinorVersionUpgrade":{ "shape":"Boolean", - "documentation":"

Whether the DB cluster is encrypted.

" + "documentation":"

Indicates whether minor version patches are applied automatically.

" }, - "KmsKeyId":{ + "ReadReplicaSourceDBInstanceIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the AWS KMS master key that is used to encrypt the database instances in the DB cluster.

" + "documentation":"

If this DB instance is a read replica, contains the identifier of the source DB instance.

" }, - "DbClusterResourceId":{ - "shape":"NonEmptyString", - "documentation":"

The identifier of the DB cluster. The identifier must be unique within each AWS Region and is immutable.

" + "ReadReplicaDBInstanceIdentifiers":{ + "shape":"StringList", + "documentation":"

List of identifiers of the read replicas associated with this DB instance.

" }, - "AssociatedRoles":{ - "shape":"AwsRdsDbClusterAssociatedRoles", - "documentation":"

A list of the IAM roles that are associated with the DB cluster.

" + "ReadReplicaDBClusterIdentifiers":{ + "shape":"StringList", + "documentation":"

List of identifiers of Aurora DB clusters to which the RDS DB instance is replicated as a read replica.

" }, - "ClusterCreateTime":{ + "LicenseModel":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the DB cluster was created, in Universal Coordinated Time (UTC).

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

License model information for this DB instance.

" }, - "EnabledCloudWatchLogsExports":{ - "shape":"StringList", - "documentation":"

A list of log types that this DB cluster is configured to export to CloudWatch Logs.

" + "Iops":{ + "shape":"Integer", + "documentation":"

Specifies the provisioned IOPS (I/O operations per second) for this DB instance.

" }, - "EngineMode":{ + "OptionGroupMemberships":{ + "shape":"AwsRdsDbOptionGroupMemberships", + "documentation":"

The list of option group memberships for this DB instance.

" + }, + "CharacterSetName":{ "shape":"NonEmptyString", - "documentation":"

The database engine mode of the DB cluster.

" + "documentation":"

The name of the character set that this DB instance is associated with.

" }, - "DeletionProtection":{ - "shape":"Boolean", - "documentation":"

Whether the DB cluster has deletion protection enabled.

" + "SecondaryAvailabilityZone":{ + "shape":"NonEmptyString", + "documentation":"

For a DB instance with multi-Availability Zone support, the name of the secondary Availability Zone.

" }, - "HttpEndpointEnabled":{ - "shape":"Boolean", - "documentation":"

Whether the HTTP endpoint for an Aurora Serverless DB cluster is enabled.

" + "StatusInfos":{ + "shape":"AwsRdsDbStatusInfos", + "documentation":"

The status of a read replica. If the instance isn't a read replica, this is empty.

" }, - "ActivityStreamStatus":{ + "StorageType":{ "shape":"NonEmptyString", - "documentation":"

The status of the database activity stream.

" + "documentation":"

The storage type for the DB instance.

" }, - "CopyTagsToSnapshot":{ - "shape":"Boolean", - "documentation":"

Whether tags are copied from the DB cluster to snapshots of the DB cluster.

" + "DomainMemberships":{ + "shape":"AwsRdsDbDomainMemberships", + "documentation":"

The Active Directory domain membership records associated with the DB instance.

" }, - "CrossAccountClone":{ + "CopyTagsToSnapshot":{ "shape":"Boolean", - "documentation":"

Whether the DB cluster is a clone of a DB cluster owned by a different AWS account.

" + "documentation":"

Whether to copy resource tags to snapshots of the DB instance.

" }, - "DomainMemberships":{ - "shape":"AwsRdsDbDomainMemberships", - "documentation":"

The Active Directory domain membership records that are associated with the DB cluster.

" + "MonitoringInterval":{ + "shape":"Integer", + "documentation":"

The interval, in seconds, between points when enhanced monitoring metrics are collected for the DB instance.

" }, - "DbClusterParameterGroup":{ + "MonitoringRoleArn":{ "shape":"NonEmptyString", - "documentation":"

The name of the DB cluster parameter group for the DB cluster.

" + "documentation":"

The ARN for the IAM role that permits Amazon RDS to send enhanced monitoring metrics to CloudWatch Logs.

" }, - "DbSubnetGroup":{ + "PromotionTier":{ + "shape":"Integer", + "documentation":"

The order in which to promote an Aurora replica to the primary instance after a failure of the existing primary instance.

" + }, + "Timezone":{ "shape":"NonEmptyString", - "documentation":"

The subnet group that is associated with the DB cluster, including the name, description, and subnets in the subnet group.

" + "documentation":"

The time zone of the DB instance.

" }, - "DbClusterOptionGroupMemberships":{ - "shape":"AwsRdsDbClusterOptionGroupMemberships", - "documentation":"

The list of option group memberships for this DB cluster.

" + "PerformanceInsightsEnabled":{ + "shape":"Boolean", + "documentation":"

Indicates whether Performance Insights is enabled for the DB instance.

" }, - "DbClusterIdentifier":{ + "PerformanceInsightsKmsKeyId":{ "shape":"NonEmptyString", - "documentation":"

The DB cluster identifier that the user assigned to the cluster. This identifier is the unique key that identifies a DB cluster.

" + "documentation":"

The identifier of the AWS KMS key used to encrypt the Performance Insights data.

" }, - "DbClusterMembers":{ - "shape":"AwsRdsDbClusterMembers", - "documentation":"

The list of instances that make up the DB cluster.

" + "PerformanceInsightsRetentionPeriod":{ + "shape":"Integer", + "documentation":"

The number of days to retain Performance Insights data.

" }, - "IamDatabaseAuthenticationEnabled":{ - "shape":"Boolean", - "documentation":"

Whether the mapping of IAM accounts to database accounts is enabled.

" + "EnabledCloudWatchLogsExports":{ + "shape":"StringList", + "documentation":"

A list of log types that this DB instance is configured to export to CloudWatch Logs.

" + }, + "ProcessorFeatures":{ + "shape":"AwsRdsDbProcessorFeatures", + "documentation":"

The number of CPU cores and the number of threads per core for the DB instance class of the DB instance.

" + }, + "ListenerEndpoint":{"shape":"AwsRdsDbInstanceEndpoint"}, + "MaxAllocatedStorage":{ + "shape":"Integer", + "documentation":"

The upper limit to which Amazon RDS can automatically scale the storage of the DB instance.

" } }, - "documentation":"

Information about an Amazon RDS DB cluster.

" + "documentation":"

Contains the details of an Amazon RDS DB instance.

" }, - "AwsRdsDbClusterMember":{ + "AwsRdsDbInstanceEndpoint":{ "type":"structure", "members":{ - "IsClusterWriter":{ - "shape":"Boolean", - "documentation":"

Whether the cluster member is the primary instance for the DB cluster.

" + "Address":{ + "shape":"NonEmptyString", + "documentation":"

Specifies the DNS address of the DB instance.

" }, - "PromotionTier":{ + "Port":{ "shape":"Integer", - "documentation":"

Specifies the order in which an Aurora replica is promoted to the primary instance when the existing primary instance fails.

" + "documentation":"

Specifies the port that the database engine is listening on.

" }, - "DbInstanceIdentifier":{ + "HostedZoneId":{ "shape":"NonEmptyString", - "documentation":"

The instance identifier for this member of the DB cluster.

" + "documentation":"

Specifies the ID that Amazon Route 53 assigns when you create a hosted zone.

" + } + }, + "documentation":"

Specifies the connection endpoint.

" + }, + "AwsRdsDbInstanceVpcSecurityGroup":{ + "type":"structure", + "members":{ + "VpcSecurityGroupId":{ + "shape":"NonEmptyString", + "documentation":"

The name of the VPC security group.

" }, - "DbClusterParameterGroupStatus":{ + "Status":{ "shape":"NonEmptyString", - "documentation":"

The status of the DB cluster parameter group for this member of the DB cluster.

" + "documentation":"

The status of the VPC security group.

" } }, - "documentation":"

Information about an instance in the DB cluster.

" + "documentation":"

A VPC security groups that the DB instance belongs to.

" }, - "AwsRdsDbClusterMembers":{ + "AwsRdsDbInstanceVpcSecurityGroups":{ "type":"list", - "member":{"shape":"AwsRdsDbClusterMember"} + "member":{"shape":"AwsRdsDbInstanceVpcSecurityGroup"} }, - "AwsRdsDbClusterOptionGroupMembership":{ + "AwsRdsDbOptionGroupMembership":{ "type":"structure", "members":{ - "DbClusterOptionGroupName":{ + "OptionGroupName":{ "shape":"NonEmptyString", - "documentation":"

The name of the DB cluster option group.

" + "documentation":"

" }, "Status":{ "shape":"NonEmptyString", - "documentation":"

The status of the DB cluster option group.

" + "documentation":"

" } }, - "documentation":"

Information about an option group membership for a DB cluster.

" + "documentation":"

" }, - "AwsRdsDbClusterOptionGroupMemberships":{ + "AwsRdsDbOptionGroupMemberships":{ "type":"list", - "member":{"shape":"AwsRdsDbClusterOptionGroupMembership"} + "member":{"shape":"AwsRdsDbOptionGroupMembership"} }, - "AwsRdsDbClusterSnapshotDetails":{ + "AwsRdsDbParameterGroup":{ "type":"structure", "members":{ - "AvailabilityZones":{ - "shape":"StringList", - "documentation":"

A list of Availability Zones where instances in the DB cluster can be created.

" - }, - "SnapshotCreateTime":{ + "DbParameterGroupName":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the snapshot was taken.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

" }, - "Engine":{ + "ParameterApplyStatus":{ + "shape":"NonEmptyString", + "documentation":"

" + } + }, + "documentation":"

" + }, + "AwsRdsDbParameterGroups":{ + "type":"list", + "member":{"shape":"AwsRdsDbParameterGroup"} + }, + "AwsRdsDbPendingModifiedValues":{ + "type":"structure", + "members":{ + "DbInstanceClass":{ "shape":"NonEmptyString", "documentation":"

" }, "AllocatedStorage":{ "shape":"Integer", - "documentation":"

Specifies the allocated storage size in gibibytes (GiB).

" + "documentation":"

" }, - "Status":{ + "MasterUserPassword":{ "shape":"NonEmptyString", - "documentation":"

The status of this DB cluster snapshot.

" + "documentation":"

" }, "Port":{ "shape":"Integer", - "documentation":"

The port number on which the DB instances in the DB cluster accept connections.

" - }, - "VpcId":{ - "shape":"NonEmptyString", - "documentation":"

The VPC ID that is associated with the DB cluster snapshot.

" - }, - "ClusterCreateTime":{ - "shape":"NonEmptyString", - "documentation":"

Indicates when the DB cluster was created, in Universal Coordinated Time (UTC).

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "MasterUsername":{ - "shape":"NonEmptyString", - "documentation":"

The name of the master user for the DB cluster.

" - }, - "EngineVersion":{ - "shape":"NonEmptyString", - "documentation":"

The version of the database engine to use.

" - }, - "LicenseModel":{ - "shape":"NonEmptyString", - "documentation":"

The license model information for this DB cluster snapshot.

" - }, - "SnapshotType":{ - "shape":"NonEmptyString", - "documentation":"

The type of DB cluster snapshot.

" + "documentation":"

" }, - "PercentProgress":{ + "BackupRetentionPeriod":{ "shape":"Integer", - "documentation":"

Specifies the percentage of the estimated data that has been transferred.

" + "documentation":"

" }, - "StorageEncrypted":{ + "MultiAZ":{ "shape":"Boolean", - "documentation":"

Whether the DB cluster is encrypted.

" - }, - "KmsKeyId":{ - "shape":"NonEmptyString", - "documentation":"

The ARN of the AWS KMS master key that is used to encrypt the database instances in the DB cluster.

" + "documentation":"

" }, - "DbClusterIdentifier":{ + "EngineVersion":{ "shape":"NonEmptyString", - "documentation":"

The DB cluster identifier.

" + "documentation":"

" }, - "DbClusterSnapshotIdentifier":{ + "LicenseModel":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the DB cluster snapshot.

" + "documentation":"

" }, - "IamDatabaseAuthenticationEnabled":{ - "shape":"Boolean", - "documentation":"

Whether mapping of IAM accounts to database accounts is enabled.

" - } - }, - "documentation":"

Information about an Amazon RDS DB cluster snapshot.

" - }, - "AwsRdsDbDomainMembership":{ - "type":"structure", - "members":{ - "Domain":{ + "Iops":{ + "shape":"Integer", + "documentation":"

" + }, + "DbInstanceIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the Active Directory domain.

" + "documentation":"

" }, - "Status":{ + "StorageType":{ "shape":"NonEmptyString", - "documentation":"

The status of the Active Directory Domain membership for the DB instance.

" + "documentation":"

" }, - "Fqdn":{ + "CaCertificateIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The fully qualified domain name of the Active Directory domain.

" + "documentation":"

" }, - "IamRoleName":{ + "DbSubnetGroupName":{ "shape":"NonEmptyString", - "documentation":"

The name of the IAM role to use when making API calls to the Directory Service.

" + "documentation":"

" + }, + "PendingCloudWatchLogsExports":{ + "shape":"AwsRdsPendingCloudWatchLogsExports", + "documentation":"

" + }, + "ProcessorFeatures":{ + "shape":"AwsRdsDbProcessorFeatures", + "documentation":"

" } }, - "documentation":"

Information about an Active Directory domain membership record associated with the DB instance.

" - }, - "AwsRdsDbDomainMemberships":{ - "type":"list", - "member":{"shape":"AwsRdsDbDomainMembership"} + "documentation":"

" }, - "AwsRdsDbInstanceAssociatedRole":{ + "AwsRdsDbProcessorFeature":{ "type":"structure", "members":{ - "RoleArn":{ - "shape":"NonEmptyString", - "documentation":"

The Amazon Resource Name (ARN) of the IAM role that is associated with the DB instance.

" - }, - "FeatureName":{ + "Name":{ "shape":"NonEmptyString", - "documentation":"

The name of the feature associated with the IAM)role.

" + "documentation":"

" }, - "Status":{ + "Value":{ "shape":"NonEmptyString", - "documentation":"

Describes the state of the association between the IAM role and the DB instance. The Status property returns one of the following values:

" + "documentation":"

" } }, - "documentation":"

An AWS Identity and Access Management (IAM) role associated with the DB instance.

" + "documentation":"

" }, - "AwsRdsDbInstanceAssociatedRoles":{ + "AwsRdsDbProcessorFeatures":{ "type":"list", - "member":{"shape":"AwsRdsDbInstanceAssociatedRole"} + "member":{"shape":"AwsRdsDbProcessorFeature"} }, - "AwsRdsDbInstanceDetails":{ + "AwsRdsDbSnapshotDetails":{ "type":"structure", "members":{ - "AssociatedRoles":{ - "shape":"AwsRdsDbInstanceAssociatedRoles", - "documentation":"

The AWS Identity and Access Management (IAM) roles associated with the DB instance.

" - }, - "CACertificateIdentifier":{ + "DbSnapshotIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the CA certificate for this DB instance.

" + "documentation":"

" }, - "DBClusterIdentifier":{ + "DbInstanceIdentifier":{ "shape":"NonEmptyString", - "documentation":"

If the DB instance is a member of a DB cluster, contains the name of the DB cluster that the DB instance is a member of.

" + "documentation":"

" }, - "DBInstanceIdentifier":{ + "SnapshotCreateTime":{ "shape":"NonEmptyString", - "documentation":"

Contains a user-supplied database identifier. This identifier is the unique key that identifies a DB instance.

" + "documentation":"

" }, - "DBInstanceClass":{ + "Engine":{ "shape":"NonEmptyString", - "documentation":"

Contains the name of the compute and memory capacity class of the DB instance.

" + "documentation":"

" }, - "DbInstancePort":{ + "AllocatedStorage":{ "shape":"Integer", - "documentation":"

Specifies the port that the DB instance listens on. If the DB instance is part of a DB cluster, this can be a different port than the DB cluster port.

" - }, - "DbiResourceId":{ - "shape":"NonEmptyString", - "documentation":"

The AWS Region-unique, immutable identifier for the DB instance. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB instance is accessed.

" + "documentation":"

" }, - "DBName":{ + "Status":{ "shape":"NonEmptyString", - "documentation":"

The meaning of this parameter differs according to the database engine you use.

MySQL, MariaDB, SQL Server, PostgreSQL

Contains the name of the initial database of this instance that was provided at create time, if one was specified when the DB instance was created. This same name is returned for the life of the DB instance.

Oracle

Contains the Oracle System ID (SID) of the created DB instance. Not shown when the returned parameters do not apply to an Oracle DB instance.

" - }, - "DeletionProtection":{ - "shape":"Boolean", - "documentation":"

Indicates whether the DB instance has deletion protection enabled.

When deletion protection is enabled, the database cannot be deleted.

" + "documentation":"

" }, - "Endpoint":{ - "shape":"AwsRdsDbInstanceEndpoint", - "documentation":"

Specifies the connection endpoint.

" + "Port":{ + "shape":"Integer", + "documentation":"

" }, - "Engine":{ + "AvailabilityZone":{ "shape":"NonEmptyString", - "documentation":"

Provides the name of the database engine to use for this DB instance.

" + "documentation":"

" }, - "EngineVersion":{ + "VpcId":{ "shape":"NonEmptyString", - "documentation":"

Indicates the database engine version.

" - }, - "IAMDatabaseAuthenticationEnabled":{ - "shape":"Boolean", - "documentation":"

True if mapping of AWS Identity and Access Management (IAM) accounts to database accounts is enabled, and otherwise false.

IAM database authentication can be enabled for the following database engines.

" + "documentation":"

" }, "InstanceCreateTime":{ "shape":"NonEmptyString", - "documentation":"

Indicates when the DB instance was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" - }, - "KmsKeyId":{ - "shape":"NonEmptyString", - "documentation":"

If StorageEncrypted is true, the AWS KMS key identifier for the encrypted DB instance.

" - }, - "PubliclyAccessible":{ - "shape":"Boolean", - "documentation":"

Specifies the accessibility options for the DB instance.

A value of true specifies an Internet-facing instance with a publicly resolvable DNS name, which resolves to a public IP address.

A value of false specifies an internal instance with a DNS name that resolves to a private IP address.

" - }, - "StorageEncrypted":{ - "shape":"Boolean", - "documentation":"

Specifies whether the DB instance is encrypted.

" + "documentation":"

" }, - "TdeCredentialArn":{ + "MasterUsername":{ "shape":"NonEmptyString", - "documentation":"

The ARN from the key store with which the instance is associated for TDE encryption.

" - }, - "VpcSecurityGroups":{ - "shape":"AwsRdsDbInstanceVpcSecurityGroups", - "documentation":"

A list of VPC security groups that the DB instance belongs to.

" - }, - "MultiAz":{ - "shape":"Boolean", - "documentation":"

Whether the DB instance is a multiple Availability Zone deployment.

" + "documentation":"

" }, - "EnhancedMonitoringResourceArn":{ + "EngineVersion":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the CloudWatch Logs log stream that receives the enhanced monitoring metrics data for the DB instance.

" + "documentation":"

" }, - "DbInstanceStatus":{ + "LicenseModel":{ "shape":"NonEmptyString", - "documentation":"

The current status of the DB instance.

" + "documentation":"

" }, - "MasterUsername":{ + "SnapshotType":{ "shape":"NonEmptyString", - "documentation":"

The master user name of the DB instance.

" + "documentation":"

" }, - "AllocatedStorage":{ + "Iops":{ "shape":"Integer", - "documentation":"

The amount of storage (in gigabytes) to initially allocate for the DB instance.

" + "documentation":"

" }, - "PreferredBackupWindow":{ + "OptionGroupName":{ "shape":"NonEmptyString", - "documentation":"

The range of time each day when automated backups are created, if automated backups are enabled.

Uses the format HH:MM-HH:MM. For example, 04:52-05:22.

" + "documentation":"

" }, - "BackupRetentionPeriod":{ + "PercentProgress":{ "shape":"Integer", - "documentation":"

The number of days for which to retain automated backups.

" - }, - "DbSecurityGroups":{ - "shape":"StringList", - "documentation":"

A list of the DB security groups to assign to the DB instance.

" - }, - "DbParameterGroups":{ - "shape":"AwsRdsDbParameterGroups", - "documentation":"

A list of the DB parameter groups to assign to the DB instance.

" + "documentation":"

" }, - "AvailabilityZone":{ + "SourceRegion":{ "shape":"NonEmptyString", - "documentation":"

The Availability Zone where the DB instance will be created.

" - }, - "DbSubnetGroup":{ - "shape":"AwsRdsDbSubnetGroup", - "documentation":"

Information about the subnet group that is associated with the DB instance.

" + "documentation":"

" }, - "PreferredMaintenanceWindow":{ + "SourceDbSnapshotIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).

Uses the format <day>:HH:MM-<day>:HH:MM.

For the day values, use mon|tue|wed|thu|fri|sat|sun.

For example, sun:09:32-sun:10:02.

" + "documentation":"

" }, - "PendingModifiedValues":{ - "shape":"AwsRdsDbPendingModifiedValues", - "documentation":"

Changes to the DB instance that are currently pending.

" + "StorageType":{ + "shape":"NonEmptyString", + "documentation":"

" }, - "LatestRestorableTime":{ + "TdeCredentialArn":{ "shape":"NonEmptyString", - "documentation":"

Specifies the latest time to which a database can be restored with point-in-time restore.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" + "documentation":"

" }, - "AutoMinorVersionUpgrade":{ + "Encrypted":{ "shape":"Boolean", - "documentation":"

Indicates whether minor version patches are applied automatically.

" + "documentation":"

" }, - "ReadReplicaSourceDBInstanceIdentifier":{ + "KmsKeyId":{ "shape":"NonEmptyString", - "documentation":"

If this DB instance is a read replica, contains the identifier of the source DB instance.

" + "documentation":"

" }, - "ReadReplicaDBInstanceIdentifiers":{ - "shape":"StringList", - "documentation":"

List of identifiers of the read replicas associated with this DB instance.

" + "Timezone":{ + "shape":"NonEmptyString", + "documentation":"

" }, - "ReadReplicaDBClusterIdentifiers":{ - "shape":"StringList", - "documentation":"

List of identifiers of Aurora DB clusters to which the RDS DB instance is replicated as a read replica.

" + "IamDatabaseAuthenticationEnabled":{ + "shape":"Boolean", + "documentation":"

" }, - "LicenseModel":{ - "shape":"NonEmptyString", - "documentation":"

License model information for this DB instance.

" + "ProcessorFeatures":{ + "shape":"AwsRdsDbProcessorFeatures", + "documentation":"

" }, - "Iops":{ - "shape":"Integer", - "documentation":"

Specifies the provisioned IOPS (I/O operations per second) for this DB instance.

" + "DbiResourceId":{ + "shape":"NonEmptyString", + "documentation":"

" + } + }, + "documentation":"

" + }, + "AwsRdsDbStatusInfo":{ + "type":"structure", + "members":{ + "StatusType":{ + "shape":"NonEmptyString", + "documentation":"

The type of status. For a read replica, the status type is read replication.

" }, - "OptionGroupMemberships":{ - "shape":"AwsRdsDbOptionGroupMemberships", - "documentation":"

The list of option group memberships for this DB instance.

" + "Normal":{ + "shape":"Boolean", + "documentation":"

Whether the read replica instance is operating normally.

" }, - "CharacterSetName":{ + "Status":{ "shape":"NonEmptyString", - "documentation":"

The name of the character set that this DB instance is associated with.

" + "documentation":"

The status of the read replica instance.

" }, - "SecondaryAvailabilityZone":{ + "Message":{ + "shape":"NonEmptyString", + "documentation":"

If the read replica is currently in an error state, provides the error details.

" + } + }, + "documentation":"

Information about the status of a read replica.

" + }, + "AwsRdsDbStatusInfos":{ + "type":"list", + "member":{"shape":"AwsRdsDbStatusInfo"} + }, + "AwsRdsDbSubnetGroup":{ + "type":"structure", + "members":{ + "DbSubnetGroupName":{ "shape":"NonEmptyString", - "documentation":"

For a DB instance with multi-Availability Zone support, the name of the secondary Availability Zone.

" - }, - "StatusInfos":{ - "shape":"AwsRdsDbStatusInfos", - "documentation":"

The status of a read replica. If the instance isn't a read replica, this is empty.

" + "documentation":"

The name of the subnet group.

" }, - "StorageType":{ + "DbSubnetGroupDescription":{ "shape":"NonEmptyString", - "documentation":"

The storage type for the DB instance.

" - }, - "DomainMemberships":{ - "shape":"AwsRdsDbDomainMemberships", - "documentation":"

The Active Directory domain membership records associated with the DB instance.

" - }, - "CopyTagsToSnapshot":{ - "shape":"Boolean", - "documentation":"

Whether to copy resource tags to snapshots of the DB instance.

" - }, - "MonitoringInterval":{ - "shape":"Integer", - "documentation":"

The interval, in seconds, between points when enhanced monitoring metrics are collected for the DB instance.

" + "documentation":"

The description of the subnet group.

" }, - "MonitoringRoleArn":{ + "VpcId":{ "shape":"NonEmptyString", - "documentation":"

The ARN for the IAM role that permits Amazon RDS to send enhanced monitoring metrics to CloudWatch Logs.

" - }, - "PromotionTier":{ - "shape":"Integer", - "documentation":"

The order in which to promote an Aurora replica to the primary instance after a failure of the existing primary instance.

" + "documentation":"

The VPC ID of the subnet group.

" }, - "Timezone":{ + "SubnetGroupStatus":{ "shape":"NonEmptyString", - "documentation":"

The time zone of the DB instance.

" + "documentation":"

The status of the subnet group.

" }, - "PerformanceInsightsEnabled":{ - "shape":"Boolean", - "documentation":"

Indicates whether Performance Insights is enabled for the DB instance.

" + "Subnets":{ + "shape":"AwsRdsDbSubnetGroupSubnets", + "documentation":"

A list of subnets in the subnet group.

" }, - "PerformanceInsightsKmsKeyId":{ + "DbSubnetGroupArn":{ "shape":"NonEmptyString", - "documentation":"

The identifier of the AWS KMS key used to encrypt the Performance Insights data.

" + "documentation":"

The ARN of the subnet group.

" + } + }, + "documentation":"

Information about the subnet group for the database instance.

" + }, + "AwsRdsDbSubnetGroupSubnet":{ + "type":"structure", + "members":{ + "SubnetIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of a subnet in the subnet group.

" }, - "PerformanceInsightsRetentionPeriod":{ - "shape":"Integer", - "documentation":"

The number of days to retain Performance Insights data.

" + "SubnetAvailabilityZone":{ + "shape":"AwsRdsDbSubnetGroupSubnetAvailabilityZone", + "documentation":"

Information about the Availability Zone for a subnet in the subnet group.

" }, - "EnabledCloudWatchLogsExports":{ + "SubnetStatus":{ + "shape":"NonEmptyString", + "documentation":"

The status of a subnet in the subnet group.

" + } + }, + "documentation":"

Information about a subnet in a subnet group.

" + }, + "AwsRdsDbSubnetGroupSubnetAvailabilityZone":{ + "type":"structure", + "members":{ + "Name":{ + "shape":"NonEmptyString", + "documentation":"

The name of the Availability Zone for a subnet in the subnet group.

" + } + }, + "documentation":"

An Availability Zone for a subnet in a subnet group.

" + }, + "AwsRdsDbSubnetGroupSubnets":{ + "type":"list", + "member":{"shape":"AwsRdsDbSubnetGroupSubnet"} + }, + "AwsRdsPendingCloudWatchLogsExports":{ + "type":"structure", + "members":{ + "LogTypesToEnable":{ "shape":"StringList", - "documentation":"

A list of log types that this DB instance is configured to export to CloudWatch Logs.

" - }, - "ProcessorFeatures":{ - "shape":"AwsRdsDbProcessorFeatures", - "documentation":"

The number of CPU cores and the number of threads per core for the DB instance class of the DB instance.

" + "documentation":"

A list of log types that are being enabled.

" }, - "ListenerEndpoint":{"shape":"AwsRdsDbInstanceEndpoint"}, - "MaxAllocatedStorage":{ - "shape":"Integer", - "documentation":"

The upper limit to which Amazon RDS can automatically scale the storage of the DB instance.

" + "LogTypesToDisable":{ + "shape":"StringList", + "documentation":"

A list of log types that are being disabled.

" } }, - "documentation":"

Contains the details of an Amazon RDS DB instance.

" + "documentation":"

Identifies the log types to enable and disable.

" }, - "AwsRdsDbInstanceEndpoint":{ + "AwsRedshiftClusterClusterNode":{ "type":"structure", "members":{ - "Address":{ + "NodeRole":{ "shape":"NonEmptyString", - "documentation":"

Specifies the DNS address of the DB instance.

" + "documentation":"

The role of the node. A node might be a leader node or a compute node.

" }, - "Port":{ - "shape":"Integer", - "documentation":"

Specifies the port that the database engine is listening on.

" + "PrivateIpAddress":{ + "shape":"NonEmptyString", + "documentation":"

The private IP address of the node.

" }, - "HostedZoneId":{ + "PublicIpAddress":{ "shape":"NonEmptyString", - "documentation":"

Specifies the ID that Amazon Route 53 assigns when you create a hosted zone.

" + "documentation":"

The public IP address of the node.

" } }, - "documentation":"

Specifies the connection endpoint.

" + "documentation":"

A node in an Amazon Redshift cluster.

" }, - "AwsRdsDbInstanceVpcSecurityGroup":{ + "AwsRedshiftClusterClusterNodes":{ + "type":"list", + "member":{"shape":"AwsRedshiftClusterClusterNode"} + }, + "AwsRedshiftClusterClusterParameterGroup":{ "type":"structure", "members":{ - "VpcSecurityGroupId":{ + "ClusterParameterStatusList":{ + "shape":"AwsRedshiftClusterClusterParameterStatusList", + "documentation":"

The list of parameter statuses.

" + }, + "ParameterApplyStatus":{ "shape":"NonEmptyString", - "documentation":"

The name of the VPC security group.

" + "documentation":"

The status of updates to the parameters.

" }, - "Status":{ + "ParameterGroupName":{ "shape":"NonEmptyString", - "documentation":"

The status of the VPC security group.

" + "documentation":"

The name of the parameter group.

" } }, - "documentation":"

A VPC security groups that the DB instance belongs to.

" + "documentation":"

A cluster parameter group that is associated with an Amazon Redshift cluster.

" }, - "AwsRdsDbInstanceVpcSecurityGroups":{ + "AwsRedshiftClusterClusterParameterGroups":{ "type":"list", - "member":{"shape":"AwsRdsDbInstanceVpcSecurityGroup"} + "member":{"shape":"AwsRedshiftClusterClusterParameterGroup"} }, - "AwsRdsDbOptionGroupMembership":{ + "AwsRedshiftClusterClusterParameterStatus":{ "type":"structure", "members":{ - "OptionGroupName":{ + "ParameterName":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The name of the parameter.

" }, - "Status":{ + "ParameterApplyStatus":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The status of the parameter. Indicates whether the parameter is in sync with the database, waiting for a cluster reboot, or encountered an error when it was applied.

Valid values: in-sync | pending-reboot | applying | invalid-parameter | apply-deferred | apply-error | unknown-error

" + }, + "ParameterApplyErrorDescription":{ + "shape":"NonEmptyString", + "documentation":"

The error that prevented the parameter from being applied to the database.

" } }, - "documentation":"

" + "documentation":"

The status of a parameter in a cluster parameter group for an Amazon Redshift cluster.

" }, - "AwsRdsDbOptionGroupMemberships":{ + "AwsRedshiftClusterClusterParameterStatusList":{ "type":"list", - "member":{"shape":"AwsRdsDbOptionGroupMembership"} + "member":{"shape":"AwsRedshiftClusterClusterParameterStatus"} }, - "AwsRdsDbParameterGroup":{ + "AwsRedshiftClusterClusterSecurityGroup":{ "type":"structure", "members":{ - "DbParameterGroupName":{ + "ClusterSecurityGroupName":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The name of the cluster security group.

" }, - "ParameterApplyStatus":{ + "Status":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The status of the cluster security group.

" } }, - "documentation":"

" + "documentation":"

A security group that is associated with the cluster.

" }, - "AwsRdsDbParameterGroups":{ + "AwsRedshiftClusterClusterSecurityGroups":{ "type":"list", - "member":{"shape":"AwsRdsDbParameterGroup"} + "member":{"shape":"AwsRedshiftClusterClusterSecurityGroup"} }, - "AwsRdsDbPendingModifiedValues":{ + "AwsRedshiftClusterClusterSnapshotCopyStatus":{ "type":"structure", "members":{ - "DbInstanceClass":{ - "shape":"NonEmptyString", - "documentation":"

" - }, - "AllocatedStorage":{ - "shape":"Integer", - "documentation":"

" - }, - "MasterUserPassword":{ + "DestinationRegion":{ "shape":"NonEmptyString", - "documentation":"

" - }, - "Port":{ - "shape":"Integer", - "documentation":"

" + "documentation":"

The destination Region that snapshots are automatically copied to when cross-Region snapshot copy is enabled.

" }, - "BackupRetentionPeriod":{ + "ManualSnapshotRetentionPeriod":{ "shape":"Integer", - "documentation":"

" - }, - "MultiAZ":{ - "shape":"Boolean", - "documentation":"

" - }, - "EngineVersion":{ - "shape":"NonEmptyString", - "documentation":"

" - }, - "LicenseModel":{ - "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The number of days that manual snapshots are retained in the destination region after they are copied from a source region.

If the value is -1, then the manual snapshot is retained indefinitely.

Valid values: Either -1 or an integer between 1 and 3,653

" }, - "Iops":{ + "RetentionPeriod":{ "shape":"Integer", - "documentation":"

" + "documentation":"

The number of days to retain automated snapshots in the destination Region after they are copied from a source Region.

" }, - "DbInstanceIdentifier":{ - "shape":"NonEmptyString", - "documentation":"

" - }, - "StorageType":{ - "shape":"NonEmptyString", - "documentation":"

" - }, - "CaCertificateIdentifier":{ - "shape":"NonEmptyString", - "documentation":"

" - }, - "DbSubnetGroupName":{ + "SnapshotCopyGrantName":{ "shape":"NonEmptyString", - "documentation":"

" - }, - "PendingCloudWatchLogsExports":{ - "shape":"AwsRdsPendingCloudWatchLogsExports", - "documentation":"

" - }, - "ProcessorFeatures":{ - "shape":"AwsRdsDbProcessorFeatures", - "documentation":"

" + "documentation":"

The name of the snapshot copy grant.

" } }, - "documentation":"

" + "documentation":"

Information about a cross-Region snapshot copy.

" }, - "AwsRdsDbProcessorFeature":{ + "AwsRedshiftClusterDeferredMaintenanceWindow":{ "type":"structure", "members":{ - "Name":{ + "DeferMaintenanceEndTime":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The end of the time window for which maintenance was deferred.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "Value":{ + "DeferMaintenanceIdentifier":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The identifier of the maintenance window.

" + }, + "DeferMaintenanceStartTime":{ + "shape":"NonEmptyString", + "documentation":"

The start of the time window for which maintenance was deferred.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" } }, - "documentation":"

" + "documentation":"

A time windows during which maintenance was deferred for an Amazon Redshift cluster.

" }, - "AwsRdsDbProcessorFeatures":{ + "AwsRedshiftClusterDeferredMaintenanceWindows":{ "type":"list", - "member":{"shape":"AwsRdsDbProcessorFeature"} + "member":{"shape":"AwsRedshiftClusterDeferredMaintenanceWindow"} }, - "AwsRdsDbSnapshotDetails":{ + "AwsRedshiftClusterDetails":{ "type":"structure", "members":{ - "DbSnapshotIdentifier":{ + "AllowVersionUpgrade":{ + "shape":"Boolean", + "documentation":"

Indicates whether major version upgrades are applied automatically to the cluster during the maintenance window.

" + }, + "AutomatedSnapshotRetentionPeriod":{ + "shape":"Integer", + "documentation":"

The number of days that automatic cluster snapshots are retained.

" + }, + "AvailabilityZone":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The name of the Availability Zone in which the cluster is located.

" }, - "DbInstanceIdentifier":{ + "ClusterAvailabilityStatus":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The availability status of the cluster for queries. Possible values are the following:

" }, - "SnapshotCreateTime":{ + "ClusterCreateTime":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

Indicates when the cluster was created.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "Engine":{ + "ClusterIdentifier":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The unique identifier of the cluster.

" }, - "AllocatedStorage":{ - "shape":"Integer", - "documentation":"

" + "ClusterNodes":{ + "shape":"AwsRedshiftClusterClusterNodes", + "documentation":"

The nodes in the cluster.

" }, - "Status":{ + "ClusterParameterGroups":{ + "shape":"AwsRedshiftClusterClusterParameterGroups", + "documentation":"

The list of cluster parameter groups that are associated with this cluster.

" + }, + "ClusterPublicKey":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The public key for the cluster.

" }, - "Port":{ - "shape":"Integer", - "documentation":"

" + "ClusterRevisionNumber":{ + "shape":"NonEmptyString", + "documentation":"

The specific revision number of the database in the cluster.

" }, - "AvailabilityZone":{ + "ClusterSecurityGroups":{ + "shape":"AwsRedshiftClusterClusterSecurityGroups", + "documentation":"

A list of cluster security groups that are associated with the cluster.

" + }, + "ClusterSnapshotCopyStatus":{ + "shape":"AwsRedshiftClusterClusterSnapshotCopyStatus", + "documentation":"

Information about the destination Region and retention period for the cross-Region snapshot copy.

" + }, + "ClusterStatus":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The current status of the cluster.

Valid values: available | available, prep-for-resize | available, resize-cleanup | cancelling-resize | creating | deleting | final-snapshot | hardware-failure | incompatible-hsm | incompatible-network | incompatible-parameters | incompatible-restore | modifying | paused | rebooting | renaming | resizing | rotating-keys | storage-full | updating-hsm

" }, - "VpcId":{ + "ClusterSubnetGroupName":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The name of the subnet group that is associated with the cluster. This parameter is valid only when the cluster is in a VPC.

" }, - "InstanceCreateTime":{ + "ClusterVersion":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The version ID of the Amazon Redshift engine that runs on the cluster.

" }, - "MasterUsername":{ + "DBName":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The name of the initial database that was created when the cluster was created.

The same name is returned for the life of the cluster.

If an initial database is not specified, a database named devdev is created by default.

" + }, + "DeferredMaintenanceWindows":{ + "shape":"AwsRedshiftClusterDeferredMaintenanceWindows", + "documentation":"

List of time windows during which maintenance was deferred.

" + }, + "ElasticIpStatus":{ + "shape":"AwsRedshiftClusterElasticIpStatus", + "documentation":"

Information about the status of the Elastic IP (EIP) address.

" + }, + "ElasticResizeNumberOfNodeOptions":{ + "shape":"NonEmptyString", + "documentation":"

The number of nodes that you can use the elastic resize method to resize the cluster to.

" + }, + "Encrypted":{ + "shape":"Boolean", + "documentation":"

Indicates whether the data in the cluster is encrypted at rest.

" + }, + "Endpoint":{ + "shape":"AwsRedshiftClusterEndpoint", + "documentation":"

The connection endpoint.

" + }, + "EnhancedVpcRouting":{ + "shape":"Boolean", + "documentation":"

Indicates whether to create the cluster with enhanced VPC routing enabled.

" }, - "EngineVersion":{ + "ExpectedNextSnapshotScheduleTime":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

Indicates when the next snapshot is expected to be taken. The cluster must have a valid snapshot schedule and have backups enabled.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "LicenseModel":{ + "ExpectedNextSnapshotScheduleTimeStatus":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The status of the next expected snapshot.

Valid values: OnTrack | Pending

" }, - "SnapshotType":{ - "shape":"NonEmptyString", - "documentation":"

" + "HsmStatus":{ + "shape":"AwsRedshiftClusterHsmStatus", + "documentation":"

Information about whether the Amazon Redshift cluster finished applying any changes to hardware security module (HSM) settings that were specified in a modify cluster command.

" }, - "Iops":{ - "shape":"Integer", - "documentation":"

" + "IamRoles":{ + "shape":"AwsRedshiftClusterIamRoles", + "documentation":"

A list of IAM roles that the cluster can use to access other AWS services.

" }, - "OptionGroupName":{ + "KmsKeyId":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The identifier of the AWS KMS encryption key that is used to encrypt data in the cluster.

" }, - "PercentProgress":{ + "MaintenanceTrackName":{ + "shape":"NonEmptyString", + "documentation":"

The name of the maintenance track for the cluster.

" + }, + "ManualSnapshotRetentionPeriod":{ "shape":"Integer", - "documentation":"

" + "documentation":"

The default number of days to retain a manual snapshot.

If the value is -1, the snapshot is retained indefinitely.

This setting doesn't change the retention period of existing snapshots.

Valid values: Either -1 or an integer between 1 and 3,653

" }, - "SourceRegion":{ + "MasterUsername":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The master user name for the cluster. This name is used to connect to the database that is specified in as the value of DBName.

" }, - "SourceDbSnapshotIdentifier":{ + "NextMaintenanceWindowStartTime":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

Indicates the start of the next maintenance window.

Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces. For example, 2020-03-22T13:22:13.933Z.

" }, - "StorageType":{ + "NodeType":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The node type for the nodes in the cluster.

" }, - "TdeCredentialArn":{ + "NumberOfNodes":{ + "shape":"Integer", + "documentation":"

The number of compute nodes in the cluster.

" + }, + "PendingActions":{ + "shape":"StringList", + "documentation":"

A list of cluster operations that are waiting to start.

" + }, + "PendingModifiedValues":{ + "shape":"AwsRedshiftClusterPendingModifiedValues", + "documentation":"

A list of changes to the cluster that are currently pending.

" + }, + "PreferredMaintenanceWindow":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The weekly time range, in Universal Coordinated Time (UTC), during which system maintenance can occur.

Format: <day>:HH:MM-<day>:HH:MM

For the day values, use mon | tue | wed | thu | fri | sat | sun

For example, sun:09:32-sun:10:02

" }, - "Encrypted":{ + "PubliclyAccessible":{ "shape":"Boolean", - "documentation":"

" + "documentation":"

Whether the cluster can be accessed from a public network.

" }, - "KmsKeyId":{ + "ResizeInfo":{ + "shape":"AwsRedshiftClusterResizeInfo", + "documentation":"

Information about the resize operation for the cluster.

" + }, + "RestoreStatus":{ + "shape":"AwsRedshiftClusterRestoreStatus", + "documentation":"

Information about the status of a cluster restore action. Only applies to a cluster that was created by restoring a snapshot.

" + }, + "SnapshotScheduleIdentifier":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

A unique identifier for the cluster snapshot schedule.

" }, - "Timezone":{ + "SnapshotScheduleState":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The current state of the cluster snapshot schedule.

Valid values: MODIFYING | ACTIVE | FAILED

" }, - "IamDatabaseAuthenticationEnabled":{ - "shape":"Boolean", - "documentation":"

" + "VpcId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the VPC that the cluster is in, if the cluster is in a VPC.

" }, - "ProcessorFeatures":{ - "shape":"AwsRdsDbProcessorFeatures", - "documentation":"

" + "VpcSecurityGroups":{ + "shape":"AwsRedshiftClusterVpcSecurityGroups", + "documentation":"

The list of VPC security groups that the cluster belongs to, if the cluster is in a VPC.

" + } + }, + "documentation":"

Details about an Amazon Redshift cluster.

" + }, + "AwsRedshiftClusterElasticIpStatus":{ + "type":"structure", + "members":{ + "ElasticIp":{ + "shape":"NonEmptyString", + "documentation":"

The elastic IP address for the cluster.

" }, - "DbiResourceId":{ + "Status":{ "shape":"NonEmptyString", - "documentation":"

" + "documentation":"

The status of the elastic IP address.

" } }, - "documentation":"

" + "documentation":"

The status of the elastic IP (EIP) address for an Amazon Redshift cluster.

" }, - "AwsRdsDbStatusInfo":{ + "AwsRedshiftClusterEndpoint":{ "type":"structure", "members":{ - "StatusType":{ + "Address":{ "shape":"NonEmptyString", - "documentation":"

The type of status. For a read replica, the status type is read replication.

" + "documentation":"

The DNS address of the cluster.

" }, - "Normal":{ - "shape":"Boolean", - "documentation":"

Whether the read replica instance is operating normally.

" + "Port":{ + "shape":"Integer", + "documentation":"

The port that the database engine listens on.

" + } + }, + "documentation":"

The connection endpoint for an Amazon Redshift cluster.

" + }, + "AwsRedshiftClusterHsmStatus":{ + "type":"structure", + "members":{ + "HsmClientCertificateIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The name of the HSM client certificate that the Amazon Redshift cluster uses to retrieve the data encryption keys that are stored in an HSM.

" + }, + "HsmConfigurationIdentifier":{ + "shape":"NonEmptyString", + "documentation":"

The name of the HSM configuration that contains the information that the Amazon Redshift cluster can use to retrieve and store keys in an HSM.

" }, "Status":{ "shape":"NonEmptyString", - "documentation":"

The status of the read replica instance.

" + "documentation":"

Indicates whether the Amazon Redshift cluster has finished applying any HSM settings changes specified in a modify cluster command.

Type: String

Valid values: active | applying

" + } + }, + "documentation":"

Information about whether an Amazon Redshift cluster finished applying any hardware changes to security module (HSM) settings that were specified in a modify cluster command.

" + }, + "AwsRedshiftClusterIamRole":{ + "type":"structure", + "members":{ + "ApplyStatus":{ + "shape":"NonEmptyString", + "documentation":"

The status of the IAM role's association with the cluster.

Valid values: in-sync | adding | removing

" }, - "Message":{ + "IamRoleArn":{ "shape":"NonEmptyString", - "documentation":"

If the read replica is currently in an error state, provides the error details.

" + "documentation":"

The ARN of the IAM role.

" } }, - "documentation":"

Information about the status of a read replica.

" + "documentation":"

An IAM role that the cluster can use to access other AWS services.

" }, - "AwsRdsDbStatusInfos":{ + "AwsRedshiftClusterIamRoles":{ "type":"list", - "member":{"shape":"AwsRdsDbStatusInfo"} + "member":{"shape":"AwsRedshiftClusterIamRole"} }, - "AwsRdsDbSubnetGroup":{ + "AwsRedshiftClusterPendingModifiedValues":{ "type":"structure", "members":{ - "DbSubnetGroupName":{ + "AutomatedSnapshotRetentionPeriod":{ + "shape":"Integer", + "documentation":"

The pending or in-progress change to the automated snapshot retention period.

" + }, + "ClusterIdentifier":{ "shape":"NonEmptyString", - "documentation":"

The name of the subnet group.

" + "documentation":"

The pending or in-progress change to the identifier for the cluster.

" }, - "DbSubnetGroupDescription":{ + "ClusterType":{ "shape":"NonEmptyString", - "documentation":"

The description of the subnet group.

" + "documentation":"

The pending or in-progress change to the cluster type.

" }, - "VpcId":{ + "ClusterVersion":{ "shape":"NonEmptyString", - "documentation":"

The VPC ID of the subnet group.

" + "documentation":"

The pending or in-progress change to the service version.

" }, - "SubnetGroupStatus":{ + "EncryptionType":{ "shape":"NonEmptyString", - "documentation":"

The status of the subnet group.

" + "documentation":"

The encryption type for a cluster.

" }, - "Subnets":{ - "shape":"AwsRdsDbSubnetGroupSubnets", - "documentation":"

A list of subnets in the subnet group.

" + "EnhancedVpcRouting":{ + "shape":"Boolean", + "documentation":"

Indicates whether to create the cluster with enhanced VPC routing enabled.

" }, - "DbSubnetGroupArn":{ + "MaintenanceTrackName":{ "shape":"NonEmptyString", - "documentation":"

The ARN of the subnet group.

" + "documentation":"

The name of the maintenance track that the cluster changes to during the next maintenance window.

" + }, + "MasterUserPassword":{ + "shape":"NonEmptyString", + "documentation":"

The pending or in-progress change to the master user password for the cluster.

" + }, + "NodeType":{ + "shape":"NonEmptyString", + "documentation":"

The pending or in-progress change to the cluster's node type.

" + }, + "NumberOfNodes":{ + "shape":"Integer", + "documentation":"

The pending or in-progress change to the number of nodes in the cluster.

" + }, + "PubliclyAccessible":{ + "shape":"Boolean", + "documentation":"

The pending or in-progress change to whether the cluster can be connected to from the public network.

" } }, - "documentation":"

Information about the subnet group for the database instance.

" + "documentation":"

Changes to the Amazon Redshift cluster that are currently pending.

" }, - "AwsRdsDbSubnetGroupSubnet":{ + "AwsRedshiftClusterResizeInfo":{ "type":"structure", "members":{ - "SubnetIdentifier":{ - "shape":"NonEmptyString", - "documentation":"

The identifier of a subnet in the subnet group.

" - }, - "SubnetAvailabilityZone":{ - "shape":"AwsRdsDbSubnetGroupSubnetAvailabilityZone", - "documentation":"

Information about the Availability Zone for a subnet in the subnet group.

" + "AllowCancelResize":{ + "shape":"Boolean", + "documentation":"

Indicates whether the resize operation can be canceled.

" }, - "SubnetStatus":{ + "ResizeType":{ "shape":"NonEmptyString", - "documentation":"

The status of a subnet in the subnet group.

" + "documentation":"

The type of resize operation.

Valid values: ClassicResize

" } }, - "documentation":"

Information about a subnet in a subnet group.

" + "documentation":"

Information about the resize operation for the cluster.

" }, - "AwsRdsDbSubnetGroupSubnetAvailabilityZone":{ + "AwsRedshiftClusterRestoreStatus":{ "type":"structure", "members":{ - "Name":{ + "CurrentRestoreRateInMegaBytesPerSecond":{ + "shape":"Double", + "documentation":"

The number of megabytes per second being transferred from the backup storage. Returns the average rate for a completed backup.

This field is only updated when you restore to DC2 and DS2 node types.

" + }, + "ElapsedTimeInSeconds":{ + "shape":"Long", + "documentation":"

The amount of time an in-progress restore has been running, or the amount of time it took a completed restore to finish.

This field is only updated when you restore to DC2 and DS2 node types.

" + }, + "EstimatedTimeToCompletionInSeconds":{ + "shape":"Long", + "documentation":"

The estimate of the time remaining before the restore is complete. Returns 0 for a completed restore.

This field is only updated when you restore to DC2 and DS2 node types.

" + }, + "ProgressInMegaBytes":{ + "shape":"Long", + "documentation":"

The number of megabytes that were transferred from snapshot storage.

This field is only updated when you restore to DC2 and DS2 node types.

" + }, + "SnapshotSizeInMegaBytes":{ + "shape":"Long", + "documentation":"

The size of the set of snapshot data that was used to restore the cluster.

This field is only updated when you restore to DC2 and DS2 node types.

" + }, + "Status":{ "shape":"NonEmptyString", - "documentation":"

The name of the Availability Zone for a subnet in the subnet group.

" + "documentation":"

The status of the restore action.

Valid values: starting | restoring | completed | failed

" } }, - "documentation":"

An Availability Zone for a subnet in a subnet group.

" - }, - "AwsRdsDbSubnetGroupSubnets":{ - "type":"list", - "member":{"shape":"AwsRdsDbSubnetGroupSubnet"} + "documentation":"

Information about the status of a cluster restore action. It only applies if the cluster was created by restoring a snapshot.

" }, - "AwsRdsPendingCloudWatchLogsExports":{ + "AwsRedshiftClusterVpcSecurityGroup":{ "type":"structure", "members":{ - "LogTypesToEnable":{ - "shape":"StringList", - "documentation":"

A list of log types that are being enabled.

" + "Status":{ + "shape":"NonEmptyString", + "documentation":"

The status of the VPC security group.

" }, - "LogTypesToDisable":{ - "shape":"StringList", - "documentation":"

A list of log types that are being disabled.

" + "VpcSecurityGroupId":{ + "shape":"NonEmptyString", + "documentation":"

The identifier of the VPC security group.

" } }, - "documentation":"

Identifies the log types to enable and disable.

" + "documentation":"

A VPC security group that the cluster belongs to, if the cluster is in a VPC.

" + }, + "AwsRedshiftClusterVpcSecurityGroups":{ + "type":"list", + "member":{"shape":"AwsRedshiftClusterVpcSecurityGroup"} }, "AwsS3BucketDetails":{ "type":"structure", @@ -3994,7 +5882,7 @@ "documentation":"

A keyword for a finding.

" } }, - "documentation":"

A collection of attributes that are applied to all active Security Hub-aggregated findings and that result in a subset of findings that are included in this insight.

" + "documentation":"

A collection of attributes that are applied to all active Security Hub-aggregated findings and that result in a subset of findings that are included in this insight.

You can filter by up to 10 finding attributes. For each attribute, you can provide up to 20 filter values.

" }, "AwsSecurityFindingIdentifier":{ "type":"structure", @@ -4445,10 +6333,11 @@ }, "CreateMembersRequest":{ "type":"structure", + "required":["AccountDetails"], "members":{ "AccountDetails":{ "shape":"AccountDetailsList", - "documentation":"

The list of accounts to associate with the Security Hub master account. For each account, the list includes the account ID and the email address.

" + "documentation":"

The list of accounts to associate with the Security Hub master account. For each account, the list includes the account ID and optionally the email address.

" } } }, @@ -4461,6 +6350,11 @@ } } }, + "CrossAccountMaxResults":{ + "type":"integer", + "max":50, + "min":1 + }, "Cvss":{ "type":"structure", "members":{ @@ -4607,6 +6501,7 @@ }, "DeleteMembersRequest":{ "type":"structure", + "required":["AccountIds"], "members":{ "AccountIds":{ "shape":"AccountIdList", @@ -4682,6 +6577,24 @@ } } }, + "DescribeOrganizationConfigurationRequest":{ + "type":"structure", + "members":{ + } + }, + "DescribeOrganizationConfigurationResponse":{ + "type":"structure", + "members":{ + "AutoEnable":{ + "shape":"Boolean", + "documentation":"

Whether to automatically enable Security Hub for new accounts in the organization.

If set to true, then Security Hub is enabled for new accounts. If set to false, then new accounts are not added automatically.

" + }, + "MemberAccountLimitReached":{ + "shape":"Boolean", + "documentation":"

Whether the maximum number of allowed member accounts are already associated with the Security Hub administrator account.

" + } + } + }, "DescribeProductsRequest":{ "type":"structure", "members":{ @@ -4719,7 +6632,7 @@ "members":{ "StandardsSubscriptionArn":{ "shape":"NonEmptyString", - "documentation":"

The ARN of a resource that represents your subscription to a supported standard.

", + "documentation":"

The ARN of a resource that represents your subscription to a supported standard. To get the subscription ARNs of the standards you have enabled, use the GetEnabledStandards operation.

", "location":"uri", "locationName":"StandardsSubscriptionArn" }, @@ -4797,6 +6710,21 @@ "members":{ } }, + "DisableOrganizationAdminAccountRequest":{ + "type":"structure", + "required":["AdminAccountId"], + "members":{ + "AdminAccountId":{ + "shape":"NonEmptyString", + "documentation":"

The AWS account identifier of the Security Hub administrator account.

" + } + } + }, + "DisableOrganizationAdminAccountResponse":{ + "type":"structure", + "members":{ + } + }, "DisableSecurityHubRequest":{ "type":"structure", "members":{ @@ -4819,6 +6747,7 @@ }, "DisassociateMembersRequest":{ "type":"structure", + "required":["AccountIds"], "members":{ "AccountIds":{ "shape":"AccountIdList", @@ -4851,6 +6780,21 @@ } } }, + "EnableOrganizationAdminAccountRequest":{ + "type":"structure", + "required":["AdminAccountId"], + "members":{ + "AdminAccountId":{ + "shape":"NonEmptyString", + "documentation":"

The AWS account identifier of the account to designate as the Security Hub administrator account.

" + } + } + }, + "EnableOrganizationAdminAccountResponse":{ + "type":"structure", + "members":{ + } + }, "EnableSecurityHubRequest":{ "type":"structure", "members":{ @@ -4909,7 +6853,7 @@ "members":{ "Filters":{ "shape":"AwsSecurityFindingFilters", - "documentation":"

The finding attributes used to define a condition to filter the returned findings.

Note that in the available filter fields, WorkflowState is deprecated. To search for a finding based on its workflow status, use WorkflowStatus.

" + "documentation":"

The finding attributes used to define a condition to filter the returned findings.

You can filter by up to 10 finding attributes. For each attribute, you can provide up to 20 filter values.

Note that in the available filter fields, WorkflowState is deprecated. To search for a finding based on its workflow status, use WorkflowStatus.

" }, "SortCriteria":{ "shape":"SortCriteria", @@ -5175,7 +7119,7 @@ "Message":{"shape":"NonEmptyString"}, "Code":{"shape":"NonEmptyString"} }, - "documentation":"

AWS Security Hub isn't enabled for the account used to make this request.

", + "documentation":"

There is an issue with the account used to make the request. Either Security Hub is not enabled for the account, or the account does not have permission to perform this action.

", "error":{"httpStatusCode":401}, "exception":true }, @@ -5217,6 +7161,7 @@ }, "InviteMembersRequest":{ "type":"structure", + "required":["AccountIds"], "members":{ "AccountIds":{ "shape":"AccountIdList", @@ -5289,7 +7234,7 @@ "Message":{"shape":"NonEmptyString"}, "Code":{"shape":"NonEmptyString"} }, - "documentation":"

The request was rejected because it attempted to create resources beyond the current AWS account limits. The error code describes the limit exceeded.

", + "documentation":"

The request was rejected because it attempted to create resources beyond the current AWS account or throttling limits. The error code describes the limit exceeded.

", "error":{"httpStatusCode":429}, "exception":true }, @@ -5327,7 +7272,7 @@ "type":"structure", "members":{ "MaxResults":{ - "shape":"MaxResults", + "shape":"CrossAccountMaxResults", "documentation":"

The maximum number of items to return in the response.

", "location":"querystring", "locationName":"MaxResults" @@ -5358,12 +7303,12 @@ "members":{ "OnlyAssociated":{ "shape":"Boolean", - "documentation":"

Specifies which member accounts to include in the response based on their relationship status with the master account. The default value is TRUE.

If OnlyAssociated is set to TRUE, the response includes member accounts whose relationship status with the master is set to ENABLED or DISABLED.

If OnlyAssociated is set to FALSE, the response includes all existing member accounts.

", + "documentation":"

Specifies which member accounts to include in the response based on their relationship status with the master account. The default value is TRUE.

If OnlyAssociated is set to TRUE, the response includes member accounts whose relationship status with the master is set to ENABLED.

If OnlyAssociated is set to FALSE, the response includes all existing member accounts.

", "location":"querystring", "locationName":"OnlyAssociated" }, "MaxResults":{ - "shape":"MaxResults", + "shape":"CrossAccountMaxResults", "documentation":"

The maximum number of items to return in the response.

", "location":"querystring", "locationName":"MaxResults" @@ -5389,6 +7334,36 @@ } } }, + "ListOrganizationAdminAccountsRequest":{ + "type":"structure", + "members":{ + "MaxResults":{ + "shape":"AdminsMaxResults", + "documentation":"

The maximum number of items to return in the response.

", + "location":"querystring", + "locationName":"MaxResults" + }, + "NextToken":{ + "shape":"NextToken", + "documentation":"

The token that is required for pagination. On your first call to the ListOrganizationAdminAccounts operation, set the value of this parameter to NULL. For subsequent calls to the operation, to continue listing data, set the value of this parameter to the value returned from the previous response.

", + "location":"querystring", + "locationName":"NextToken" + } + } + }, + "ListOrganizationAdminAccountsResponse":{ + "type":"structure", + "members":{ + "AdminAccounts":{ + "shape":"AdminAccounts", + "documentation":"

The list of Security Hub administrator accounts.

" + }, + "NextToken":{ + "shape":"NextToken", + "documentation":"

The pagination token to use to request the next page of results.

" + } + } + }, "ListTagsForResourceRequest":{ "type":"structure", "required":["ResourceArn"], @@ -5424,6 +7399,7 @@ }, "documentation":"

Information about the state of the load balancer.

" }, + "Long":{"type":"long"}, "Malware":{ "type":"structure", "required":["Name"], @@ -5530,7 +7506,7 @@ }, "MemberStatus":{ "shape":"NonEmptyString", - "documentation":"

The status of the relationship between the member account and its master account.

" + "documentation":"

The status of the relationship between the member account and its master account.

The status can have one of the following values:

" }, "InvitedAt":{ "shape":"Timestamp", @@ -5776,7 +7752,7 @@ }, "InstalledPendingReboot":{ "shape":"Integer", - "documentation":"

The number of patches that were installed since the last time the instance was rebooted.

" + "documentation":"

The number of patches that were applied, but that require the instance to be rebooted in order to be marked as installed.

" }, "OperationStartTime":{ "shape":"NonEmptyString", @@ -5981,6 +7957,10 @@ "shape":"NonEmptyString", "documentation":"

The canonical AWS external Region name where this resource is located.

" }, + "ResourceRole":{ + "shape":"NonEmptyString", + "documentation":"

" + }, "Tags":{ "shape":"FieldMap", "documentation":"

A list of AWS tags associated with a resource at the time the finding was processed.

" @@ -6077,10 +8057,46 @@ "shape":"AwsIamPolicyDetails", "documentation":"

Details about an IAM permissions policy.

" }, + "AwsApiGatewayV2Stage":{ + "shape":"AwsApiGatewayV2StageDetails", + "documentation":"

" + }, + "AwsApiGatewayV2Api":{ + "shape":"AwsApiGatewayV2ApiDetails", + "documentation":"

" + }, "AwsDynamoDbTable":{ "shape":"AwsDynamoDbTableDetails", "documentation":"

Details about a DynamoDB table.

" }, + "AwsApiGatewayStage":{ + "shape":"AwsApiGatewayStageDetails", + "documentation":"

" + }, + "AwsApiGatewayRestApi":{ + "shape":"AwsApiGatewayRestApiDetails", + "documentation":"

" + }, + "AwsCloudTrailTrail":{ + "shape":"AwsCloudTrailTrailDetails", + "documentation":"

" + }, + "AwsCertificateManagerCertificate":{ + "shape":"AwsCertificateManagerCertificateDetails", + "documentation":"

" + }, + "AwsRedshiftCluster":{ + "shape":"AwsRedshiftClusterDetails", + "documentation":"

" + }, + "AwsElbLoadBalancer":{ + "shape":"AwsElbLoadBalancerDetails", + "documentation":"

" + }, + "AwsIamGroup":{ + "shape":"AwsIamGroupDetails", + "documentation":"

" + }, "AwsIamRole":{ "shape":"AwsIamRoleDetails", "documentation":"

Details about an IAM role.

" @@ -6192,7 +8208,7 @@ "documentation":"

The native severity from the finding product that generated the finding.

" } }, - "documentation":"

The severity of the finding.

The finding provider can provide the initial severity, but cannot update it after that. The severity can only be updated by a master account. It cannot be updated by a member account.

The finding must have either Label or Normalized populated. If only one of these attributes is populated, then Security Hub automatically populates the other one. If neither attribute is populated, then the finding is invalid. Label is the preferred attribute.

" + "documentation":"

The severity of the finding.

The finding provider can provide the initial severity. The finding provider can only update the severity if it has not been updated using BatchUpdateFindings.

The finding must have either Label or Normalized populated. If only one of these attributes is populated, then Security Hub automatically populates the other one. If neither attribute is populated, then the finding is invalid. Label is the preferred attribute.

" }, "SeverityLabel":{ "type":"string", @@ -6706,6 +8722,21 @@ "members":{ } }, + "UpdateOrganizationConfigurationRequest":{ + "type":"structure", + "required":["AutoEnable"], + "members":{ + "AutoEnable":{ + "shape":"Boolean", + "documentation":"

Whether to automatically enable Security Hub for new accounts in the organization.

By default, this is false, and new accounts are not added automatically.

To automatically enable Security Hub for new accounts, set this to true.

" + } + } + }, + "UpdateOrganizationConfigurationResponse":{ + "type":"structure", + "members":{ + } + }, "UpdateSecurityHubConfigurationRequest":{ "type":"structure", "members":{ @@ -6892,5 +8923,5 @@ "documentation":"

Used to update information about the investigation into the finding.

" } }, - "documentation":"

Security Hub provides you with a comprehensive view of the security state of your AWS environment and resources. It also provides you with the readiness status of your environment based on controls from supported security standards. Security Hub collects security data from AWS accounts, services, and integrated third-party products and helps you analyze security trends in your environment to identify the highest priority security issues. For more information about Security Hub, see the AWS Security Hub User Guide .

When you use operations in the Security Hub API, the requests are executed only in the AWS Region that is currently active or in the specific AWS Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, execute the same command for each Region to apply the change to.

For example, if your Region is set to us-west-2, when you use CreateMembers to add a member account to Security Hub, the association of the member account with the master account is created only in the us-west-2 Region. Security Hub must be enabled for the member account in the same Region that the invitation was sent from.

The following throttling limits apply to using Security Hub API operations.

" + "documentation":"

Security Hub provides you with a comprehensive view of the security state of your AWS environment and resources. It also provides you with the readiness status of your environment based on controls from supported security standards. Security Hub collects security data from AWS accounts, services, and integrated third-party products and helps you analyze security trends in your environment to identify the highest priority security issues. For more information about Security Hub, see the AWS Security Hub User Guide .

When you use operations in the Security Hub API, the requests are executed only in the AWS Region that is currently active or in the specific AWS Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, execute the same command for each Region to apply the change to.

For example, if your Region is set to us-west-2, when you use CreateMembers to add a member account to Security Hub, the association of the member account with the master account is created only in the us-west-2 Region. Security Hub must be enabled for the member account in the same Region that the invitation was sent from.

The following throttling limits apply to using Security Hub API operations.

" }