intermediate changes

ref:c6c605abd3c8b1fa68acc3979963dd20d25ea2d8

21 files changed, 5341 insertions, 156 deletions

diff --git a/contrib/python/boto3/py3/.dist-info/METADATA b/contrib/python/boto3/py3/.dist-info/METADATA
index 17bf40ce9c..1661bad5b5 100644
--- a/contrib/python/boto3/py3/.dist-info/METADATA
+++ b/contrib/python/boto3/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boto3
-Version: 1.24.8
+Version: 1.24.11
 Summary: The AWS SDK for Python
 Home-page: https://github.com/boto/boto3
 Author: Amazon Web Services
@@ -21,7 +21,7 @@ Classifier: Programming Language :: Python :: 3.10
 Requires-Python: >= 3.7
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: botocore (<1.28.0,>=1.27.8)
+Requires-Dist: botocore (<1.28.0,>=1.27.11)
 Requires-Dist: jmespath (<2.0.0,>=0.7.1)
 Requires-Dist: s3transfer (<0.7.0,>=0.6.0)
 Provides-Extra: crt
diff --git a/contrib/python/boto3/py3/boto3/__init__.py b/contrib/python/boto3/py3/boto3/__init__.py
index c554e832b8..39c9d4492e 100644
--- a/contrib/python/boto3/py3/boto3/__init__.py
+++ b/contrib/python/boto3/py3/boto3/__init__.py
@@ -17,7 +17,7 @@ from boto3.compat import _warn_deprecated_python
 from boto3.session import Session
 
 __author__ = 'Amazon Web Services'
-__version__ = '1.24.8'
+__version__ = '1.24.11'
 
 
 # The default Boto3 session; autoloaded when needed.
diff --git a/contrib/python/botocore/py3/.dist-info/METADATA b/contrib/python/botocore/py3/.dist-info/METADATA
index 8e3985f355..175ab98e29 100644
--- a/contrib/python/botocore/py3/.dist-info/METADATA
+++ b/contrib/python/botocore/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: botocore
-Version: 1.27.8
+Version: 1.27.11
 Summary: Low-level, data-driven core of boto 3.
 Home-page: https://github.com/boto/botocore
 Author: Amazon Web Services
diff --git a/contrib/python/botocore/py3/botocore/__init__.py b/contrib/python/botocore/py3/botocore/__init__.py
index 49cd8d984c..f631b137b6 100644
--- a/contrib/python/botocore/py3/botocore/__init__.py
+++ b/contrib/python/botocore/py3/botocore/__init__.py
@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.27.8'
+__version__ = '1.27.11'
 
 
 class NullHandler(logging.Handler):
diff --git a/contrib/python/botocore/py3/botocore/config.py b/contrib/python/botocore/py3/botocore/config.py
index 0187fca765..9cd1025144 100644
--- a/contrib/python/botocore/py3/botocore/config.py
+++ b/contrib/python/botocore/py3/botocore/config.py
@@ -276,11 +276,14 @@ class Config:
                 )
 
     def _validate_retry_configuration(self, retries):
+        valid_options = ('max_attempts', 'mode', 'total_max_attempts')
+        valid_modes = ('legacy', 'standard', 'adaptive')
         if retries is not None:
             for key, value in retries.items():
-                if key not in ['max_attempts', 'mode', 'total_max_attempts']:
+                if key not in valid_options:
                     raise InvalidRetryConfigurationError(
-                        retry_config_option=key
+                        retry_config_option=key,
+                        valid_options=valid_options,
                     )
                 if key == 'max_attempts' and value < 0:
                     raise InvalidMaxRetryAttemptsError(
@@ -292,12 +295,11 @@ class Config:
                         provided_max_attempts=value,
                         min_value=1,
                     )
-                if key == 'mode' and value not in (
-                    'legacy',
-                    'standard',
-                    'adaptive',
-                ):
-                    raise InvalidRetryModeError(provided_retry_mode=value)
+                if key == 'mode' and value not in valid_modes:
+                    raise InvalidRetryModeError(
+                        provided_retry_mode=value,
+                        valid_modes=valid_modes,
+                    )
 
     def merge(self, other_config):
         """Merges the config object with another config object
diff --git a/contrib/python/botocore/py3/botocore/data/budgets/2016-10-20/service-2.json b/contrib/python/botocore/py3/botocore/data/budgets/2016-10-20/service-2.json
index 4fe71ec03c..ca7cbd0335 100644
--- a/contrib/python/botocore/py3/botocore/data/budgets/2016-10-20/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/budgets/2016-10-20/service-2.json
@@ -26,7 +26,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"CreationLimitExceededException"},
         {"shape":"DuplicateRecordException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Creates a budget and, if included, notifications and subscribers. </p> <important> <p>Only one of <code>BudgetLimit</code> or <code>PlannedBudgetLimits</code> can be present in the syntax at one time. Use the syntax that matches your case. The Request Syntax section shows the <code>BudgetLimit</code> syntax. For <code>PlannedBudgetLimits</code>, see the <a href=\"https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_CreateBudget.html#API_CreateBudget_Examples\">Examples</a> section. </p> </important>"
     },
@@ -44,7 +45,8 @@
         {"shape":"CreationLimitExceededException"},
         {"shape":"DuplicateRecordException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Creates a budget action. </p>"
     },
@@ -62,7 +64,8 @@
         {"shape":"NotFoundException"},
         {"shape":"CreationLimitExceededException"},
         {"shape":"DuplicateRecordException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Creates a notification. You must create the budget before you create the associated notification.</p>"
     },
@@ -80,7 +83,8 @@
         {"shape":"CreationLimitExceededException"},
         {"shape":"DuplicateRecordException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Creates a subscriber. You must create the associated budget and notification before you create the subscriber.</p>"
     },
@@ -96,7 +100,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Deletes a budget. You can delete your budget at any time.</p> <important> <p>Deleting a budget also deletes the notifications and subscribers that are associated with that budget.</p> </important>"
     },
@@ -113,7 +118,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"AccessDeniedException"},
-        {"shape":"ResourceLockedException"}
+        {"shape":"ResourceLockedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Deletes a budget action. </p>"
     },
@@ -129,7 +135,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"InternalErrorException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Deletes a notification.</p> <important> <p>Deleting a notification also deletes the subscribers that are associated with the notification.</p> </important>"
     },
@@ -145,7 +152,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Deletes a subscriber.</p> <important> <p>Deleting the last subscriber to a notification also deletes the notification.</p> </important>"
     },
@@ -161,7 +169,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Describes a budget.</p> <important> <p>The Request Syntax section shows the <code>BudgetLimit</code> syntax. For <code>PlannedBudgetLimits</code>, see the <a href=\"https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_DescribeBudget.html#API_DescribeBudget_Examples\">Examples</a> section. </p> </important>"
     },
@@ -177,7 +186,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Describes a budget action detail. </p>"
     },
@@ -194,7 +204,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"AccessDeniedException"},
-        {"shape":"InvalidNextTokenException"}
+        {"shape":"InvalidNextTokenException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Describes a budget action history detail. </p>"
     },
@@ -210,7 +221,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"InvalidParameterException"},
         {"shape":"AccessDeniedException"},
-        {"shape":"InvalidNextTokenException"}
+        {"shape":"InvalidNextTokenException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Describes all of the budget actions for an account. </p>"
     },
@@ -227,7 +239,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"AccessDeniedException"},
-        {"shape":"InvalidNextTokenException"}
+        {"shape":"InvalidNextTokenException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Describes all of the budget actions for a budget. </p>"
     },
@@ -245,7 +258,8 @@
         {"shape":"NotFoundException"},
         {"shape":"InvalidNextTokenException"},
         {"shape":"ExpiredNextTokenException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Lists the budget names and notifications that are associated with an account. </p>"
     },
@@ -263,7 +277,8 @@
         {"shape":"NotFoundException"},
         {"shape":"InvalidNextTokenException"},
         {"shape":"ExpiredNextTokenException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Describes the history for <code>DAILY</code>, <code>MONTHLY</code>, and <code>QUARTERLY</code> budgets. Budget history isn't available for <code>ANNUAL</code> budgets.</p>"
     },
@@ -281,7 +296,8 @@
         {"shape":"NotFoundException"},
         {"shape":"InvalidNextTokenException"},
         {"shape":"ExpiredNextTokenException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Lists the budgets that are associated with an account.</p> <important> <p>The Request Syntax section shows the <code>BudgetLimit</code> syntax. For <code>PlannedBudgetLimits</code>, see the <a href=\"https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_DescribeBudgets.html#API_DescribeBudgets_Examples\">Examples</a> section. </p> </important>"
     },
@@ -299,7 +315,8 @@
         {"shape":"NotFoundException"},
         {"shape":"InvalidNextTokenException"},
         {"shape":"ExpiredNextTokenException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Lists the notifications that are associated with a budget.</p>"
     },
@@ -317,7 +334,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"InvalidNextTokenException"},
         {"shape":"ExpiredNextTokenException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Lists the subscribers that are associated with a notification.</p>"
     },
@@ -334,7 +352,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"AccessDeniedException"},
-        {"shape":"ResourceLockedException"}
+        {"shape":"ResourceLockedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Executes a budget action. </p>"
     },
@@ -350,7 +369,8 @@
         {"shape":"InternalErrorException"},
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Updates a budget. You can change every part of a budget except for the <code>budgetName</code> and the <code>calculatedSpend</code>. When you modify a budget, the <code>calculatedSpend</code> drops to zero until Amazon Web Services has new usage data to use for forecasting.</p> <important> <p>Only one of <code>BudgetLimit</code> or <code>PlannedBudgetLimits</code> can be present in the syntax at one time. Use the syntax that matches your case. The Request Syntax section shows the <code>BudgetLimit</code> syntax. For <code>PlannedBudgetLimits</code>, see the <a href=\"https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_UpdateBudget.html#API_UpdateBudget_Examples\">Examples</a> section. </p> </important>"
     },
@@ -367,7 +387,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"AccessDeniedException"},
-        {"shape":"ResourceLockedException"}
+        {"shape":"ResourceLockedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p> Updates a budget action. </p>"
     },
@@ -384,7 +405,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"DuplicateRecordException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Updates a notification.</p>"
     },
@@ -401,7 +423,8 @@
         {"shape":"InvalidParameterException"},
         {"shape":"NotFoundException"},
         {"shape":"DuplicateRecordException"},
-        {"shape":"AccessDeniedException"}
+        {"shape":"AccessDeniedException"},
+        {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>Updates a subscriber.</p>"
     }
@@ -1414,9 +1437,15 @@
       },
       "documentation":"<p> Response of DescribeSubscribersForNotification </p>"
     },
+    "DimensionValue":{
+      "type":"string",
+      "max":2147483647,
+      "min":0,
+      "pattern":"[\\S\\s]*"
+    },
     "DimensionValues":{
       "type":"list",
-      "member":{"shape":"GenericString"}
+      "member":{"shape":"DimensionValue"}
     },
     "DuplicateRecordException":{
       "type":"structure",
@@ -1874,6 +1903,14 @@
         "ABSOLUTE_VALUE"
       ]
     },
+    "ThrottlingException":{
+      "type":"structure",
+      "members":{
+        "Message":{"shape":"errorMessage"}
+      },
+      "documentation":"<p> The number of API requests has exceeded the maximum allowed API request throttling limit for the account. </p>",
+      "exception":true
+    },
     "TimePeriod":{
       "type":"structure",
       "members":{
@@ -2068,5 +2105,5 @@
       "documentation":"<p>The error message the exception carries.</p>"
     }
   },
-  "documentation":"<p>The Amazon Web Services Budgets API enables you to use Amazon Web Services Budgets to plan your service usage, service costs, and instance reservations. The API reference provides descriptions, syntax, and usage examples for each of the actions and data types for Amazon Web Services Budgets. </p> <p>Budgets provide you with a way to see the following information:</p> <ul> <li> <p>How close your plan is to your budgeted amount or to the free tier limits</p> </li> <li> <p>Your usage-to-date, including how much you've used of your Reserved Instances (RIs)</p> </li> <li> <p>Your current estimated charges from Amazon Web Services, and how much your predicted usage will accrue in charges by the end of the month</p> </li> <li> <p>How much of your budget has been used</p> </li> </ul> <p>Amazon Web Services updates your budget status several times a day. Budgets track your unblended costs, subscriptions, refunds, and RIs. You can create the following types of budgets:</p> <ul> <li> <p> <b>Cost budgets</b> - Plan how much you want to spend on a service.</p> </li> <li> <p> <b>Usage budgets</b> - Plan how much you want to use one or more services.</p> </li> <li> <p> <b>RI utilization budgets</b> - Define a utilization threshold, and receive alerts when your RI usage falls below that threshold. This lets you see if your RIs are unused or under-utilized.</p> </li> <li> <p> <b>RI coverage budgets</b> - Define a coverage threshold, and receive alerts when the number of your instance hours that are covered by RIs fall below that threshold. This lets you see how much of your instance usage is covered by a reservation.</p> </li> </ul> <p>Service Endpoint</p> <p>The Amazon Web Services Budgets API provides the following endpoint:</p> <ul> <li> <p>https://budgets.amazonaws.com</p> </li> </ul> <p>For information about costs that are associated with the Amazon Web Services Budgets API, see <a href=\"https://aws.amazon.com/aws-cost-management/pricing/\">Amazon Web Services Cost Management Pricing</a>.</p>"
+  "documentation":"<p>Use the Amazon Web Services Budgets API to plan your service usage, service costs, and instance reservations. This API reference provides descriptions, syntax, and usage examples for each of the actions and data types for the Amazon Web Services Budgets feature. </p> <p>Budgets provide you with a way to see the following information:</p> <ul> <li> <p>How close your plan is to your budgeted amount or to the free tier limits</p> </li> <li> <p>Your usage-to-date, including how much you've used of your Reserved Instances (RIs)</p> </li> <li> <p>Your current estimated charges from Amazon Web Services, and how much your predicted usage will accrue in charges by the end of the month</p> </li> <li> <p>How much of your budget has been used</p> </li> </ul> <p>Amazon Web Services updates your budget status several times a day. Budgets track your unblended costs, subscriptions, refunds, and RIs. You can create the following types of budgets:</p> <ul> <li> <p> <b>Cost budgets</b> - Plan how much you want to spend on a service.</p> </li> <li> <p> <b>Usage budgets</b> - Plan how much you want to use one or more services.</p> </li> <li> <p> <b>RI utilization budgets</b> - Define a utilization threshold, and receive alerts when your RI usage falls below that threshold. This lets you see if your RIs are unused or under-utilized.</p> </li> <li> <p> <b>RI coverage budgets</b> - Define a coverage threshold, and receive alerts when the number of your instance hours that are covered by RIs fall below that threshold. This lets you see how much of your instance usage is covered by a reservation.</p> </li> </ul> <p>Service Endpoint</p> <p>The Amazon Web Services Budgets API provides the following endpoint:</p> <ul> <li> <p>https://budgets.amazonaws.com</p> </li> </ul> <p>For information about costs that are associated with the Amazon Web Services Budgets API, see <a href=\"https://aws.amazon.com/aws-cost-management/pricing/\">Amazon Web Services Cost Management Pricing</a>.</p>"
 }
diff --git a/contrib/python/botocore/py3/botocore/data/endpoints.json b/contrib/python/botocore/py3/botocore/data/endpoints.json
index 38d77d1ac1..fc339611cd 100644
--- a/contrib/python/botocore/py3/botocore/data/endpoints.json
+++ b/contrib/python/botocore/py3/botocore/data/endpoints.json
@@ -3693,14 +3693,26 @@
       },
       "drs" : {
         "endpoints" : {
+          "af-south-1" : { },
+          "ap-east-1" : { },
           "ap-northeast-1" : { },
+          "ap-northeast-2" : { },
+          "ap-northeast-3" : { },
+          "ap-south-1" : { },
           "ap-southeast-1" : { },
           "ap-southeast-2" : { },
+          "ca-central-1" : { },
           "eu-central-1" : { },
+          "eu-north-1" : { },
+          "eu-south-1" : { },
           "eu-west-1" : { },
           "eu-west-2" : { },
+          "eu-west-3" : { },
+          "me-south-1" : { },
+          "sa-east-1" : { },
           "us-east-1" : { },
           "us-east-2" : { },
+          "us-west-1" : { },
           "us-west-2" : { }
         }
       },
@@ -9261,6 +9273,12 @@
             },
             "hostname" : "portal.sso.eu-north-1.amazonaws.com"
           },
+          "eu-south-1" : {
+            "credentialScope" : {
+              "region" : "eu-south-1"
+            },
+            "hostname" : "portal.sso.eu-south-1.amazonaws.com"
+          },
           "eu-west-1" : {
             "credentialScope" : {
               "region" : "eu-west-1"
@@ -9789,6 +9807,21 @@
           }
         }
       },
+      "redshift-serverless" : {
+        "endpoints" : {
+          "ap-northeast-1" : { },
+          "ap-northeast-2" : { },
+          "ap-southeast-1" : { },
+          "ap-southeast-2" : { },
+          "eu-central-1" : { },
+          "eu-north-1" : { },
+          "eu-west-1" : { },
+          "eu-west-2" : { },
+          "us-east-1" : { },
+          "us-east-2" : { },
+          "us-west-2" : { }
+        }
+      },
       "rekognition" : {
         "endpoints" : {
           "ap-northeast-1" : { },
@@ -13359,6 +13392,384 @@
           }
         }
       },
+      "wafv2" : {
+        "endpoints" : {
+          "af-south-1" : {
+            "credentialScope" : {
+              "region" : "af-south-1"
+            },
+            "hostname" : "wafv2.af-south-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.af-south-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-east-1" : {
+            "credentialScope" : {
+              "region" : "ap-east-1"
+            },
+            "hostname" : "wafv2.ap-east-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-northeast-1" : {
+            "credentialScope" : {
+              "region" : "ap-northeast-1"
+            },
+            "hostname" : "wafv2.ap-northeast-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-northeast-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-northeast-2" : {
+            "credentialScope" : {
+              "region" : "ap-northeast-2"
+            },
+            "hostname" : "wafv2.ap-northeast-2.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-northeast-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-northeast-3" : {
+            "credentialScope" : {
+              "region" : "ap-northeast-3"
+            },
+            "hostname" : "wafv2.ap-northeast-3.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-northeast-3.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-south-1" : {
+            "credentialScope" : {
+              "region" : "ap-south-1"
+            },
+            "hostname" : "wafv2.ap-south-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-south-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-southeast-1" : {
+            "credentialScope" : {
+              "region" : "ap-southeast-1"
+            },
+            "hostname" : "wafv2.ap-southeast-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-southeast-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-southeast-2" : {
+            "credentialScope" : {
+              "region" : "ap-southeast-2"
+            },
+            "hostname" : "wafv2.ap-southeast-2.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-southeast-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ap-southeast-3" : {
+            "credentialScope" : {
+              "region" : "ap-southeast-3"
+            },
+            "hostname" : "wafv2.ap-southeast-3.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ap-southeast-3.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "ca-central-1" : {
+            "credentialScope" : {
+              "region" : "ca-central-1"
+            },
+            "hostname" : "wafv2.ca-central-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.ca-central-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "eu-central-1" : {
+            "credentialScope" : {
+              "region" : "eu-central-1"
+            },
+            "hostname" : "wafv2.eu-central-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.eu-central-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "eu-north-1" : {
+            "credentialScope" : {
+              "region" : "eu-north-1"
+            },
+            "hostname" : "wafv2.eu-north-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.eu-north-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "eu-south-1" : {
+            "credentialScope" : {
+              "region" : "eu-south-1"
+            },
+            "hostname" : "wafv2.eu-south-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.eu-south-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "eu-west-1" : {
+            "credentialScope" : {
+              "region" : "eu-west-1"
+            },
+            "hostname" : "wafv2.eu-west-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.eu-west-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "eu-west-2" : {
+            "credentialScope" : {
+              "region" : "eu-west-2"
+            },
+            "hostname" : "wafv2.eu-west-2.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.eu-west-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "eu-west-3" : {
+            "credentialScope" : {
+              "region" : "eu-west-3"
+            },
+            "hostname" : "wafv2.eu-west-3.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.eu-west-3.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "fips-af-south-1" : {
+            "credentialScope" : {
+              "region" : "af-south-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.af-south-1.amazonaws.com"
+          },
+          "fips-ap-east-1" : {
+            "credentialScope" : {
+              "region" : "ap-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-east-1.amazonaws.com"
+          },
+          "fips-ap-northeast-1" : {
+            "credentialScope" : {
+              "region" : "ap-northeast-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-northeast-1.amazonaws.com"
+          },
+          "fips-ap-northeast-2" : {
+            "credentialScope" : {
+              "region" : "ap-northeast-2"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-northeast-2.amazonaws.com"
+          },
+          "fips-ap-northeast-3" : {
+            "credentialScope" : {
+              "region" : "ap-northeast-3"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-northeast-3.amazonaws.com"
+          },
+          "fips-ap-south-1" : {
+            "credentialScope" : {
+              "region" : "ap-south-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-south-1.amazonaws.com"
+          },
+          "fips-ap-southeast-1" : {
+            "credentialScope" : {
+              "region" : "ap-southeast-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-southeast-1.amazonaws.com"
+          },
+          "fips-ap-southeast-2" : {
+            "credentialScope" : {
+              "region" : "ap-southeast-2"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-southeast-2.amazonaws.com"
+          },
+          "fips-ap-southeast-3" : {
+            "credentialScope" : {
+              "region" : "ap-southeast-3"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ap-southeast-3.amazonaws.com"
+          },
+          "fips-ca-central-1" : {
+            "credentialScope" : {
+              "region" : "ca-central-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.ca-central-1.amazonaws.com"
+          },
+          "fips-eu-central-1" : {
+            "credentialScope" : {
+              "region" : "eu-central-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.eu-central-1.amazonaws.com"
+          },
+          "fips-eu-north-1" : {
+            "credentialScope" : {
+              "region" : "eu-north-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.eu-north-1.amazonaws.com"
+          },
+          "fips-eu-south-1" : {
+            "credentialScope" : {
+              "region" : "eu-south-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.eu-south-1.amazonaws.com"
+          },
+          "fips-eu-west-1" : {
+            "credentialScope" : {
+              "region" : "eu-west-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.eu-west-1.amazonaws.com"
+          },
+          "fips-eu-west-2" : {
+            "credentialScope" : {
+              "region" : "eu-west-2"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.eu-west-2.amazonaws.com"
+          },
+          "fips-eu-west-3" : {
+            "credentialScope" : {
+              "region" : "eu-west-3"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.eu-west-3.amazonaws.com"
+          },
+          "fips-me-south-1" : {
+            "credentialScope" : {
+              "region" : "me-south-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.me-south-1.amazonaws.com"
+          },
+          "fips-sa-east-1" : {
+            "credentialScope" : {
+              "region" : "sa-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.sa-east-1.amazonaws.com"
+          },
+          "fips-us-east-1" : {
+            "credentialScope" : {
+              "region" : "us-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.us-east-1.amazonaws.com"
+          },
+          "fips-us-east-2" : {
+            "credentialScope" : {
+              "region" : "us-east-2"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.us-east-2.amazonaws.com"
+          },
+          "fips-us-west-1" : {
+            "credentialScope" : {
+              "region" : "us-west-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.us-west-1.amazonaws.com"
+          },
+          "fips-us-west-2" : {
+            "credentialScope" : {
+              "region" : "us-west-2"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.us-west-2.amazonaws.com"
+          },
+          "me-south-1" : {
+            "credentialScope" : {
+              "region" : "me-south-1"
+            },
+            "hostname" : "wafv2.me-south-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.me-south-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "sa-east-1" : {
+            "credentialScope" : {
+              "region" : "sa-east-1"
+            },
+            "hostname" : "wafv2.sa-east-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.sa-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-east-1" : {
+            "credentialScope" : {
+              "region" : "us-east-1"
+            },
+            "hostname" : "wafv2.us-east-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.us-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-east-2" : {
+            "credentialScope" : {
+              "region" : "us-east-2"
+            },
+            "hostname" : "wafv2.us-east-2.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.us-east-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-west-1" : {
+            "credentialScope" : {
+              "region" : "us-west-1"
+            },
+            "hostname" : "wafv2.us-west-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.us-west-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-west-2" : {
+            "credentialScope" : {
+              "region" : "us-west-2"
+            },
+            "hostname" : "wafv2.us-west-2.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.us-west-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          }
+        }
+      },
       "wellarchitected" : {
         "endpoints" : {
           "ap-east-1" : { },
@@ -14615,6 +15026,44 @@
           }
         }
       },
+      "wafv2" : {
+        "endpoints" : {
+          "cn-north-1" : {
+            "credentialScope" : {
+              "region" : "cn-north-1"
+            },
+            "hostname" : "wafv2.cn-north-1.amazonaws.com.cn",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.cn-north-1.amazonaws.com.cn",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "cn-northwest-1" : {
+            "credentialScope" : {
+              "region" : "cn-northwest-1"
+            },
+            "hostname" : "wafv2.cn-northwest-1.amazonaws.com.cn",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.cn-northwest-1.amazonaws.com.cn",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "fips-cn-north-1" : {
+            "credentialScope" : {
+              "region" : "cn-north-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.cn-north-1.amazonaws.com.cn"
+          },
+          "fips-cn-northwest-1" : {
+            "credentialScope" : {
+              "region" : "cn-northwest-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.cn-northwest-1.amazonaws.com.cn"
+          }
+        }
+      },
       "workspaces" : {
         "endpoints" : {
           "cn-northwest-1" : { }
@@ -18149,6 +18598,44 @@
           }
         }
       },
+      "wafv2" : {
+        "endpoints" : {
+          "fips-us-gov-east-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.us-gov-east-1.amazonaws.com"
+          },
+          "fips-us-gov-west-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-west-1"
+            },
+            "deprecated" : true,
+            "hostname" : "wafv2-fips.us-gov-west-1.amazonaws.com"
+          },
+          "us-gov-east-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-east-1"
+            },
+            "hostname" : "wafv2.us-gov-east-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.us-gov-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-gov-west-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-west-1"
+            },
+            "hostname" : "wafv2.us-gov-west-1.amazonaws.com",
+            "variants" : [ {
+              "hostname" : "wafv2-fips.us-gov-west-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          }
+        }
+      },
       "workspaces" : {
         "endpoints" : {
           "fips-us-gov-west-1" : {
diff --git a/contrib/python/botocore/py3/botocore/data/finspace-data/2020-07-13/service-2.json b/contrib/python/botocore/py3/botocore/data/finspace-data/2020-07-13/service-2.json
index 9d531a03b1..755f78911a 100644
--- a/contrib/python/botocore/py3/botocore/data/finspace-data/2020-07-13/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/finspace-data/2020-07-13/service-2.json
@@ -13,6 +13,24 @@
     "uid":"finspace-2020-07-13"
   },
   "operations":{
+    "AssociateUserToPermissionGroup":{
+      "name":"AssociateUserToPermissionGroup",
+      "http":{
+        "method":"POST",
+        "requestUri":"/permission-group/{permissionGroupId}/users/{userId}"
+      },
+      "input":{"shape":"AssociateUserToPermissionGroupRequest"},
+      "output":{"shape":"AssociateUserToPermissionGroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"}
+      ],
+      "documentation":"<p>Adds a user account to a permission group to grant permissions for actions a user can perform in FinSpace.</p>"
+    },
     "CreateChangeset":{
       "name":"CreateChangeset",
       "http":{
@@ -161,6 +179,24 @@
       ],
       "documentation":"<p>Denies access to the FinSpace web application and API for the specified user.</p>"
     },
+    "DisassociateUserFromPermissionGroup":{
+      "name":"DisassociateUserFromPermissionGroup",
+      "http":{
+        "method":"DELETE",
+        "requestUri":"/permission-group/{permissionGroupId}/users/{userId}"
+      },
+      "input":{"shape":"DisassociateUserFromPermissionGroupRequest"},
+      "output":{"shape":"DisassociateUserFromPermissionGroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"}
+      ],
+      "documentation":"<p>Removes a user account from a permission group.</p>"
+    },
     "EnableUser":{
       "name":"EnableUser",
       "http":{
@@ -233,6 +269,23 @@
       ],
       "documentation":"<p>Returns information about a Dataset.</p>"
     },
+    "GetPermissionGroup":{
+      "name":"GetPermissionGroup",
+      "http":{
+        "method":"GET",
+        "requestUri":"/permission-group/{permissionGroupId}"
+      },
+      "input":{"shape":"GetPermissionGroupRequest"},
+      "output":{"shape":"GetPermissionGroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"}
+      ],
+      "documentation":"<p>Retrieves the details of a specific permission group.</p>"
+    },
     "GetProgrammaticAccessCredentials":{
       "name":"GetProgrammaticAccessCredentials",
       "http":{
@@ -350,6 +403,23 @@
       ],
       "documentation":"<p>Lists all available permission groups in FinSpace.</p>"
     },
+    "ListPermissionGroupsByUser":{
+      "name":"ListPermissionGroupsByUser",
+      "http":{
+        "method":"GET",
+        "requestUri":"/user/{userId}/permission-groups"
+      },
+      "input":{"shape":"ListPermissionGroupsByUserRequest"},
+      "output":{"shape":"ListPermissionGroupsByUserResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"}
+      ],
+      "documentation":"<p>Lists all the permission groups that are associated with a specific user account.</p>"
+    },
     "ListUsers":{
       "name":"ListUsers",
       "http":{
@@ -366,6 +436,23 @@
       ],
       "documentation":"<p>Lists all available user accounts in FinSpace.</p>"
     },
+    "ListUsersByPermissionGroup":{
+      "name":"ListUsersByPermissionGroup",
+      "http":{
+        "method":"GET",
+        "requestUri":"/permission-group/{permissionGroupId}/users"
+      },
+      "input":{"shape":"ListUsersByPermissionGroupRequest"},
+      "output":{"shape":"ListUsersByPermissionGroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"}
+      ],
+      "documentation":"<p>Lists details of all the users in a specific permission group.</p>"
+    },
     "ResetUserPassword":{
       "name":"ResetUserPassword",
       "http":{
@@ -496,6 +583,42 @@
       "type":"list",
       "member":{"shape":"ApplicationPermission"}
     },
+    "AssociateUserToPermissionGroupRequest":{
+      "type":"structure",
+      "required":[
+        "permissionGroupId",
+        "userId"
+      ],
+      "members":{
+        "permissionGroupId":{
+          "shape":"PermissionGroupId",
+          "documentation":"<p>The unique identifier for the permission group.</p>",
+          "location":"uri",
+          "locationName":"permissionGroupId"
+        },
+        "userId":{
+          "shape":"UserId",
+          "documentation":"<p>The unique identifier for the user.</p>",
+          "location":"uri",
+          "locationName":"userId"
+        },
+        "clientToken":{
+          "shape":"ClientToken",
+          "documentation":"<p>A token that ensures idempotency. This token expires in 10 minutes.</p>",
+          "idempotencyToken":true
+        }
+      }
+    },
+    "AssociateUserToPermissionGroupResponse":{
+      "type":"structure",
+      "members":{
+        "statusCode":{
+          "shape":"StatusCode",
+          "documentation":"<p>The returned status code of the response.</p>",
+          "location":"statusCode"
+        }
+      }
+    },
     "Boolean":{
       "type":"boolean",
       "documentation":"Common Boolean data type"
@@ -645,7 +768,7 @@
       "type":"string",
       "documentation":"Column Description",
       "max":512,
-      "pattern":"[\\s\\S]*\\S[\\s\\S]*"
+      "pattern":"[\\s\\S]*"
     },
     "ColumnList":{
       "type":"list",
@@ -950,7 +1073,7 @@
         },
         "s3DestinationExportFileFormat":{
           "shape":"ExportFileFormat",
-          "documentation":"<p>Data view export file format.</p> <ul> <li> <p> <code>PARQUET</code> – Parquet export file format.</p> </li> <li> <p> <code>DELIMITED_TEXT</code> – Delimited text export file format.</p> </li> </ul>"
+          "documentation":"<p>Dataview export file format.</p> <ul> <li> <p> <code>PARQUET</code> – Parquet export file format.</p> </li> <li> <p> <code>DELIMITED_TEXT</code> – Delimited text export file format.</p> </li> </ul>"
         },
         "s3DestinationExportFileFormatOptions":{
           "shape":"S3DestinationFormatOptions",
@@ -1107,8 +1230,7 @@
       "type":"string",
       "documentation":"Description of a dataset",
       "max":1000,
-      "min":1,
-      "pattern":"[\\s\\S]*\\S[\\s\\S]*"
+      "pattern":"[\\s\\S]*"
     },
     "DatasetId":{
       "type":"string",
@@ -1248,6 +1370,44 @@
         }
       }
     },
+    "DisassociateUserFromPermissionGroupRequest":{
+      "type":"structure",
+      "required":[
+        "permissionGroupId",
+        "userId"
+      ],
+      "members":{
+        "permissionGroupId":{
+          "shape":"PermissionGroupId",
+          "documentation":"<p>The unique identifier for the permission group.</p>",
+          "location":"uri",
+          "locationName":"permissionGroupId"
+        },
+        "userId":{
+          "shape":"UserId",
+          "documentation":"<p>The unique identifier for the user.</p>",
+          "location":"uri",
+          "locationName":"userId"
+        },
+        "clientToken":{
+          "shape":"ClientToken",
+          "documentation":"<p>A token that ensures idempotency. This token expires in 10 minutes.</p>",
+          "idempotencyToken":true,
+          "location":"querystring",
+          "locationName":"clientToken"
+        }
+      }
+    },
+    "DisassociateUserFromPermissionGroupResponse":{
+      "type":"structure",
+      "members":{
+        "statusCode":{
+          "shape":"StatusCode",
+          "documentation":"<p>The returned status code of the response.</p>",
+          "location":"statusCode"
+        }
+      }
+    },
     "Email":{
       "type":"string",
       "max":320,
@@ -1539,6 +1699,24 @@
       },
       "documentation":"Response for the GetDataset operation"
     },
+    "GetPermissionGroupRequest":{
+      "type":"structure",
+      "required":["permissionGroupId"],
+      "members":{
+        "permissionGroupId":{
+          "shape":"PermissionGroupId",
+          "documentation":"<p>The unique identifier for the permission group.</p>",
+          "location":"uri",
+          "locationName":"permissionGroupId"
+        }
+      }
+    },
+    "GetPermissionGroupResponse":{
+      "type":"structure",
+      "members":{
+        "permissionGroup":{"shape":"PermissionGroup"}
+      }
+    },
     "GetProgrammaticAccessCredentialsRequest":{
       "type":"structure",
       "required":["environmentId"],
@@ -1609,7 +1787,7 @@
         },
         "type":{
           "shape":"UserType",
-          "documentation":"<p>Indicates the type of user. </p> <ul> <li> <p> <code>SUPER_USER</code> – A user with permission to all the functionality and data in FinSpace.</p> </li> </ul> <ul> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permissions group.</p> </li> </ul>"
+          "documentation":"<p>Indicates the type of user. </p> <ul> <li> <p> <code>SUPER_USER</code> – A user with permission to all the functionality and data in FinSpace.</p> </li> </ul> <ul> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permission group.</p> </li> </ul>"
         },
         "apiAccess":{
           "shape":"ApiAccess",
@@ -1820,6 +1998,46 @@
       },
       "documentation":"Response for the ListDatasets operation"
     },
+    "ListPermissionGroupsByUserRequest":{
+      "type":"structure",
+      "required":[
+        "userId",
+        "maxResults"
+      ],
+      "members":{
+        "userId":{
+          "shape":"UserId",
+          "documentation":"<p>The unique identifier for the user.</p>",
+          "location":"uri",
+          "locationName":"userId"
+        },
+        "nextToken":{
+          "shape":"PaginationToken",
+          "documentation":"<p>A token that indicates where a results page should begin.</p>",
+          "location":"querystring",
+          "locationName":"nextToken"
+        },
+        "maxResults":{
+          "shape":"ResultLimit",
+          "documentation":"<p>The maximum number of results per page.</p>",
+          "location":"querystring",
+          "locationName":"maxResults"
+        }
+      }
+    },
+    "ListPermissionGroupsByUserResponse":{
+      "type":"structure",
+      "members":{
+        "permissionGroups":{
+          "shape":"PermissionGroupByUserList",
+          "documentation":"<p>A list of returned permission groups.</p>"
+        },
+        "nextToken":{
+          "shape":"PaginationToken",
+          "documentation":"<p>A token that indicates where a results page should begin.</p>"
+        }
+      }
+    },
     "ListPermissionGroupsRequest":{
       "type":"structure",
       "required":["maxResults"],
@@ -1851,6 +2069,46 @@
         }
       }
     },
+    "ListUsersByPermissionGroupRequest":{
+      "type":"structure",
+      "required":[
+        "permissionGroupId",
+        "maxResults"
+      ],
+      "members":{
+        "permissionGroupId":{
+          "shape":"PermissionGroupId",
+          "documentation":"<p>The unique identifier for the permission group.</p>",
+          "location":"uri",
+          "locationName":"permissionGroupId"
+        },
+        "nextToken":{
+          "shape":"PaginationToken",
+          "documentation":"<p>A token that indicates where a results page should begin.</p>",
+          "location":"querystring",
+          "locationName":"nextToken"
+        },
+        "maxResults":{
+          "shape":"ResultLimit",
+          "documentation":"<p>The maximum number of results per page.</p>",
+          "location":"querystring",
+          "locationName":"maxResults"
+        }
+      }
+    },
+    "ListUsersByPermissionGroupResponse":{
+      "type":"structure",
+      "members":{
+        "users":{
+          "shape":"UserByPermissionGroupList",
+          "documentation":"<p>Lists details of all users in a specific permission group.</p>"
+        },
+        "nextToken":{
+          "shape":"PaginationToken",
+          "documentation":"<p>A token that indicates where a results page should begin.</p>"
+        }
+      }
+    },
     "ListUsersRequest":{
       "type":"structure",
       "required":["maxResults"],
@@ -1889,10 +2147,7 @@
       "min":1,
       "pattern":".*\\S.*"
     },
-    "PaginationToken":{
-      "type":"string",
-      "documentation":"Pagination token for list operations"
-    },
+    "PaginationToken":{"type":"string"},
     "PartitionColumnList":{
       "type":"list",
       "member":{"shape":"StringValueLength1to255"},
@@ -1931,15 +2186,41 @@
         "lastModifiedTime":{
           "shape":"TimestampEpoch",
           "documentation":"<p>Describes the last time the permission group was updated. The value is determined as epoch time in milliseconds. </p>"
+        },
+        "membershipStatus":{
+          "shape":"PermissionGroupMembershipStatus",
+          "documentation":"<p>Indicates the status of the user account within a permission group.</p> <ul> <li> <p> <code>ADDITION_IN_PROGRESS</code> – The user account is currently being added to the permission group.</p> </li> <li> <p> <code>ADDITION_SUCCESS</code> – The user account is successfully added to the permission group.</p> </li> <li> <p> <code>REMOVAL_IN_PROGRESS</code> – The user is currently being removed from the permission group.</p> </li> </ul>"
         }
       },
       "documentation":"<p>The structure for a permission group.</p>"
     },
+    "PermissionGroupByUser":{
+      "type":"structure",
+      "members":{
+        "permissionGroupId":{
+          "shape":"PermissionGroupId",
+          "documentation":"<p>The unique identifier for the permission group.</p>"
+        },
+        "name":{
+          "shape":"PermissionGroupName",
+          "documentation":"<p>The name of the permission group.</p>"
+        },
+        "membershipStatus":{
+          "shape":"PermissionGroupMembershipStatus",
+          "documentation":"<p>Indicates the status of the user account within a permission group.</p> <ul> <li> <p> <code>ADDITION_IN_PROGRESS</code> – The user account is currently being added to the permission group.</p> </li> <li> <p> <code>ADDITION_SUCCESS</code> – The user account is successfully added to the permission group.</p> </li> <li> <p> <code>REMOVAL_IN_PROGRESS</code> – The user is currently being removed from the permission group.</p> </li> </ul>"
+        }
+      },
+      "documentation":"<p>The structure of a permission group associated with a user account.</p>"
+    },
+    "PermissionGroupByUserList":{
+      "type":"list",
+      "member":{"shape":"PermissionGroupByUser"}
+    },
     "PermissionGroupDescription":{
       "type":"string",
       "max":4000,
       "min":1,
-      "pattern":".*\\S.*",
+      "pattern":"[\\s\\S]*",
       "sensitive":true
     },
     "PermissionGroupId":{
@@ -1952,6 +2233,14 @@
       "type":"list",
       "member":{"shape":"PermissionGroup"}
     },
+    "PermissionGroupMembershipStatus":{
+      "type":"string",
+      "enum":[
+        "ADDITION_IN_PROGRESS",
+        "ADDITION_SUCCESS",
+        "REMOVAL_IN_PROGRESS"
+      ]
+    },
     "PermissionGroupName":{
       "type":"string",
       "max":255,
@@ -2037,7 +2326,6 @@
     },
     "ResultLimit":{
       "type":"integer",
-      "documentation":"Maximum number of results to be returned as part of a list operation",
       "max":100,
       "min":1
     },
@@ -2092,6 +2380,7 @@
       "value":{"shape":"StringMapValue"},
       "documentation":"Source Parameters of a Changeset"
     },
+    "StatusCode":{"type":"integer"},
     "StringMapKey":{
       "type":"string",
       "max":128,
@@ -2281,7 +2570,7 @@
         },
         "type":{
           "shape":"UserType",
-          "documentation":"<p>The option to indicate the type of user.</p> <ul> <li> <p> <code>SUPER_USER</code>– A user with permission to all the functionality and data in FinSpace.</p> </li> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permissions group.</p> </li> </ul>"
+          "documentation":"<p>The option to indicate the type of user.</p> <ul> <li> <p> <code>SUPER_USER</code>– A user with permission to all the functionality and data in FinSpace.</p> </li> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permission group.</p> </li> </ul>"
         },
         "firstName":{
           "shape":"FirstName",
@@ -2340,7 +2629,7 @@
         },
         "type":{
           "shape":"UserType",
-          "documentation":"<p> Indicates the type of user.</p> <ul> <li> <p> <code>SUPER_USER</code> – A user with permission to all the functionality and data in FinSpace.</p> </li> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permissions group.</p> </li> </ul>"
+          "documentation":"<p> Indicates the type of user.</p> <ul> <li> <p> <code>SUPER_USER</code> – A user with permission to all the functionality and data in FinSpace.</p> </li> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permission group.</p> </li> </ul>"
         },
         "apiAccess":{
           "shape":"ApiAccess",
@@ -2373,6 +2662,52 @@
       },
       "documentation":"<p>The details of the user account.</p>"
     },
+    "UserByPermissionGroup":{
+      "type":"structure",
+      "members":{
+        "userId":{
+          "shape":"UserId",
+          "documentation":"<p>The unique identifier for the user.</p>"
+        },
+        "status":{
+          "shape":"UserStatus",
+          "documentation":"<p>The current status of the user account. </p> <ul> <li> <p> <code>CREATING</code> – The user account creation is in progress.</p> </li> <li> <p> <code>ENABLED</code> – The user account is created and is currently active.</p> </li> <li> <p> <code>DISABLED</code> – The user account is currently inactive.</p> </li> </ul>"
+        },
+        "firstName":{
+          "shape":"FirstName",
+          "documentation":"<p>The first name of the user.</p>"
+        },
+        "lastName":{
+          "shape":"LastName",
+          "documentation":"<p>The last name of the user.</p>"
+        },
+        "emailAddress":{
+          "shape":"Email",
+          "documentation":"<p>The email address of the user. The email address serves as a unique identifier for each user and cannot be changed after it's created.</p>"
+        },
+        "type":{
+          "shape":"UserType",
+          "documentation":"<p> Indicates the type of user.</p> <ul> <li> <p> <code>SUPER_USER</code> – A user with permission to all the functionality and data in FinSpace.</p> </li> <li> <p> <code>APP_USER</code> – A user with specific permissions in FinSpace. The users are assigned permissions by adding them to a permission group.</p> </li> </ul>"
+        },
+        "apiAccess":{
+          "shape":"ApiAccess",
+          "documentation":"<p>Indicates whether the user can access FinSpace API operations.</p> <ul> <li> <p> <code>ENABLED</code> – The user has permissions to use the API operations.</p> </li> <li> <p> <code>DISABLED</code> – The user does not have permissions to use any API operations.</p> </li> </ul>"
+        },
+        "apiAccessPrincipalArn":{
+          "shape":"RoleArn",
+          "documentation":"<p>The IAM ARN identifier that is attached to FinSpace API calls.</p>"
+        },
+        "membershipStatus":{
+          "shape":"PermissionGroupMembershipStatus",
+          "documentation":"<p>Indicates the status of the user account within a permission group.</p> <ul> <li> <p> <code>ADDITION_IN_PROGRESS</code> – The user account is currently being added to the permission group.</p> </li> <li> <p> <code>ADDITION_SUCCESS</code> – The user account is successfully added to the permission group.</p> </li> <li> <p> <code>REMOVAL_IN_PROGRESS</code> – The user is currently being removed from the permission group.</p> </li> </ul>"
+        }
+      },
+      "documentation":"<p>The structure of a user account associated with a permission group.</p>"
+    },
+    "UserByPermissionGroupList":{
+      "type":"list",
+      "member":{"shape":"UserByPermissionGroup"}
+    },
     "UserId":{
       "type":"string",
       "max":26,
diff --git a/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json b/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json
index 2b1d333639..02f1c5820a 100644
--- a/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json
@@ -12,6 +12,21 @@
     "uid":"guardduty-2017-11-28"
   },
   "operations":{
+    "AcceptAdministratorInvitation":{
+      "name":"AcceptAdministratorInvitation",
+      "http":{
+        "method":"POST",
+        "requestUri":"/detector/{detectorId}/administrator",
+        "responseCode":200
+      },
+      "input":{"shape":"AcceptAdministratorInvitationRequest"},
+      "output":{"shape":"AcceptAdministratorInvitationResponse"},
+      "errors":[
+        {"shape":"BadRequestException"},
+        {"shape":"InternalServerErrorException"}
+      ],
+      "documentation":"<p>Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.</p>"
+    },
     "AcceptInvitation":{
       "name":"AcceptInvitation",
       "http":{
@@ -25,7 +40,9 @@
         {"shape":"BadRequestException"},
         {"shape":"InternalServerErrorException"}
       ],
-      "documentation":"<p>Accepts the invitation to be monitored by a GuardDuty administrator account.</p>"
+      "documentation":"<p>Accepts the invitation to be monitored by a GuardDuty administrator account.</p>",
+      "deprecated":true,
+      "deprecatedMessage":"This operation is deprecated, use AcceptAdministratorInvitation instead"
     },
     "ArchiveFindings":{
       "name":"ArchiveFindings",
@@ -312,6 +329,21 @@
       ],
       "documentation":"<p>Disables an Amazon Web Services account within the Organization as the GuardDuty delegated administrator.</p>"
     },
+    "DisassociateFromAdministratorAccount":{
+      "name":"DisassociateFromAdministratorAccount",
+      "http":{
+        "method":"POST",
+        "requestUri":"/detector/{detectorId}/administrator/disassociate",
+        "responseCode":200
+      },
+      "input":{"shape":"DisassociateFromAdministratorAccountRequest"},
+      "output":{"shape":"DisassociateFromAdministratorAccountResponse"},
+      "errors":[
+        {"shape":"BadRequestException"},
+        {"shape":"InternalServerErrorException"}
+      ],
+      "documentation":"<p>Disassociates the current GuardDuty member account from its administrator account.</p>"
+    },
     "DisassociateFromMasterAccount":{
       "name":"DisassociateFromMasterAccount",
       "http":{
@@ -325,7 +357,9 @@
         {"shape":"BadRequestException"},
         {"shape":"InternalServerErrorException"}
       ],
-      "documentation":"<p>Disassociates the current GuardDuty member account from its administrator account.</p>"
+      "documentation":"<p>Disassociates the current GuardDuty member account from its administrator account.</p>",
+      "deprecated":true,
+      "deprecatedMessage":"This operation is deprecated, use DisassociateFromAdministratorAccount instead"
     },
     "DisassociateMembers":{
       "name":"DisassociateMembers",
@@ -340,7 +374,7 @@
         {"shape":"BadRequestException"},
         {"shape":"InternalServerErrorException"}
       ],
-      "documentation":"<p>Disassociates GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. Member accounts added through <a href=\"https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_invitations.html\">Invitation</a> get deleted from the current GuardDuty administrator account after 30 days of disassociation.</p>"
+      "documentation":"<p>Disassociates GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.</p>"
     },
     "EnableOrganizationAdminAccount":{
       "name":"EnableOrganizationAdminAccount",
@@ -357,6 +391,21 @@
       ],
       "documentation":"<p>Enables an Amazon Web Services account within the organization as the GuardDuty delegated administrator.</p>"
     },
+    "GetAdministratorAccount":{
+      "name":"GetAdministratorAccount",
+      "http":{
+        "method":"GET",
+        "requestUri":"/detector/{detectorId}/administrator",
+        "responseCode":200
+      },
+      "input":{"shape":"GetAdministratorAccountRequest"},
+      "output":{"shape":"GetAdministratorAccountResponse"},
+      "errors":[
+        {"shape":"BadRequestException"},
+        {"shape":"InternalServerErrorException"}
+      ],
+      "documentation":"<p>Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.</p>"
+    },
     "GetDetector":{
       "name":"GetDetector",
       "http":{
@@ -460,7 +509,9 @@
         {"shape":"BadRequestException"},
         {"shape":"InternalServerErrorException"}
       ],
-      "documentation":"<p>Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.</p>"
+      "documentation":"<p>Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.</p>",
+      "deprecated":true,
+      "deprecatedMessage":"This operation is deprecated, use GetAdministratorAccount instead"
     },
     "GetMemberDetectors":{
       "name":"GetMemberDetectors",
@@ -492,6 +543,21 @@
       ],
       "documentation":"<p>Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.</p>"
     },
+    "GetRemainingFreeTrialDays":{
+      "name":"GetRemainingFreeTrialDays",
+      "http":{
+        "method":"POST",
+        "requestUri":"/detector/{detectorId}/freeTrial/daysRemaining",
+        "responseCode":200
+      },
+      "input":{"shape":"GetRemainingFreeTrialDaysRequest"},
+      "output":{"shape":"GetRemainingFreeTrialDaysResponse"},
+      "errors":[
+        {"shape":"BadRequestException"},
+        {"shape":"InternalServerErrorException"}
+      ],
+      "documentation":"<p>Provides the number of days left for each data source used in the free trial period.</p>"
+    },
     "GetThreatIntelSet":{
       "name":"GetThreatIntelSet",
       "http":{
@@ -520,7 +586,7 @@
         {"shape":"BadRequestException"},
         {"shape":"InternalServerErrorException"}
       ],
-      "documentation":"<p>Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources the cost returned will include only the usage so far under 30 days, this may differ from the cost metrics in the console, which projects usage over 30 days to provide a monthly cost estimate. For more information see <a href=\"https://docs.aws.amazon.com/guardduty/latest/ug/monitoring_costs.html#usage-calculations\">Understanding How Usage Costs are Calculated</a>.</p>"
+      "documentation":"<p>Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see <a href=\"https://docs.aws.amazon.com/guardduty/latest/ug/monitoring_costs.html#usage-calculations\">Understanding How Usage Costs are Calculated</a>.</p>"
     },
     "InviteMembers":{
       "name":"InviteMembers",
@@ -884,6 +950,37 @@
     }
   },
   "shapes":{
+    "AcceptAdministratorInvitationRequest":{
+      "type":"structure",
+      "required":[
+        "DetectorId",
+        "AdministratorId",
+        "InvitationId"
+      ],
+      "members":{
+        "DetectorId":{
+          "shape":"DetectorId",
+          "documentation":"<p>The unique ID of the detector of the GuardDuty member account.</p>",
+          "location":"uri",
+          "locationName":"detectorId"
+        },
+        "AdministratorId":{
+          "shape":"String",
+          "documentation":"<p>The account ID of the GuardDuty administrator account whose invitation you're accepting.</p>",
+          "locationName":"administratorId"
+        },
+        "InvitationId":{
+          "shape":"String",
+          "documentation":"<p>The value that is used to validate the administrator account to the member account.</p>",
+          "locationName":"invitationId"
+        }
+      }
+    },
+    "AcceptAdministratorInvitationResponse":{
+      "type":"structure",
+      "members":{
+      }
+    },
     "AcceptInvitationRequest":{
       "type":"structure",
       "required":[
@@ -908,12 +1005,16 @@
           "documentation":"<p>The value that is used to validate the administrator account to the member account.</p>",
           "locationName":"invitationId"
         }
-      }
+      },
+      "deprecated":true,
+      "deprecatedMessage":"This input is deprecated, use AcceptAdministratorInvitationRequest instead"
     },
     "AcceptInvitationResponse":{
       "type":"structure",
       "members":{
-      }
+      },
+      "deprecated":true,
+      "deprecatedMessage":"This output is deprecated, use AcceptAdministratorInvitationResponse instead"
     },
     "AccessControlList":{
       "type":"structure",
@@ -983,6 +1084,26 @@
       "max":50,
       "min":1
     },
+    "AccountFreeTrialInfo":{
+      "type":"structure",
+      "members":{
+        "AccountId":{
+          "shape":"String",
+          "documentation":"<p>The account identifier of the GuardDuty member account.</p>",
+          "locationName":"accountId"
+        },
+        "DataSources":{
+          "shape":"DataSourcesFreeTrial",
+          "documentation":"<p>Describes the data source enabled for the GuardDuty member account.</p>",
+          "locationName":"dataSources"
+        }
+      },
+      "documentation":"<p>Provides details of the GuardDuty member account that uses a free trial service.</p>"
+    },
+    "AccountFreeTrialInfos":{
+      "type":"list",
+      "member":{"shape":"AccountFreeTrialInfo"}
+    },
     "AccountId":{
       "type":"string",
       "max":12,
@@ -1072,6 +1193,37 @@
       "max":300,
       "min":1
     },
+    "Administrator":{
+      "type":"structure",
+      "members":{
+        "AccountId":{
+          "shape":"AccountId",
+          "documentation":"<p>The ID of the account used as the administrator account.</p>",
+          "locationName":"accountId"
+        },
+        "InvitationId":{
+          "shape":"String",
+          "documentation":"<p>The value that is used to validate the administrator account to the member account.</p>",
+          "locationName":"invitationId"
+        },
+        "RelationshipStatus":{
+          "shape":"String",
+          "documentation":"<p>The status of the relationship between the administrator and member accounts.</p>",
+          "locationName":"relationshipStatus"
+        },
+        "InvitedAt":{
+          "shape":"String",
+          "documentation":"<p>The timestamp when the invitation was sent.</p>",
+          "locationName":"invitedAt"
+        }
+      },
+      "documentation":"<p>Contains information about the administrator account and invitation.</p>"
+    },
+    "AffectedResources":{
+      "type":"map",
+      "key":{"shape":"String"},
+      "value":{"shape":"String"}
+    },
     "ArchiveFindingsRequest":{
       "type":"structure",
       "required":[
@@ -1139,6 +1291,11 @@
           "shape":"RemoteAccountDetails",
           "documentation":"<p>The details of the Amazon Web Services account that made the API call. This field appears if the call was made from outside your account.</p>",
           "locationName":"remoteAccountDetails"
+        },
+        "AffectedResources":{
+          "shape":"AffectedResources",
+          "documentation":"<p>The details of the Amazon Web Services account that made the API call. This field identifies the resources that were affected by this API call.</p>",
+          "locationName":"affectedResources"
         }
       },
       "documentation":"<p>Contains information about the API action.</p>"
@@ -1792,6 +1949,17 @@
       },
       "documentation":"<p>Contains information on the status of data sources for the detector.</p>"
     },
+    "DataSourceFreeTrial":{
+      "type":"structure",
+      "members":{
+        "FreeTrialDaysRemaining":{
+          "shape":"Integer",
+          "documentation":"<p>A value that specifies the number of days left to use each enabled data source.</p>",
+          "locationName":"freeTrialDaysRemaining"
+        }
+      },
+      "documentation":"<p>Contains information about which data sources are enabled for the GuardDuty member account.</p>"
+    },
     "DataSourceList":{
       "type":"list",
       "member":{"shape":"DataSource"}
@@ -1805,6 +1973,37 @@
       "max":300,
       "min":1
     },
+    "DataSourcesFreeTrial":{
+      "type":"structure",
+      "members":{
+        "CloudTrail":{
+          "shape":"DataSourceFreeTrial",
+          "documentation":"<p>Describes whether any AWS CloudTrail management event logs are enabled as data sources.</p>",
+          "locationName":"cloudTrail"
+        },
+        "DnsLogs":{
+          "shape":"DataSourceFreeTrial",
+          "documentation":"<p>Describes whether any DNS logs are enabled as data sources.</p>",
+          "locationName":"dnsLogs"
+        },
+        "FlowLogs":{
+          "shape":"DataSourceFreeTrial",
+          "documentation":"<p>Describes whether any VPC Flow logs are enabled as data sources.</p>",
+          "locationName":"flowLogs"
+        },
+        "S3Logs":{
+          "shape":"DataSourceFreeTrial",
+          "documentation":"<p>Describes whether any S3 data event logs are enabled as data sources.</p>",
+          "locationName":"s3Logs"
+        },
+        "Kubernetes":{
+          "shape":"KubernetesDataSourceFreeTrial",
+          "documentation":"<p>Describes whether any Kubernetes logs are enabled as data sources.</p>",
+          "locationName":"kubernetes"
+        }
+      },
+      "documentation":"<p>Contains information about which data sources are enabled for the GuardDuty member account.</p>"
+    },
     "DeclineInvitationsRequest":{
       "type":"structure",
       "required":["AccountIds"],
@@ -2199,7 +2398,7 @@
       "members":{
       }
     },
-    "DisassociateFromMasterAccountRequest":{
+    "DisassociateFromAdministratorAccountRequest":{
       "type":"structure",
       "required":["DetectorId"],
       "members":{
@@ -2211,11 +2410,32 @@
         }
       }
     },
-    "DisassociateFromMasterAccountResponse":{
+    "DisassociateFromAdministratorAccountResponse":{
       "type":"structure",
       "members":{
       }
     },
+    "DisassociateFromMasterAccountRequest":{
+      "type":"structure",
+      "required":["DetectorId"],
+      "members":{
+        "DetectorId":{
+          "shape":"DetectorId",
+          "documentation":"<p>The unique ID of the detector of the GuardDuty member account.</p>",
+          "location":"uri",
+          "locationName":"detectorId"
+        }
+      },
+      "deprecated":true,
+      "deprecatedMessage":"This input is deprecated, use DisassociateFromAdministratorAccountRequest instead"
+    },
+    "DisassociateFromMasterAccountResponse":{
+      "type":"structure",
+      "members":{
+      },
+      "deprecated":true,
+      "deprecatedMessage":"This output is deprecated, use DisassociateFromAdministratorAccountResponse instead"
+    },
     "DisassociateMembersRequest":{
       "type":"structure",
       "required":[
@@ -2254,6 +2474,16 @@
           "shape":"String",
           "documentation":"<p>The domain information for the API request.</p>",
           "locationName":"domain"
+        },
+        "Protocol":{
+          "shape":"String",
+          "documentation":"<p>The network connection protocol observed in the activity that prompted GuardDuty to generate the finding.</p>",
+          "locationName":"protocol"
+        },
+        "Blocked":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether the targeted port is blocked.</p>",
+          "locationName":"blocked"
         }
       },
       "documentation":"<p>Contains information about the DNS_REQUEST action described in this finding.</p>"
@@ -2570,6 +2800,29 @@
       },
       "documentation":"<p>Contains information about the location of the remote IP address.</p>"
     },
+    "GetAdministratorAccountRequest":{
+      "type":"structure",
+      "required":["DetectorId"],
+      "members":{
+        "DetectorId":{
+          "shape":"DetectorId",
+          "documentation":"<p>The unique ID of the detector of the GuardDuty member account.</p>",
+          "location":"uri",
+          "locationName":"detectorId"
+        }
+      }
+    },
+    "GetAdministratorAccountResponse":{
+      "type":"structure",
+      "required":["Administrator"],
+      "members":{
+        "Administrator":{
+          "shape":"Administrator",
+          "documentation":"<p>The administrator account details.</p>",
+          "locationName":"administrator"
+        }
+      }
+    },
     "GetDetectorRequest":{
       "type":"structure",
       "required":["DetectorId"],
@@ -2841,7 +3094,9 @@
           "location":"uri",
           "locationName":"detectorId"
         }
-      }
+      },
+      "deprecated":true,
+      "deprecatedMessage":"This input is deprecated, use GetAdministratorAccountRequest instead"
     },
     "GetMasterAccountResponse":{
       "type":"structure",
@@ -2852,7 +3107,9 @@
           "documentation":"<p>The administrator account details.</p>",
           "locationName":"master"
         }
-      }
+      },
+      "deprecated":true,
+      "deprecatedMessage":"This output is deprecated, use GetAdministratorAccountResponse instead"
     },
     "GetMemberDetectorsRequest":{
       "type":"structure",
@@ -2932,6 +3189,38 @@
         }
       }
     },
+    "GetRemainingFreeTrialDaysRequest":{
+      "type":"structure",
+      "required":["DetectorId"],
+      "members":{
+        "DetectorId":{
+          "shape":"DetectorId",
+          "documentation":"<p>The unique ID of the detector of the GuardDuty member account.</p>",
+          "location":"uri",
+          "locationName":"detectorId"
+        },
+        "AccountIds":{
+          "shape":"AccountIds",
+          "documentation":"<p>A list of account identifiers of the GuardDuty member account.</p>",
+          "locationName":"accountIds"
+        }
+      }
+    },
+    "GetRemainingFreeTrialDaysResponse":{
+      "type":"structure",
+      "members":{
+        "Accounts":{
+          "shape":"AccountFreeTrialInfos",
+          "documentation":"<p>The member accounts which were included in a request and were processed successfully.</p>",
+          "locationName":"accounts"
+        },
+        "UnprocessedAccounts":{
+          "shape":"UnprocessedAccounts",
+          "documentation":"<p>The member account that was included in a request but for which the request could not be processed.</p>",
+          "locationName":"unprocessedAccounts"
+        }
+      }
+    },
     "GetThreatIntelSetRequest":{
       "type":"structure",
       "required":[
@@ -3368,6 +3657,17 @@
       },
       "documentation":"<p>Describes whether any Kubernetes logs will be enabled as a data source.</p>"
     },
+    "KubernetesDataSourceFreeTrial":{
+      "type":"structure",
+      "members":{
+        "AuditLogs":{
+          "shape":"DataSourceFreeTrial",
+          "documentation":"<p>Describes whether Kubernetes audit logs are enabled as a data source.</p>",
+          "locationName":"auditLogs"
+        }
+      },
+      "documentation":"<p>Provides details about the Kubernetes resources when it is enabled as a data source.</p>"
+    },
     "KubernetesDetails":{
       "type":"structure",
       "members":{
@@ -3926,6 +4226,11 @@
           "shape":"String",
           "documentation":"<p>The last-updated timestamp of the member.</p>",
           "locationName":"updatedAt"
+        },
+        "AdministratorId":{
+          "shape":"String",
+          "documentation":"<p>The administrator account ID.</p>",
+          "locationName":"administratorId"
         }
       },
       "documentation":"<p>Contains information about the member account. </p>"
@@ -4308,12 +4613,12 @@
         "Code":{
           "shape":"String",
           "documentation":"<p>The product code information.</p>",
-          "locationName":"code"
+          "locationName":"productCodeId"
         },
         "ProductType":{
           "shape":"String",
           "documentation":"<p>The product code type.</p>",
-          "locationName":"productType"
+          "locationName":"productCodeType"
         }
       },
       "documentation":"<p>Contains information about the product code for the EC2 instance.</p>"
@@ -4609,10 +4914,31 @@
           "shape":"String",
           "documentation":"<p>Feedback that was submitted about the finding.</p>",
           "locationName":"userFeedback"
+        },
+        "AdditionalInfo":{
+          "shape":"ServiceAdditionalInfo",
+          "documentation":"<p>Contains additional information about the generated finding.</p>",
+          "locationName":"additionalInfo"
         }
       },
       "documentation":"<p>Contains additional information about the generated finding.</p>"
     },
+    "ServiceAdditionalInfo":{
+      "type":"structure",
+      "members":{
+        "Value":{
+          "shape":"String",
+          "documentation":"<p>This field specifies the value of the additional information.</p>",
+          "locationName":"value"
+        },
+        "Type":{
+          "shape":"String",
+          "documentation":"<p>Describes the type of the additional information.</p>",
+          "locationName":"type"
+        }
+      },
+      "documentation":"<p>Additional information about the generated finding.</p>"
+    },
     "SortCriteria":{
       "type":"structure",
       "members":{
@@ -5372,5 +5698,5 @@
       "member":{"shape":"Volume"}
     }
   },
-  "documentation":"<p>Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following data sources: VPC Flow Logs, Amazon Web Services CloudTrail event logs, and DNS logs. It uses threat intelligence feeds (such as lists of malicious IPs and domains) and machine learning to identify unexpected, potentially unauthorized, and malicious activity within your Amazon Web Services environment. This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IPs, URLs, or domains. For example, GuardDuty can detect compromised EC2 instances that serve malware or mine bitcoin. </p> <p>GuardDuty also monitors Amazon Web Services account access behavior for signs of compromise. Some examples of this are unauthorized infrastructure deployments such as EC2 instances deployed in a Region that has never been used, or unusual API calls like a password policy change to reduce password strength. </p> <p>GuardDuty informs you of the status of your Amazon Web Services environment by producing security findings that you can view in the GuardDuty console or through Amazon CloudWatch events. For more information, see the <i> <a href=\"https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html\">Amazon GuardDuty User Guide</a> </i>. </p>"
+  "documentation":"<p>Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following data sources: VPC Flow Logs, AWS CloudTrail management event logs, CloudTrail S3 data event logs, EKS audit logs, and DNS logs. It uses threat intelligence feeds (such as lists of malicious IPs and domains) and machine learning to identify unexpected, potentially unauthorized, and malicious activity within your Amazon Web Services environment. This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IPs, URLs, or domains. For example, GuardDuty can detect compromised EC2 instances that serve malware or mine bitcoin. </p> <p>GuardDuty also monitors Amazon Web Services account access behavior for signs of compromise. Some examples of this are unauthorized infrastructure deployments such as EC2 instances deployed in a Region that has never been used, or unusual API calls like a password policy change to reduce password strength. </p> <p>GuardDuty informs you of the status of your Amazon Web Services environment by producing security findings that you can view in the GuardDuty console or through Amazon CloudWatch events. For more information, see the <i> <a href=\"https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html\">Amazon GuardDuty User Guide</a> </i>. </p>"
 }
diff --git a/contrib/python/botocore/py3/botocore/data/lookoutmetrics/2017-07-25/service-2.json b/contrib/python/botocore/py3/botocore/data/lookoutmetrics/2017-07-25/service-2.json
index 14676d6b7b..9de4019526 100644
--- a/contrib/python/botocore/py3/botocore/data/lookoutmetrics/2017-07-25/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/lookoutmetrics/2017-07-25/service-2.json
@@ -461,6 +461,23 @@
       ],
       "documentation":"<p>Removes <a href=\"https://docs.aws.amazon.com/lookoutmetrics/latest/dev/detectors-tags.html\">tags</a> from a detector, dataset, or alert.</p>"
     },
+    "UpdateAlert":{
+      "name":"UpdateAlert",
+      "http":{
+        "method":"POST",
+        "requestUri":"/UpdateAlert"
+      },
+      "input":{"shape":"UpdateAlertRequest"},
+      "output":{"shape":"UpdateAlertResponse"},
+      "errors":[
+        {"shape":"ValidationException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"InternalServerException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"TooManyRequestsException"}
+      ],
+      "documentation":"<p>Make changes to an existing alert.</p>"
+    },
     "UpdateAnomalyDetector":{
       "name":"UpdateAnomalyDetector",
       "http":{
@@ -586,6 +603,10 @@
         "CreationTime":{
           "shape":"Timestamp",
           "documentation":"<p>The time at which the alert was created.</p>"
+        },
+        "AlertFilters":{
+          "shape":"AlertFilters",
+          "documentation":"<p>The configuration of the alert filters, containing MetricList and DimensionFilter.</p>"
         }
       },
       "documentation":"<p>A configuration for Amazon SNS-integrated notifications.</p>"
@@ -595,6 +616,20 @@
       "max":256,
       "pattern":".*\\S.*"
     },
+    "AlertFilters":{
+      "type":"structure",
+      "members":{
+        "MetricList":{
+          "shape":"MetricNameList",
+          "documentation":"<p>The list of measures that you want to get alerts for.</p>"
+        },
+        "DimensionFilterList":{
+          "shape":"DimensionFilterList",
+          "documentation":"<p>The list of DimensionFilter objects that are used for dimension-based filtering.</p>"
+        }
+      },
+      "documentation":"<p>The configuration of the alert filters.</p>"
+    },
     "AlertName":{
       "type":"string",
       "max":63,
@@ -1128,7 +1163,6 @@
       "type":"structure",
       "required":[
         "AlertName",
-        "AlertSensitivityThreshold",
         "AnomalyDetectorArn",
         "Action"
       ],
@@ -1156,6 +1190,10 @@
         "Tags":{
           "shape":"TagMap",
           "documentation":"<p>A list of <a href=\"https://docs.aws.amazon.com/lookoutmetrics/latest/dev/detectors-tags.html\">tags</a> to apply to the alert.</p>"
+        },
+        "AlertFilters":{
+          "shape":"AlertFilters",
+          "documentation":"<p>The configuration of the alert filters, containing MetricList and DimensionFilterList.</p>"
         }
       }
     },
@@ -1704,6 +1742,26 @@
       "type":"list",
       "member":{"shape":"DimensionContribution"}
     },
+    "DimensionFilter":{
+      "type":"structure",
+      "members":{
+        "DimensionName":{
+          "shape":"ColumnName",
+          "documentation":"<p>The name of the dimension to filter on.</p>"
+        },
+        "DimensionValueList":{
+          "shape":"DimensionValueList",
+          "documentation":"<p>The list of values for the dimension specified in DimensionName that you want to filter on.</p>"
+        }
+      },
+      "documentation":"<p>The dimension filter, containing DimensionName and DimensionValueList.</p>"
+    },
+    "DimensionFilterList":{
+      "type":"list",
+      "member":{"shape":"DimensionFilter"},
+      "max":5,
+      "min":1
+    },
     "DimensionList":{
       "type":"list",
       "member":{"shape":"ColumnName"},
@@ -1750,6 +1808,12 @@
       "type":"list",
       "member":{"shape":"DimensionValueContribution"}
     },
+    "DimensionValueList":{
+      "type":"list",
+      "member":{"shape":"DimensionValue"},
+      "max":10,
+      "min":1
+    },
     "ErrorMessage":{
       "type":"string",
       "max":256
@@ -2331,6 +2395,12 @@
       "max":256,
       "pattern":"^[a-zA-Z0-9][a-zA-Z0-9\\-_]*"
     },
+    "MetricNameList":{
+      "type":"list",
+      "member":{"shape":"MetricName"},
+      "max":5,
+      "min":1
+    },
     "MetricSetDescription":{
       "type":"string",
       "max":256,
@@ -2636,7 +2706,7 @@
         },
         "SnsFormat":{
           "shape":"SnsFormat",
-          "documentation":"<p>The format of the SNS topic.</p>"
+          "documentation":"<p>The format of the SNS topic.</p> <ul> <li> <p> <code>JSON</code> – Send JSON alerts with an anomaly ID and a link to the anomaly detail page. This is the default.</p> </li> <li> <p> <code>LONG_TEXT</code> – Send human-readable alerts with information about the impacted timeseries and a link to the anomaly detail page. We recommend this for email.</p> </li> <li> <p> <code>SHORT_TEXT</code> – Send human-readable alerts with a link to the anomaly detail page. We recommend this for SMS.</p> </li> </ul>"
         }
       },
       "documentation":"<p>Contains information about the SNS topic to which you want to send your alerts and the IAM role that has access to that topic.</p>"
@@ -2925,6 +2995,41 @@
       "members":{
       }
     },
+    "UpdateAlertRequest":{
+      "type":"structure",
+      "required":["AlertArn"],
+      "members":{
+        "AlertArn":{
+          "shape":"Arn",
+          "documentation":"<p>The ARN of the alert to update.</p>"
+        },
+        "AlertDescription":{
+          "shape":"AlertDescription",
+          "documentation":"<p>A description of the alert.</p>"
+        },
+        "AlertSensitivityThreshold":{
+          "shape":"SensitivityThreshold",
+          "documentation":"<p>An integer from 0 to 100 specifying the alert sensitivity threshold.</p>"
+        },
+        "Action":{
+          "shape":"Action",
+          "documentation":"<p>Action that will be triggered when there is an alert.</p>"
+        },
+        "AlertFilters":{
+          "shape":"AlertFilters",
+          "documentation":"<p>The configuration of the alert filters, containing MetricList and DimensionFilterList.</p>"
+        }
+      }
+    },
+    "UpdateAlertResponse":{
+      "type":"structure",
+      "members":{
+        "AlertArn":{
+          "shape":"Arn",
+          "documentation":"<p>The ARN of the updated alert.</p>"
+        }
+      }
+    },
     "UpdateAnomalyDetectorRequest":{
       "type":"structure",
       "required":["AnomalyDetectorArn"],
diff --git a/contrib/python/botocore/py3/botocore/data/mediaconvert/2017-08-29/service-2.json b/contrib/python/botocore/py3/botocore/data/mediaconvert/2017-08-29/service-2.json
index 8ef68daa34..884b600c9c 100644
--- a/contrib/python/botocore/py3/botocore/data/mediaconvert/2017-08-29/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/mediaconvert/2017-08-29/service-2.json
@@ -1737,6 +1737,16 @@
       },
       "documentation": "Settings related to one audio tab on the MediaConvert console. In your job JSON, an instance of AudioDescription is equivalent to one audio tab in the console. Usually, one audio tab corresponds to one output audio track. Depending on how you set up your input audio selectors and whether you use audio selector groups, one audio tab can correspond to a group of output audio tracks."
     },
+    "AudioDurationCorrection": {
+      "type": "string",
+      "documentation": "Apply audio timing corrections to help synchronize audio and video in your output. To apply timing corrections, your input must meet the following requirements: * Container: MP4, or MOV, with an accurate time-to-sample (STTS) table. * Audio track: AAC. Choose from the following audio timing correction settings: * Disabled (Default): Apply no correction. * Auto: Recommended for most inputs. MediaConvert analyzes the audio timing in your input and determines which correction setting to use, if needed. * Track: Adjust the duration of each audio frame by a constant amount to align the audio track length with STTS duration. Track-level correction does not affect pitch, and is recommended for tonal audio content such as music. * Frame: Adjust the duration of each audio frame by a variable amount to align audio frames with STTS timestamps. No corrections are made to already-aligned frames. Frame-level correction may affect the pitch of corrected frames, and is recommended for atonal audio content such as speech or percussion.",
+      "enum": [
+        "DISABLED",
+        "AUTO",
+        "TRACK",
+        "FRAME"
+      ]
+    },
     "AudioLanguageCodeControl": {
       "type": "string",
       "documentation": "Specify which source for language code takes precedence for this audio track. When you choose Follow input (FOLLOW_INPUT), the service uses the language code from the input track if it's present. If there's no languge code on the input track, the service uses the code that you specify in the setting Language code (languageCode or customLanguageCode). When you choose Use configured (USE_CONFIGURED), the service uses the language code that you specify.",
@@ -1818,6 +1828,11 @@
     "AudioSelector": {
       "type": "structure",
       "members": {
+        "AudioDurationCorrection": {
+          "shape": "AudioDurationCorrection",
+          "locationName": "audioDurationCorrection",
+          "documentation": "Apply audio timing corrections to help synchronize audio and video in your output. To apply timing corrections, your input must meet the following requirements: * Container: MP4, or MOV, with an accurate time-to-sample (STTS) table. * Audio track: AAC. Choose from the following audio timing correction settings: * Disabled (Default): Apply no correction. * Auto: Recommended for most inputs. MediaConvert analyzes the audio timing in your input and determines which correction setting to use, if needed. * Track: Adjust the duration of each audio frame by a constant amount to align the audio track length with STTS duration. Track-level correction does not affect pitch, and is recommended for tonal audio content such as music. * Frame: Adjust the duration of each audio frame by a variable amount to align audio frames with STTS timestamps. No corrections are made to already-aligned frames. Frame-level correction may affect the pitch of corrected frames, and is recommended for atonal audio content such as speech or percussion."
+        },
         "CustomLanguageCode": {
           "shape": "__stringMin3Max3PatternAZaZ3",
           "locationName": "customLanguageCode",
@@ -7056,7 +7071,7 @@
         "VideoGenerator": {
           "shape": "InputVideoGenerator",
           "locationName": "videoGenerator",
-          "documentation": "Use this setting if you do not have a video input or if you want to add black video frames before, or after, other inputs. When you include Video generator, MediaConvert creates a video input with black frames and without an audio track. You can specify a value for Video generator, or you can specify an Input file, but you cannot specify both."
+          "documentation": "When you include Video generator, MediaConvert creates a video input with black frames. Use this setting if you do not have a video input or if you want to add black video frames before, or after, other inputs. You can specify Video generator, or you can specify an Input file, but you cannot specify both. For more information, see https://docs.aws.amazon.com/mediaconvert/latest/ug/video-generator.html"
         },
         "VideoSelector": {
           "shape": "VideoSelector",
@@ -7291,7 +7306,7 @@
           "documentation": "Specify an integer value for Black video duration from 50 to 86400000 to generate a black video input for that many milliseconds. Required when you include Video generator."
         }
       },
-      "documentation": "Use this setting if you do not have a video input or if you want to add black video frames before, or after, other inputs. When you include Video generator, MediaConvert creates a video input with black frames and without an audio track. You can specify a value for Video generator, or you can specify an Input file, but you cannot specify both."
+      "documentation": "When you include Video generator, MediaConvert creates a video input with black frames. Use this setting if you do not have a video input or if you want to add black video frames before, or after, other inputs. You can specify Video generator, or you can specify an Input file, but you cannot specify both. For more information, see https://docs.aws.amazon.com/mediaconvert/latest/ug/video-generator.html"
     },
     "InsertableImage": {
       "type": "structure",
diff --git a/contrib/python/botocore/py3/botocore/data/redshift-data/2019-12-20/service-2.json b/contrib/python/botocore/py3/botocore/data/redshift-data/2019-12-20/service-2.json
index 6012e59ca4..371ee4b64f 100644
--- a/contrib/python/botocore/py3/botocore/data/redshift-data/2019-12-20/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/redshift-data/2019-12-20/service-2.json
@@ -26,7 +26,7 @@
         {"shape":"ActiveStatementsExceededException"},
         {"shape":"BatchExecuteStatementException"}
       ],
-      "documentation":"<p>Runs one or more SQL statements, which can be data manipulation language (DML) or data definition language (DDL). Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless endpoint, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless endpoint, specify the database name. </p> </li> </ul>"
+      "documentation":"<p>Runs one or more SQL statements, which can be data manipulation language (DML) or data definition language (DDL). Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless workgroup, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless workgroup, specify the workgroup name and database name. Also, permission to call the <code>redshift-serverless:GetCredentials</code> operation is required. </p> </li> </ul>"
     },
     "CancelStatement":{
       "name":"CancelStatement",
@@ -72,7 +72,7 @@
         {"shape":"InternalServerException"},
         {"shape":"DatabaseConnectionException"}
       ],
-      "documentation":"<p>Describes the detailed information about a table from metadata in the cluster. The information includes its columns. A token is returned to page through the column list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless endpoint, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless endpoint, specify the database name. </p> </li> </ul>"
+      "documentation":"<p>Describes the detailed information about a table from metadata in the cluster. The information includes its columns. A token is returned to page through the column list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless workgroup, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless workgroup, specify the workgroup name and database name. Also, permission to call the <code>redshift-serverless:GetCredentials</code> operation is required. </p> </li> </ul>"
     },
     "ExecuteStatement":{
       "name":"ExecuteStatement",
@@ -87,7 +87,7 @@
         {"shape":"ExecuteStatementException"},
         {"shape":"ActiveStatementsExceededException"}
       ],
-      "documentation":"<p>Runs an SQL statement, which can be data manipulation language (DML) or data definition language (DDL). This statement must be a single SQL statement. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless endpoint, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless endpoint, specify the database name. </p> </li> </ul>"
+      "documentation":"<p>Runs an SQL statement, which can be data manipulation language (DML) or data definition language (DDL). This statement must be a single SQL statement. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless workgroup, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless workgroup, specify the workgroup name and database name. Also, permission to call the <code>redshift-serverless:GetCredentials</code> operation is required. </p> </li> </ul>"
     },
     "GetStatementResult":{
       "name":"GetStatementResult",
@@ -117,7 +117,7 @@
         {"shape":"InternalServerException"},
         {"shape":"DatabaseConnectionException"}
       ],
-      "documentation":"<p>List the databases in a cluster. A token is returned to page through the database list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless endpoint, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless endpoint, specify the database name. </p> </li> </ul>"
+      "documentation":"<p>List the databases in a cluster. A token is returned to page through the database list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless workgroup, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless workgroup, specify the workgroup name and database name. Also, permission to call the <code>redshift-serverless:GetCredentials</code> operation is required. </p> </li> </ul>"
     },
     "ListSchemas":{
       "name":"ListSchemas",
@@ -132,7 +132,7 @@
         {"shape":"InternalServerException"},
         {"shape":"DatabaseConnectionException"}
       ],
-      "documentation":"<p>Lists the schemas in a database. A token is returned to page through the schema list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless endpoint, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless endpoint, specify the database name. </p> </li> </ul>"
+      "documentation":"<p>Lists the schemas in a database. A token is returned to page through the schema list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless workgroup, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless workgroup, specify the workgroup name and database name. Also, permission to call the <code>redshift-serverless:GetCredentials</code> operation is required. </p> </li> </ul>"
     },
     "ListStatements":{
       "name":"ListStatements",
@@ -161,7 +161,7 @@
         {"shape":"InternalServerException"},
         {"shape":"DatabaseConnectionException"}
       ],
-      "documentation":"<p>List the tables in a database. If neither <code>SchemaPattern</code> nor <code>TablePattern</code> are specified, then all tables in the database are returned. A token is returned to page through the table list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless endpoint, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless endpoint, specify the database name. </p> </li> </ul>"
+      "documentation":"<p>List the tables in a database. If neither <code>SchemaPattern</code> nor <code>TablePattern</code> are specified, then all tables in the database are returned. A token is returned to page through the table list. Depending on the authorization method, use one of the following combinations of request parameters: </p> <ul> <li> <p>Secrets Manager - when connecting to a cluster, specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret. When connecting to a serverless workgroup, specify the Amazon Resource Name (ARN) of the secret and the database name. </p> </li> <li> <p>Temporary credentials - when connecting to a cluster, specify the cluster identifier, the database name, and the database user name. Also, permission to call the <code>redshift:GetClusterCredentials</code> operation is required. When connecting to a serverless workgroup, specify the workgroup name and database name. Also, permission to call the <code>redshift-serverless:GetCredentials</code> operation is required. </p> </li> </ul>"
     }
   },
   "shapes":{
@@ -224,6 +224,10 @@
         "WithEvent":{
           "shape":"Boolean",
           "documentation":"<p>A value that indicates whether to send an event to the Amazon EventBridge event bus after the SQL statements run. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.</p>"
         }
       }
     },
@@ -232,7 +236,7 @@
       "members":{
         "ClusterIdentifier":{
           "shape":"Location",
-          "documentation":"<p>The cluster identifier. This parameter is not returned when connecting to a serverless endpoint. </p>"
+          "documentation":"<p>The cluster identifier. This element is not returned when connecting to a serverless workgroup. </p>"
         },
         "CreatedAt":{
           "shape":"Timestamp",
@@ -253,6 +257,10 @@
         "SecretArn":{
           "shape":"SecretArn",
           "documentation":"<p>The name or ARN of the secret that enables access to the database. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This element is not returned when connecting to a provisioned cluster.</p>"
         }
       }
     },
@@ -457,6 +465,10 @@
         "UpdatedAt":{
           "shape":"Timestamp",
           "documentation":"<p>The date and time (UTC) that the metadata for the SQL statement was last updated. An example is the time the status last changed. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name.</p>"
         }
       }
     },
@@ -499,6 +511,10 @@
         "Table":{
           "shape":"String",
           "documentation":"<p>The table name. If no table is specified, then all tables for all matching schemas are returned. If no table and no schema is specified, then all tables for all schemas in the database are returned</p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.</p>"
         }
       }
     },
@@ -577,6 +593,10 @@
         "WithEvent":{
           "shape":"Boolean",
           "documentation":"<p>A value that indicates whether to send an event to the Amazon EventBridge event bus after the SQL statement runs. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.</p>"
         }
       }
     },
@@ -585,7 +605,7 @@
       "members":{
         "ClusterIdentifier":{
           "shape":"Location",
-          "documentation":"<p>The cluster identifier. This parameter is not returned when connecting to a serverless endpoint. </p>"
+          "documentation":"<p>The cluster identifier. This element is not returned when connecting to a serverless workgroup. </p>"
         },
         "CreatedAt":{
           "shape":"Timestamp",
@@ -606,6 +626,10 @@
         "SecretArn":{
           "shape":"SecretArn",
           "documentation":"<p>The name or ARN of the secret that enables access to the database. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This element is not returned when connecting to a provisioned cluster.</p>"
         }
       }
     },
@@ -721,6 +745,10 @@
         "SecretArn":{
           "shape":"SecretArn",
           "documentation":"<p>The name or ARN of the secret that enables access to the database. This parameter is required when authenticating using Secrets Manager. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.</p>"
         }
       }
     },
@@ -772,6 +800,10 @@
         "SecretArn":{
           "shape":"SecretArn",
           "documentation":"<p>The name or ARN of the secret that enables access to the database. This parameter is required when authenticating using Secrets Manager. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.</p>"
         }
       }
     },
@@ -871,6 +903,10 @@
         "TablePattern":{
           "shape":"String",
           "documentation":"<p>A pattern to filter results by table name. Within a table pattern, \"%\" means match any substring of 0 or more characters and \"_\" means match any one character. Only table name entries matching the search pattern are returned. If <code>TablePattern</code> is not specified, then all tables that match <code>SchemaPattern</code>are returned. If neither <code>SchemaPattern</code> or <code>TablePattern</code> are specified, then all tables are returned. </p>"
+        },
+        "WorkgroupName":{
+          "shape":"WorkgroupNameString",
+          "documentation":"<p>The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.</p>"
         }
       }
     },
@@ -1137,7 +1173,13 @@
       "documentation":"<p>The Amazon Redshift Data API operation failed due to invalid input. </p>",
       "exception":true
     },
+    "WorkgroupNameString":{
+      "type":"string",
+      "max":64,
+      "min":3,
+      "pattern":"^[a-z0-9-]+$"
+    },
     "bool":{"type":"boolean"}
   },
-  "documentation":"<p>You can use the Amazon Redshift Data API to run queries on Amazon Redshift tables. You can run SQL statements, which are committed if the statement succeeds. </p> <p>For more information about the Amazon Redshift Data API, see <a href=\"https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.html\">Using the Amazon Redshift Data API</a> in the <i>Amazon Redshift Cluster Management Guide</i>. </p>"
+  "documentation":"<p>You can use the Amazon Redshift Data API to run queries on Amazon Redshift tables. You can run SQL statements, which are committed if the statement succeeds. </p> <p>For more information about the Amazon Redshift Data API and CLI usage examples, see <a href=\"https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.html\">Using the Amazon Redshift Data API</a> in the <i>Amazon Redshift Cluster Management Guide</i>. </p>"
 }
diff --git a/contrib/python/botocore/py3/botocore/data/redshiftserverless/2021-04-21/paginators-1.json b/contrib/python/botocore/py3/botocore/data/redshiftserverless/2021-04-21/paginators-1.json
new file mode 100644
index 0000000000..cf5163d450
--- /dev/null
+++ b/contrib/python/botocore/py3/botocore/data/redshiftserverless/2021-04-21/paginators-1.json
@@ -0,0 +1,40 @@
+{
+  "pagination": {
+    "ListEndpointAccess": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "endpoints"
+    },
+    "ListNamespaces": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "namespaces"
+    },
+    "ListRecoveryPoints": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "recoveryPoints"
+    },
+    "ListSnapshots": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "snapshots"
+    },
+    "ListUsageLimits": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "usageLimits"
+    },
+    "ListWorkgroups": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "workgroups"
+    }
+  }
+}
diff --git a/contrib/python/botocore/py3/botocore/data/redshiftserverless/2021-04-21/service-2.json b/contrib/python/botocore/py3/botocore/data/redshiftserverless/2021-04-21/service-2.json
new file mode 100644
index 0000000000..192dacd55b
--- /dev/null
+++ b/contrib/python/botocore/py3/botocore/data/redshiftserverless/2021-04-21/service-2.json
@@ -0,0 +1,2468 @@
+{
+  "version":"2.0",
+  "metadata":{
+    "apiVersion":"2021-04-21",
+    "endpointPrefix":"redshift-serverless",
+    "jsonVersion":"1.1",
+    "protocol":"json",
+    "serviceFullName":"Redshift Serverless",
+    "serviceId":"RedshiftServerless",
+    "signatureVersion":"v4",
+    "signingName":"redshift-serverless",
+    "targetPrefix":"RedshiftServerless",
+    "uid":"redshiftserverless-2021-04-21"
+  },
+  "operations":{
+    "ConvertRecoveryPointToSnapshot":{
+      "name":"ConvertRecoveryPointToSnapshot",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ConvertRecoveryPointToSnapshotRequest"},
+      "output":{"shape":"ConvertRecoveryPointToSnapshotResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"ServiceQuotaExceededException"}
+      ],
+      "documentation":"<p>Converts a recovery point to a snapshot. For more information about recovery points and snapshots, see <a href=\"https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-snapshots-recovery.html\">Working with snapshots and recovery points</a>.</p>"
+    },
+    "CreateEndpointAccess":{
+      "name":"CreateEndpointAccess",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateEndpointAccessRequest"},
+      "output":{"shape":"CreateEndpointAccessResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ServiceQuotaExceededException"}
+      ],
+      "documentation":"<p>Creates an Amazon Redshift Serverless managed VPC endpoint.</p>",
+      "idempotent":true
+    },
+    "CreateNamespace":{
+      "name":"CreateNamespace",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateNamespaceRequest"},
+      "output":{"shape":"CreateNamespaceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"TooManyTagsException"}
+      ],
+      "documentation":"<p>Creates a namespace in Amazon Redshift Serverless.</p>",
+      "idempotent":true
+    },
+    "CreateSnapshot":{
+      "name":"CreateSnapshot",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateSnapshotRequest"},
+      "output":{"shape":"CreateSnapshotResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"ServiceQuotaExceededException"}
+      ],
+      "documentation":"<p>Creates a snapshot of all databases in a namespace. For more information about snapshots, see <a href=\"https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-snapshots-recovery.html\"> Working with snapshots and recovery points</a>.</p>",
+      "idempotent":true
+    },
+    "CreateUsageLimit":{
+      "name":"CreateUsageLimit",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateUsageLimitRequest"},
+      "output":{"shape":"CreateUsageLimitResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"ServiceQuotaExceededException"}
+      ],
+      "documentation":"<p>Creates a usage limit for a specified Amazon Redshift Serverless usage type. The usage limit is identified by the returned usage limit identifier. </p>",
+      "idempotent":true
+    },
+    "CreateWorkgroup":{
+      "name":"CreateWorkgroup",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateWorkgroupRequest"},
+      "output":{"shape":"CreateWorkgroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"InsufficientCapacityException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"TooManyTagsException"}
+      ],
+      "documentation":"<p>Creates an workgroup in Amazon Redshift Serverless.</p>",
+      "idempotent":true
+    },
+    "DeleteEndpointAccess":{
+      "name":"DeleteEndpointAccess",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DeleteEndpointAccessRequest"},
+      "output":{"shape":"DeleteEndpointAccessResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Deletes an Amazon Redshift Serverless managed VPC endpoint.</p>",
+      "idempotent":true
+    },
+    "DeleteNamespace":{
+      "name":"DeleteNamespace",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DeleteNamespaceRequest"},
+      "output":{"shape":"DeleteNamespaceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Deletes a namespace from Amazon Redshift Serverless. Before you delete the namespace, you can create a final snapshot that has all of the data within the namespace.</p>",
+      "idempotent":true
+    },
+    "DeleteResourcePolicy":{
+      "name":"DeleteResourcePolicy",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DeleteResourcePolicyRequest"},
+      "output":{"shape":"DeleteResourcePolicyResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Deletes the specified resource policy.</p>"
+    },
+    "DeleteSnapshot":{
+      "name":"DeleteSnapshot",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DeleteSnapshotRequest"},
+      "output":{"shape":"DeleteSnapshotResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Deletes a snapshot from Amazon Redshift Serverless.</p>",
+      "idempotent":true
+    },
+    "DeleteUsageLimit":{
+      "name":"DeleteUsageLimit",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DeleteUsageLimitRequest"},
+      "output":{"shape":"DeleteUsageLimitResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Deletes a usage limit from Amazon Redshift Serverless.</p>",
+      "idempotent":true
+    },
+    "DeleteWorkgroup":{
+      "name":"DeleteWorkgroup",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DeleteWorkgroupRequest"},
+      "output":{"shape":"DeleteWorkgroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Deletes a workgroup.</p>",
+      "idempotent":true
+    },
+    "GetCredentials":{
+      "name":"GetCredentials",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetCredentialsRequest"},
+      "output":{"shape":"GetCredentialsResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns a database user name and temporary password with temporary authorization to log in to Amazon Redshift Serverless.</p> <p>By default, the temporary credentials expire in 900 seconds. You can optionally specify a duration between 900 seconds (15 minutes) and 3600 seconds (60 minutes).</p> <pre><code> &lt;p&gt; The Identity and Access Management (IAM) user or role that runs GetCredentials must have an IAM policy attached that allows access to all necessary actions and resources. &lt;/p&gt; &lt;p&gt; If the &lt;code&gt;DbName&lt;/code&gt; parameter is specified, the IAM policy must allow access to the resource dbname for the specified database name.&lt;/p&gt; </code></pre>"
+    },
+    "GetEndpointAccess":{
+      "name":"GetEndpointAccess",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetEndpointAccessRequest"},
+      "output":{"shape":"GetEndpointAccessResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information, such as the name, about a VPC endpoint.</p>"
+    },
+    "GetNamespace":{
+      "name":"GetNamespace",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetNamespaceRequest"},
+      "output":{"shape":"GetNamespaceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a namespace in Amazon Redshift Serverless.</p>"
+    },
+    "GetRecoveryPoint":{
+      "name":"GetRecoveryPoint",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetRecoveryPointRequest"},
+      "output":{"shape":"GetRecoveryPointResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a recovery point.</p>"
+    },
+    "GetResourcePolicy":{
+      "name":"GetResourcePolicy",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetResourcePolicyRequest"},
+      "output":{"shape":"GetResourcePolicyResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns a resource policy.</p>"
+    },
+    "GetSnapshot":{
+      "name":"GetSnapshot",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetSnapshotRequest"},
+      "output":{"shape":"GetSnapshotResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a specific snapshot.</p>"
+    },
+    "GetUsageLimit":{
+      "name":"GetUsageLimit",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetUsageLimitRequest"},
+      "output":{"shape":"GetUsageLimitResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a usage limit.</p>"
+    },
+    "GetWorkgroup":{
+      "name":"GetWorkgroup",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"GetWorkgroupRequest"},
+      "output":{"shape":"GetWorkgroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a specific workgroup.</p>"
+    },
+    "ListEndpointAccess":{
+      "name":"ListEndpointAccess",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListEndpointAccessRequest"},
+      "output":{"shape":"ListEndpointAccessResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns an array of <code>EndpointAccess</code> objects and relevant information.</p>"
+    },
+    "ListNamespaces":{
+      "name":"ListNamespaces",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListNamespacesRequest"},
+      "output":{"shape":"ListNamespacesResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a list of specified namespaces.</p>"
+    },
+    "ListRecoveryPoints":{
+      "name":"ListRecoveryPoints",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListRecoveryPointsRequest"},
+      "output":{"shape":"ListRecoveryPointsResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns an array of recovery points.</p>"
+    },
+    "ListSnapshots":{
+      "name":"ListSnapshots",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListSnapshotsRequest"},
+      "output":{"shape":"ListSnapshotsResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns a list of snapshots.</p>"
+    },
+    "ListTagsForResource":{
+      "name":"ListTagsForResource",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListTagsForResourceRequest"},
+      "output":{"shape":"ListTagsForResourceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"}
+      ],
+      "documentation":"<p>Lists the tags assigned to a resource.</p>"
+    },
+    "ListUsageLimits":{
+      "name":"ListUsageLimits",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListUsageLimitsRequest"},
+      "output":{"shape":"ListUsageLimitsResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"InvalidPaginationException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Lists all usage limits within Amazon Redshift Serverless.</p>"
+    },
+    "ListWorkgroups":{
+      "name":"ListWorkgroups",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"ListWorkgroupsRequest"},
+      "output":{"shape":"ListWorkgroupsResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Returns information about a list of specified workgroups.</p>"
+    },
+    "PutResourcePolicy":{
+      "name":"PutResourcePolicy",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"PutResourcePolicyRequest"},
+      "output":{"shape":"PutResourcePolicyResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"ServiceQuotaExceededException"}
+      ],
+      "documentation":"<p>Creates or updates a resource policy. Currently, you can use policies to share snapshots across Amazon Web Services accounts.</p>"
+    },
+    "RestoreFromRecoveryPoint":{
+      "name":"RestoreFromRecoveryPoint",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"RestoreFromRecoveryPointRequest"},
+      "output":{"shape":"RestoreFromRecoveryPointResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Restore the data from a recovery point.</p>"
+    },
+    "RestoreFromSnapshot":{
+      "name":"RestoreFromSnapshot",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"RestoreFromSnapshotRequest"},
+      "output":{"shape":"RestoreFromSnapshotResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"ServiceQuotaExceededException"}
+      ],
+      "documentation":"<p>Restores a namespace from a snapshot.</p>",
+      "idempotent":true
+    },
+    "TagResource":{
+      "name":"TagResource",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"TagResourceRequest"},
+      "output":{"shape":"TagResourceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"},
+        {"shape":"TooManyTagsException"},
+        {"shape":"ThrottlingException"}
+      ],
+      "documentation":"<p>Assigns one or more tags to a resource.</p>"
+    },
+    "UntagResource":{
+      "name":"UntagResource",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"UntagResourceRequest"},
+      "output":{"shape":"UntagResourceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"},
+        {"shape":"ThrottlingException"}
+      ],
+      "documentation":"<p>Removes a tag or set of tags from a resource.</p>"
+    },
+    "UpdateEndpointAccess":{
+      "name":"UpdateEndpointAccess",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"UpdateEndpointAccessRequest"},
+      "output":{"shape":"UpdateEndpointAccessResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"},
+        {"shape":"AccessDeniedException"}
+      ],
+      "documentation":"<p>Updates an Amazon Redshift Serverless managed endpoint.</p>"
+    },
+    "UpdateNamespace":{
+      "name":"UpdateNamespace",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"UpdateNamespaceRequest"},
+      "output":{"shape":"UpdateNamespaceResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Updates a namespace with the specified settings.</p>"
+    },
+    "UpdateSnapshot":{
+      "name":"UpdateSnapshot",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"UpdateSnapshotRequest"},
+      "output":{"shape":"UpdateSnapshotResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Updates a snapshot.</p>"
+    },
+    "UpdateUsageLimit":{
+      "name":"UpdateUsageLimit",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"UpdateUsageLimitRequest"},
+      "output":{"shape":"UpdateUsageLimitResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Update a usage limit in Amazon Redshift Serverless. You can't update the usage type or period of a usage limit.</p>"
+    },
+    "UpdateWorkgroup":{
+      "name":"UpdateWorkgroup",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"UpdateWorkgroupRequest"},
+      "output":{"shape":"UpdateWorkgroupResponse"},
+      "errors":[
+        {"shape":"InternalServerException"},
+        {"shape":"InsufficientCapacityException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
+      ],
+      "documentation":"<p>Updates a workgroup with the specified configuration settings.</p>"
+    }
+  },
+  "shapes":{
+    "AccessDeniedException":{
+      "type":"structure",
+      "members":{
+        "code":{"shape":"String"},
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>You do not have sufficient access to perform this action.</p>",
+      "exception":true
+    },
+    "AccountIdList":{
+      "type":"list",
+      "member":{"shape":"String"}
+    },
+    "AmazonResourceName":{
+      "type":"string",
+      "max":1011,
+      "min":1
+    },
+    "Boolean":{
+      "type":"boolean",
+      "box":true
+    },
+    "ConfigParameter":{
+      "type":"structure",
+      "members":{
+        "parameterKey":{
+          "shape":"ParameterKey",
+          "documentation":"<p>The key of the parameter. The options are <code>datestyle</code>, <code>enable_user_activity_logging</code>, <code>query_group</code>, <code>search_path</code>, and <code>max_query_execution_time</code>.</p>"
+        },
+        "parameterValue":{
+          "shape":"ParameterValue",
+          "documentation":"<p>The value of the parameter to set.</p>"
+        }
+      },
+      "documentation":"<p>An array of key-value pairs to set for advanced control over Amazon Redshift Serverless.</p>"
+    },
+    "ConfigParameterList":{
+      "type":"list",
+      "member":{"shape":"ConfigParameter"}
+    },
+    "ConflictException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>The submitted action has conflicts.</p>",
+      "exception":true
+    },
+    "ConvertRecoveryPointToSnapshotRequest":{
+      "type":"structure",
+      "required":[
+        "recoveryPointId",
+        "snapshotName"
+      ],
+      "members":{
+        "recoveryPointId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the recovery point.</p>"
+        },
+        "retentionPeriod":{
+          "shape":"Integer",
+          "documentation":"<p>How long to retain the snapshot.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot.</p>"
+        }
+      }
+    },
+    "ConvertRecoveryPointToSnapshotResponse":{
+      "type":"structure",
+      "members":{
+        "snapshot":{
+          "shape":"Snapshot",
+          "documentation":"<p>The snapshot converted from the recovery point.</p>"
+        }
+      }
+    },
+    "CreateEndpointAccessRequest":{
+      "type":"structure",
+      "required":[
+        "endpointName",
+        "subnetIds",
+        "workgroupName"
+      ],
+      "members":{
+        "endpointName":{
+          "shape":"String",
+          "documentation":"<p>The name of the VPC endpoint. An endpoint name must contain 1-30 characters. Valid characters are A-Z, a-z, 0-9, and hyphen(-). The first character must be a letter. The name can't contain two consecutive hyphens or end with a hyphen.</p>"
+        },
+        "subnetIds":{
+          "shape":"SubnetIdList",
+          "documentation":"<p>The unique identifers of subnets from which Amazon Redshift Serverless chooses one to deploy a VPC endpoint.</p>"
+        },
+        "vpcSecurityGroupIds":{
+          "shape":"VpcSecurityGroupIdList",
+          "documentation":"<p>The unique identifiers of the security group that defines the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.</p>"
+        },
+        "workgroupName":{
+          "shape":"String",
+          "documentation":"<p>The name of the workgroup to associate with the VPC endpoint.</p>"
+        }
+      }
+    },
+    "CreateEndpointAccessResponse":{
+      "type":"structure",
+      "members":{
+        "endpoint":{
+          "shape":"EndpointAccess",
+          "documentation":"<p>The created VPC endpoint.</p>"
+        }
+      }
+    },
+    "CreateNamespaceRequest":{
+      "type":"structure",
+      "required":["namespaceName"],
+      "members":{
+        "adminUserPassword":{
+          "shape":"DbPassword",
+          "documentation":"<p>The password of the administrator for the first database created in the namespace.</p>"
+        },
+        "adminUsername":{
+          "shape":"DbUser",
+          "documentation":"<p>The username of the administrator for the first database created in the namespace.</p>"
+        },
+        "dbName":{
+          "shape":"String",
+          "documentation":"<p>The name of the first database created in the namespace.</p>"
+        },
+        "defaultIamRoleArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace.</p>"
+        },
+        "iamRoles":{
+          "shape":"IamRoleArnList",
+          "documentation":"<p>A list of IAM roles to associate with the namespace.</p>"
+        },
+        "kmsKeyId":{
+          "shape":"String",
+          "documentation":"<p>The ID of the Amazon Web Services Key Management Service key used to encrypt your data.</p>"
+        },
+        "logExports":{
+          "shape":"LogExportList",
+          "documentation":"<p>The types of logs the namespace can export. Available export types are <code>userlog</code>, <code>connectionlog</code>, and <code>useractivitylog</code>.</p>"
+        },
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace.</p>"
+        },
+        "tags":{
+          "shape":"TagList",
+          "documentation":"<p>A list of tag instances.</p>"
+        }
+      }
+    },
+    "CreateNamespaceResponse":{
+      "type":"structure",
+      "members":{
+        "namespace":{
+          "shape":"Namespace",
+          "documentation":"<p>The created namespace object.</p>"
+        }
+      }
+    },
+    "CreateSnapshotRequest":{
+      "type":"structure",
+      "required":[
+        "namespaceName",
+        "snapshotName"
+      ],
+      "members":{
+        "namespaceName":{
+          "shape":"String",
+          "documentation":"<p>The namespace to create a snapshot for.</p>"
+        },
+        "retentionPeriod":{
+          "shape":"Integer",
+          "documentation":"<p>How long to retain the created snapshot.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot.</p>"
+        }
+      }
+    },
+    "CreateSnapshotResponse":{
+      "type":"structure",
+      "members":{
+        "snapshot":{
+          "shape":"Snapshot",
+          "documentation":"<p>The created snapshot object.</p>"
+        }
+      }
+    },
+    "CreateUsageLimitRequest":{
+      "type":"structure",
+      "required":[
+        "amount",
+        "resourceArn",
+        "usageType"
+      ],
+      "members":{
+        "amount":{
+          "shape":"Long",
+          "documentation":"<p>The limit amount. If time-based, this amount is in Redshift Processing Units (RPU) consumed per hour. If data-based, this amount is in terabytes (TB) of data transferred between Regions in cross-account sharing. The value must be a positive number.</p>"
+        },
+        "breachAction":{
+          "shape":"UsageLimitBreachAction",
+          "documentation":"<p>The action that Amazon Redshift Serverless takes when the limit is reached. The default is log.</p>"
+        },
+        "period":{
+          "shape":"UsageLimitPeriod",
+          "documentation":"<p>The time period that the amount applies to. A weekly period begins on Sunday. The default is monthly.</p>"
+        },
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the Amazon Redshift Serverless resource to create the usage limit for.</p>"
+        },
+        "usageType":{
+          "shape":"UsageLimitUsageType",
+          "documentation":"<p>The type of Amazon Redshift Serverless usage to create a usage limit for.</p>"
+        }
+      }
+    },
+    "CreateUsageLimitResponse":{
+      "type":"structure",
+      "members":{
+        "usageLimit":{
+          "shape":"UsageLimit",
+          "documentation":"<p>The returned usage limit object.</p>"
+        }
+      }
+    },
+    "CreateWorkgroupRequest":{
+      "type":"structure",
+      "required":[
+        "namespaceName",
+        "workgroupName"
+      ],
+      "members":{
+        "baseCapacity":{
+          "shape":"Integer",
+          "documentation":"<p>The base data warehouse capacity of the workgroup in Redshift Processing Units (RPUs).</p>"
+        },
+        "configParameters":{
+          "shape":"ConfigParameterList",
+          "documentation":"<p>An array of parameters to set for more control over a serverless database. The options are <code>datestyle</code>, <code>enable_user_activity_logging</code>, <code>query_group</code>, <code>search_path</code>, and <code>max_query_execution_time</code>.</p>"
+        },
+        "enhancedVpcRouting":{
+          "shape":"Boolean",
+          "documentation":"<p>The value that specifies whether to turn on enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC instead of over the internet.</p>"
+        },
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace to associate with the workgroup.</p>"
+        },
+        "publiclyAccessible":{
+          "shape":"Boolean",
+          "documentation":"<p>A value that specifies whether the workgroup can be accessed from a public network.</p>"
+        },
+        "securityGroupIds":{
+          "shape":"SecurityGroupIdList",
+          "documentation":"<p>An array of security group IDs to associate with the workgroup.</p>"
+        },
+        "subnetIds":{
+          "shape":"SubnetIdList",
+          "documentation":"<p>An array of VPC subnet IDs to associate with the workgroup.</p>"
+        },
+        "tags":{
+          "shape":"TagList",
+          "documentation":"<p>A array of tag instances.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the created workgroup.</p>"
+        }
+      }
+    },
+    "CreateWorkgroupResponse":{
+      "type":"structure",
+      "members":{
+        "workgroup":{
+          "shape":"Workgroup",
+          "documentation":"<p>The created workgroup object.</p>"
+        }
+      }
+    },
+    "DbName":{"type":"string"},
+    "DbPassword":{
+      "type":"string",
+      "sensitive":true
+    },
+    "DbUser":{
+      "type":"string",
+      "sensitive":true
+    },
+    "DeleteEndpointAccessRequest":{
+      "type":"structure",
+      "required":["endpointName"],
+      "members":{
+        "endpointName":{
+          "shape":"String",
+          "documentation":"<p>The name of the VPC endpoint to delete.</p>"
+        }
+      }
+    },
+    "DeleteEndpointAccessResponse":{
+      "type":"structure",
+      "members":{
+        "endpoint":{
+          "shape":"EndpointAccess",
+          "documentation":"<p>The deleted VPC endpoint.</p>"
+        }
+      }
+    },
+    "DeleteNamespaceRequest":{
+      "type":"structure",
+      "required":["namespaceName"],
+      "members":{
+        "finalSnapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot to be created before the namespace is deleted.</p>"
+        },
+        "finalSnapshotRetentionPeriod":{
+          "shape":"Integer",
+          "documentation":"<p>How long to retain the final snapshot.</p>"
+        },
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace to delete.</p>"
+        }
+      }
+    },
+    "DeleteNamespaceResponse":{
+      "type":"structure",
+      "required":["namespace"],
+      "members":{
+        "namespace":{
+          "shape":"Namespace",
+          "documentation":"<p>The deleted namespace object.</p>"
+        }
+      }
+    },
+    "DeleteResourcePolicyRequest":{
+      "type":"structure",
+      "required":["resourceArn"],
+      "members":{
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the policy to delete.</p>"
+        }
+      }
+    },
+    "DeleteResourcePolicyResponse":{
+      "type":"structure",
+      "members":{
+      }
+    },
+    "DeleteSnapshotRequest":{
+      "type":"structure",
+      "required":["snapshotName"],
+      "members":{
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot to be deleted.</p>"
+        }
+      }
+    },
+    "DeleteSnapshotResponse":{
+      "type":"structure",
+      "members":{
+        "snapshot":{
+          "shape":"Snapshot",
+          "documentation":"<p>The deleted snapshot object.</p>"
+        }
+      }
+    },
+    "DeleteUsageLimitRequest":{
+      "type":"structure",
+      "required":["usageLimitId"],
+      "members":{
+        "usageLimitId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the usage limit to delete.</p>"
+        }
+      }
+    },
+    "DeleteUsageLimitResponse":{
+      "type":"structure",
+      "members":{
+        "usageLimit":{
+          "shape":"UsageLimit",
+          "documentation":"<p>The deleted usage limit object.</p>"
+        }
+      }
+    },
+    "DeleteWorkgroupRequest":{
+      "type":"structure",
+      "required":["workgroupName"],
+      "members":{
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup to be deleted.</p>"
+        }
+      }
+    },
+    "DeleteWorkgroupResponse":{
+      "type":"structure",
+      "required":["workgroup"],
+      "members":{
+        "workgroup":{
+          "shape":"Workgroup",
+          "documentation":"<p>The deleted workgroup object.</p>"
+        }
+      }
+    },
+    "Double":{
+      "type":"double",
+      "box":true
+    },
+    "Endpoint":{
+      "type":"structure",
+      "members":{
+        "address":{
+          "shape":"String",
+          "documentation":"<p>The DNS address of the VPC endpoint.</p>"
+        },
+        "port":{
+          "shape":"Integer",
+          "documentation":"<p>The port that Amazon Redshift Serverless listens on.</p>"
+        },
+        "vpcEndpoints":{
+          "shape":"VpcEndpointList",
+          "documentation":"<p>An array of <code>VpcEndpoint</code> objects.</p>"
+        }
+      },
+      "documentation":"<p>The VPC endpoint object.</p>"
+    },
+    "EndpointAccess":{
+      "type":"structure",
+      "members":{
+        "address":{
+          "shape":"String",
+          "documentation":"<p>The DNS address of the endpoint.</p>"
+        },
+        "endpointArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the VPC endpoint.</p>"
+        },
+        "endpointCreateTime":{
+          "shape":"SyntheticTimestamp_date_time",
+          "documentation":"<p>The time that the endpoint was created.</p>"
+        },
+        "endpointName":{
+          "shape":"String",
+          "documentation":"<p>The name of the VPC endpoint.</p>"
+        },
+        "endpointStatus":{
+          "shape":"String",
+          "documentation":"<p>The status of the VPC endpoint.</p>"
+        },
+        "port":{
+          "shape":"Integer",
+          "documentation":"<p>The port number on which Amazon Redshift Serverless accepts incoming connections.</p>"
+        },
+        "subnetIds":{
+          "shape":"SubnetIdList",
+          "documentation":"<p>The unique identifier of subnets where Amazon Redshift Serverless choose to deploy the VPC endpoint.</p>"
+        },
+        "vpcEndpoint":{
+          "shape":"VpcEndpoint",
+          "documentation":"<p>The connection endpoint for connecting to Amazon Redshift Serverless.</p>"
+        },
+        "vpcSecurityGroups":{
+          "shape":"VpcSecurityGroupMembershipList",
+          "documentation":"<p>The security groups associated with the endpoint.</p>"
+        },
+        "workgroupName":{
+          "shape":"String",
+          "documentation":"<p>The name of the workgroup associated with the endpoint.</p>"
+        }
+      },
+      "documentation":"<p>Information about an Amazon Redshift Serverless VPC endpoint.</p>"
+    },
+    "EndpointAccessList":{
+      "type":"list",
+      "member":{"shape":"EndpointAccess"}
+    },
+    "GetCredentialsRequest":{
+      "type":"structure",
+      "required":["workgroupName"],
+      "members":{
+        "dbName":{
+          "shape":"DbName",
+          "documentation":"<p>The name of the database to get temporary authorization to log on to.</p> <p>Constraints:</p> <ul> <li> <p>Must be 1 to 64 alphanumeric characters or hyphens.</p> </li> <li> <p>Must contain only lowercase letters, numbers, underscore, plus sign, period (dot), at symbol (@), or hyphen.</p> </li> <li> <p>The first character must be a letter.</p> </li> <li> <p>Must not contain a colon ( : ) or slash ( / ).</p> </li> <li> <p>Cannot be a reserved word. A list of reserved words can be found in <a href=\"https://docs.aws.amazon.com/redshift/latest/dg/r_pg_keywords.html\">Reserved Words </a> in the Amazon Redshift Database Developer Guide</p> </li> </ul>"
+        },
+        "durationSeconds":{
+          "shape":"Integer",
+          "documentation":"<p>The number of seconds until the returned temporary password expires. The minimum is 900 seconds, and the maximum is 3600 seconds.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup associated with the database.</p>"
+        }
+      }
+    },
+    "GetCredentialsResponse":{
+      "type":"structure",
+      "members":{
+        "dbPassword":{
+          "shape":"DbPassword",
+          "documentation":"<p>A temporary password that authorizes the user name returned by <code>DbUser</code> to log on to the database <code>DbName</code>.</p>"
+        },
+        "dbUser":{
+          "shape":"DbUser",
+          "documentation":"<p>A database user name that is authorized to log on to the database <code>DbName</code> using the password <code>DbPassword</code>. If the specified <code>DbUser</code> exists in the database, the new user name has the same database privileges as the the user named in <code>DbUser</code>. By default, the user is added to PUBLIC.</p>"
+        },
+        "expiration":{
+          "shape":"Timestamp",
+          "documentation":"<p>The date and time the password in <code>DbPassword</code> expires.</p>"
+        },
+        "nextRefreshTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>The date and time of when the <code>DbUser</code> and <code>DbPassword</code> authorization refreshes.</p>"
+        }
+      }
+    },
+    "GetEndpointAccessRequest":{
+      "type":"structure",
+      "required":["endpointName"],
+      "members":{
+        "endpointName":{
+          "shape":"String",
+          "documentation":"<p>The name of the VPC endpoint to return information for.</p>"
+        }
+      }
+    },
+    "GetEndpointAccessResponse":{
+      "type":"structure",
+      "members":{
+        "endpoint":{
+          "shape":"EndpointAccess",
+          "documentation":"<p>The returned VPC endpoint.</p>"
+        }
+      }
+    },
+    "GetNamespaceRequest":{
+      "type":"structure",
+      "required":["namespaceName"],
+      "members":{
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace to retrieve information for.</p>"
+        }
+      }
+    },
+    "GetNamespaceResponse":{
+      "type":"structure",
+      "required":["namespace"],
+      "members":{
+        "namespace":{
+          "shape":"Namespace",
+          "documentation":"<p>The returned namespace object.</p>"
+        }
+      }
+    },
+    "GetRecoveryPointRequest":{
+      "type":"structure",
+      "required":["recoveryPointId"],
+      "members":{
+        "recoveryPointId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the recovery point to return information for.</p>"
+        }
+      }
+    },
+    "GetRecoveryPointResponse":{
+      "type":"structure",
+      "members":{
+        "recoveryPoint":{
+          "shape":"RecoveryPoint",
+          "documentation":"<p>The returned recovery point object.</p>"
+        }
+      }
+    },
+    "GetResourcePolicyRequest":{
+      "type":"structure",
+      "required":["resourceArn"],
+      "members":{
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the resource to return.</p>"
+        }
+      }
+    },
+    "GetResourcePolicyResponse":{
+      "type":"structure",
+      "members":{
+        "resourcePolicy":{
+          "shape":"ResourcePolicy",
+          "documentation":"<p>The returned resource policy.</p>"
+        }
+      }
+    },
+    "GetSnapshotRequest":{
+      "type":"structure",
+      "members":{
+        "ownerAccount":{
+          "shape":"String",
+          "documentation":"<p>The owner Amazon Web Services account of a snapshot shared with another user.</p>"
+        },
+        "snapshotArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the snapshot to return.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot to return.</p>"
+        }
+      }
+    },
+    "GetSnapshotResponse":{
+      "type":"structure",
+      "members":{
+        "snapshot":{
+          "shape":"Snapshot",
+          "documentation":"<p>The returned snapshot object.</p>"
+        }
+      }
+    },
+    "GetUsageLimitRequest":{
+      "type":"structure",
+      "required":["usageLimitId"],
+      "members":{
+        "usageLimitId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the usage limit to return information for.</p>"
+        }
+      }
+    },
+    "GetUsageLimitResponse":{
+      "type":"structure",
+      "members":{
+        "usageLimit":{
+          "shape":"UsageLimit",
+          "documentation":"<p>The returned usage limit object.</p>"
+        }
+      }
+    },
+    "GetWorkgroupRequest":{
+      "type":"structure",
+      "required":["workgroupName"],
+      "members":{
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup to return information for.</p>"
+        }
+      }
+    },
+    "GetWorkgroupResponse":{
+      "type":"structure",
+      "required":["workgroup"],
+      "members":{
+        "workgroup":{
+          "shape":"Workgroup",
+          "documentation":"<p>The returned workgroup object.</p>"
+        }
+      }
+    },
+    "IamRoleArn":{"type":"string"},
+    "IamRoleArnList":{
+      "type":"list",
+      "member":{"shape":"IamRoleArn"}
+    },
+    "InsufficientCapacityException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>There is an insufficient capacity to perform the action.</p>",
+      "exception":true,
+      "retryable":{"throttling":false}
+    },
+    "Integer":{
+      "type":"integer",
+      "box":true
+    },
+    "InternalServerException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>The request processing has failed because of an unknown error, exception or failure.</p>",
+      "exception":true,
+      "fault":true,
+      "retryable":{"throttling":false}
+    },
+    "InvalidPaginationException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>The provided pagination token is invalid.</p>",
+      "exception":true
+    },
+    "KmsKeyId":{"type":"string"},
+    "ListEndpointAccessRequest":{
+      "type":"structure",
+      "members":{
+        "maxResults":{
+          "shape":"ListEndpointAccessRequestMaxResultsInteger",
+          "documentation":"<p>An optional parameter that specifies the maximum number of results to return. You can use <code>nextToken</code> to get the next page of results.</p>",
+          "box":true
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If your initial <code>ListEndpointAccess</code> operation returns a <code>nextToken</code>, you can include the returned <code>nextToken</code> in subsequent <code>ListEndpointAccess</code> operations, which returns results in the next page.</p>"
+        },
+        "vpcId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the virtual private cloud with access to Amazon Redshift Serverless.</p>"
+        },
+        "workgroupName":{
+          "shape":"String",
+          "documentation":"<p>The name of the workgroup associated with the VPC endpoint to return.</p>"
+        }
+      }
+    },
+    "ListEndpointAccessRequestMaxResultsInteger":{
+      "type":"integer",
+      "box":true,
+      "max":100,
+      "min":1
+    },
+    "ListEndpointAccessResponse":{
+      "type":"structure",
+      "required":["endpoints"],
+      "members":{
+        "endpoints":{
+          "shape":"EndpointAccessList",
+          "documentation":"<p>The returned VPC endpoints.</p>"
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>When <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page.</p>"
+        }
+      }
+    },
+    "ListNamespacesRequest":{
+      "type":"structure",
+      "members":{
+        "maxResults":{
+          "shape":"ListNamespacesRequestMaxResultsInteger",
+          "documentation":"<p>An optional parameter that specifies the maximum number of results to return. You can use <code>nextToken</code> to get the next page of results.</p>",
+          "box":true
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If your initial <code>ListNamespaces</code> operation returns a <code>nextToken</code>, you can include the returned <code>nextToken</code> in subsequent <code>ListNamespaces</code> operations, which returns results in the next page.</p>"
+        }
+      }
+    },
+    "ListNamespacesRequestMaxResultsInteger":{
+      "type":"integer",
+      "box":true,
+      "max":100,
+      "min":1
+    },
+    "ListNamespacesResponse":{
+      "type":"structure",
+      "required":["namespaces"],
+      "members":{
+        "namespaces":{
+          "shape":"NamespaceList",
+          "documentation":"<p>The list of returned namespaces.</p>"
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>When <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page.</p>"
+        }
+      }
+    },
+    "ListRecoveryPointsRequest":{
+      "type":"structure",
+      "members":{
+        "endTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>The time when creation of the recovery point finished.</p>"
+        },
+        "maxResults":{
+          "shape":"ListRecoveryPointsRequestMaxResultsInteger",
+          "documentation":"<p>An optional parameter that specifies the maximum number of results to return. You can use <code>nextToken</code> to get the next page of results.</p>",
+          "box":true
+        },
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace to list recovery points for.</p>"
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If your initial <code>ListRecoveryPoints</code> operation returns a <code>nextToken</code>, you can include the returned <code>nextToken</code> in subsequent <code>ListRecoveryPoints</code> operations, which returns results in the next page.</p>"
+        },
+        "startTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>The time when the recovery point's creation was initiated.</p>"
+        }
+      }
+    },
+    "ListRecoveryPointsRequestMaxResultsInteger":{
+      "type":"integer",
+      "box":true,
+      "max":100,
+      "min":1
+    },
+    "ListRecoveryPointsResponse":{
+      "type":"structure",
+      "members":{
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page.</p>"
+        },
+        "recoveryPoints":{
+          "shape":"RecoveryPointList",
+          "documentation":"<p>The returned recovery point objects.</p>"
+        }
+      }
+    },
+    "ListSnapshotsRequest":{
+      "type":"structure",
+      "members":{
+        "endTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>The timestamp showing when the snapshot creation finished.</p>"
+        },
+        "maxResults":{
+          "shape":"ListSnapshotsRequestMaxResultsInteger",
+          "documentation":"<p>An optional parameter that specifies the maximum number of results to return. You can use <code>nextToken</code> to get the next page of results.</p>",
+          "box":true
+        },
+        "namespaceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the namespace from which to list all snapshots.</p>"
+        },
+        "namespaceName":{
+          "shape":"String",
+          "documentation":"<p>The namespace from which to list all snapshots.</p>"
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page.</p>"
+        },
+        "ownerAccount":{
+          "shape":"String",
+          "documentation":"<p>The owner Amazon Web Services account of the snapshot.</p>"
+        },
+        "startTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>The time when the creation of the snapshot was initiated.</p>"
+        }
+      }
+    },
+    "ListSnapshotsRequestMaxResultsInteger":{
+      "type":"integer",
+      "box":true,
+      "max":100,
+      "min":1
+    },
+    "ListSnapshotsResponse":{
+      "type":"structure",
+      "members":{
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page.</p>"
+        },
+        "snapshots":{
+          "shape":"SnapshotList",
+          "documentation":"<p>All of the returned snapshot objects.</p>"
+        }
+      }
+    },
+    "ListTagsForResourceRequest":{
+      "type":"structure",
+      "required":["resourceArn"],
+      "members":{
+        "resourceArn":{
+          "shape":"AmazonResourceName",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the resource to list tags for.</p>"
+        }
+      }
+    },
+    "ListTagsForResourceResponse":{
+      "type":"structure",
+      "members":{
+        "tags":{
+          "shape":"TagList",
+          "documentation":"<p>A map of the key-value pairs assigned to the resource.</p>"
+        }
+      }
+    },
+    "ListUsageLimitsRequest":{
+      "type":"structure",
+      "members":{
+        "maxResults":{
+          "shape":"ListUsageLimitsRequestMaxResultsInteger",
+          "documentation":"<p>An optional parameter that specifies the maximum number of results to return. You can use <code>nextToken</code> to get the next page of results. The default is 100.</p>",
+          "box":true
+        },
+        "nextToken":{
+          "shape":"PaginationToken",
+          "documentation":"<p>If your initial <code>ListUsageLimits</code> operation returns a <code>nextToken</code>, you can include the returned <code>nextToken</code> in subsequent <code>ListUsageLimits</code> operations, which returns results in the next page. </p>"
+        },
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) associated with the resource whose usage limits you want to list.</p>"
+        },
+        "usageType":{
+          "shape":"UsageLimitUsageType",
+          "documentation":"<p>The Amazon Redshift Serverless feature whose limits you want to see.</p>"
+        }
+      }
+    },
+    "ListUsageLimitsRequestMaxResultsInteger":{
+      "type":"integer",
+      "box":true,
+      "max":100,
+      "min":1
+    },
+    "ListUsageLimitsResponse":{
+      "type":"structure",
+      "members":{
+        "nextToken":{
+          "shape":"PaginationToken",
+          "documentation":"<p>When <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page.</p>"
+        },
+        "usageLimits":{
+          "shape":"UsageLimits",
+          "documentation":"<p>An array of returned usage limit objects.</p>"
+        }
+      }
+    },
+    "ListWorkgroupsRequest":{
+      "type":"structure",
+      "members":{
+        "maxResults":{
+          "shape":"ListWorkgroupsRequestMaxResultsInteger",
+          "documentation":"<p>An optional parameter that specifies the maximum number of results to return. You can use <code>nextToken</code> to get the next page of results.</p>",
+          "box":true
+        },
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p>If your initial ListWorkgroups operation returns a <code>nextToken</code>, you can include the returned <code>nextToken</code> in subsequent ListNamespaces operations, which returns results in the next page.</p>"
+        }
+      }
+    },
+    "ListWorkgroupsRequestMaxResultsInteger":{
+      "type":"integer",
+      "box":true,
+      "max":100,
+      "min":1
+    },
+    "ListWorkgroupsResponse":{
+      "type":"structure",
+      "required":["workgroups"],
+      "members":{
+        "nextToken":{
+          "shape":"String",
+          "documentation":"<p> If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page. To retrieve the next page, make the call again using the returned token.</p>"
+        },
+        "workgroups":{
+          "shape":"WorkgroupList",
+          "documentation":"<p>The returned array of workgroups.</p>"
+        }
+      }
+    },
+    "LogExport":{
+      "type":"string",
+      "enum":[
+        "useractivitylog",
+        "userlog",
+        "connectionlog"
+      ]
+    },
+    "LogExportList":{
+      "type":"list",
+      "member":{"shape":"LogExport"},
+      "max":16,
+      "min":0
+    },
+    "Long":{
+      "type":"long",
+      "box":true
+    },
+    "Namespace":{
+      "type":"structure",
+      "members":{
+        "adminUsername":{
+          "shape":"DbUser",
+          "documentation":"<p>The username of the administrator for the first database created in the namespace.</p>"
+        },
+        "creationDate":{
+          "shape":"SyntheticTimestamp_date_time",
+          "documentation":"<p>The date of when the namespace was created.</p>"
+        },
+        "dbName":{
+          "shape":"String",
+          "documentation":"<p>The name of the first database created in the namespace.</p>"
+        },
+        "defaultIamRoleArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace.</p>"
+        },
+        "iamRoles":{
+          "shape":"IamRoleArnList",
+          "documentation":"<p>A list of IAM roles to associate with the namespace.</p>"
+        },
+        "kmsKeyId":{
+          "shape":"String",
+          "documentation":"<p>The ID of the Amazon Web Services Key Management Service key used to encrypt your data.</p>"
+        },
+        "logExports":{
+          "shape":"LogExportList",
+          "documentation":"<p>The types of logs the namespace can export. Available export types are User log, Connection log, and User activity log.</p>"
+        },
+        "namespaceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) associated with a namespace.</p>"
+        },
+        "namespaceId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of a namespace.</p>"
+        },
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace. Must be between 3-64 alphanumeric characters in lowercase, and it cannot be a reserved word. A list of reserved words can be found in <a href=\"https://docs.aws.amazon.com/redshift/latest/dg/r_pg_keywords.html\">Reserved Words</a> in the Amazon Redshift Database Developer Guide.</p>"
+        },
+        "status":{
+          "shape":"NamespaceStatus",
+          "documentation":"<p>The status of the namespace.</p>"
+        }
+      },
+      "documentation":"<p>A collection of database objects and users.</p>"
+    },
+    "NamespaceList":{
+      "type":"list",
+      "member":{"shape":"Namespace"}
+    },
+    "NamespaceName":{
+      "type":"string",
+      "max":64,
+      "min":3,
+      "pattern":"^[a-z0-9-]+$"
+    },
+    "NamespaceStatus":{
+      "type":"string",
+      "enum":[
+        "AVAILABLE",
+        "MODIFYING",
+        "DELETING"
+      ]
+    },
+    "NetworkInterface":{
+      "type":"structure",
+      "members":{
+        "availabilityZone":{
+          "shape":"String",
+          "documentation":"<p>The availability Zone.</p>"
+        },
+        "networkInterfaceId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the network interface.</p>"
+        },
+        "privateIpAddress":{
+          "shape":"String",
+          "documentation":"<p>The IPv4 address of the network interface within the subnet.</p>"
+        },
+        "subnetId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the subnet.</p>"
+        }
+      },
+      "documentation":"<p>Contains information about a network interface in an Amazon Redshift Serverless managed VPC endpoint. </p>"
+    },
+    "NetworkInterfaceList":{
+      "type":"list",
+      "member":{"shape":"NetworkInterface"}
+    },
+    "PaginationToken":{
+      "type":"string",
+      "max":1024,
+      "min":8
+    },
+    "ParameterKey":{"type":"string"},
+    "ParameterValue":{"type":"string"},
+    "PutResourcePolicyRequest":{
+      "type":"structure",
+      "required":[
+        "policy",
+        "resourceArn"
+      ],
+      "members":{
+        "policy":{
+          "shape":"String",
+          "documentation":"<p>The policy to create or update. For example, the following policy grants a user authorization to restore a snapshot.</p> <p> <code>\"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\" : [{ \\\"Sid\\\": \\\"AllowUserRestoreFromSnapshot\\\", \\\"Principal\\\":{\\\"AWS\\\": [\\\"739247239426\\\"]}, \\\"Action\\\": [\\\"redshift-serverless:RestoreFromSnapshot\\\"] , \\\"Effect\\\": \\\"Allow\\\" }]}\"</code> </p>"
+        },
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the account to create or update a resource policy for.</p>"
+        }
+      }
+    },
+    "PutResourcePolicyResponse":{
+      "type":"structure",
+      "members":{
+        "resourcePolicy":{
+          "shape":"ResourcePolicy",
+          "documentation":"<p>The policy that was created or updated.</p>"
+        }
+      }
+    },
+    "RecoveryPoint":{
+      "type":"structure",
+      "members":{
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace the recovery point is associated with.</p>"
+        },
+        "recoveryPointCreateTime":{
+          "shape":"SyntheticTimestamp_date_time",
+          "documentation":"<p>The time the recovery point is created.</p>"
+        },
+        "recoveryPointId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the recovery point.</p>"
+        },
+        "totalSizeInMegaBytes":{
+          "shape":"Double",
+          "documentation":"<p>The total size of the data in the recovery point in megabytes.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup the recovery point is associated with.</p>"
+        }
+      },
+      "documentation":"<p>The automatically created recovery point of a namespace. Recovery points are created every 30 minutes and kept for 24 hours.</p>"
+    },
+    "RecoveryPointList":{
+      "type":"list",
+      "member":{"shape":"RecoveryPoint"}
+    },
+    "ResourceNotFoundException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"},
+        "resourceName":{
+          "shape":"AmazonResourceName",
+          "documentation":"<p>The name of the resource that could not be found.</p>"
+        }
+      },
+      "documentation":"<p>The resource could not be found.</p>",
+      "exception":true
+    },
+    "ResourcePolicy":{
+      "type":"structure",
+      "members":{
+        "policy":{
+          "shape":"String",
+          "documentation":"<p>The resource policy.</p>"
+        },
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the policy.</p>"
+        }
+      },
+      "documentation":"<p>The resource policy object. Currently, you can use policies to share snapshots across Amazon Web Services accounts.</p>"
+    },
+    "RestoreFromRecoveryPointRequest":{
+      "type":"structure",
+      "required":[
+        "namespaceName",
+        "recoveryPointId",
+        "workgroupName"
+      ],
+      "members":{
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace to restore data into.</p>"
+        },
+        "recoveryPointId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the recovery point to restore from.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup used to restore data.</p>"
+        }
+      }
+    },
+    "RestoreFromRecoveryPointResponse":{
+      "type":"structure",
+      "members":{
+        "namespace":{
+          "shape":"Namespace",
+          "documentation":"<p>The namespace that data was restored into.</p>"
+        },
+        "recoveryPointId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the recovery point used for the restore.</p>"
+        }
+      }
+    },
+    "RestoreFromSnapshotRequest":{
+      "type":"structure",
+      "required":[
+        "namespaceName",
+        "workgroupName"
+      ],
+      "members":{
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace to restore the snapshot to.</p>"
+        },
+        "ownerAccount":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Web Services account that owns the snapshot.</p>"
+        },
+        "snapshotArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the snapshot to restore from.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot to restore from.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup used to restore the snapshot.</p>"
+        }
+      }
+    },
+    "RestoreFromSnapshotResponse":{
+      "type":"structure",
+      "members":{
+        "namespace":{"shape":"Namespace"},
+        "ownerAccount":{
+          "shape":"String",
+          "documentation":"<p>The owner Amazon Web Services; account of the snapshot that was restored.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot used to restore the namespace.</p>"
+        }
+      }
+    },
+    "SecurityGroupId":{"type":"string"},
+    "SecurityGroupIdList":{
+      "type":"list",
+      "member":{"shape":"SecurityGroupId"}
+    },
+    "ServiceQuotaExceededException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>The service limit was exceeded.</p>",
+      "exception":true
+    },
+    "Snapshot":{
+      "type":"structure",
+      "members":{
+        "accountsWithProvisionedRestoreAccess":{
+          "shape":"AccountIdList",
+          "documentation":"<p>All of the Amazon Web Services accounts that have access to restore a snapshot to a provisioned cluster.</p>"
+        },
+        "accountsWithRestoreAccess":{
+          "shape":"AccountIdList",
+          "documentation":"<p>All of the Amazon Web Services accounts that have access to restore a snapshot to a namespace.</p>"
+        },
+        "actualIncrementalBackupSizeInMegaBytes":{
+          "shape":"Double",
+          "documentation":"<p>The size of the incremental backup in megabytes.</p>"
+        },
+        "adminUsername":{
+          "shape":"String",
+          "documentation":"<p>The username of the database within a snapshot.</p>"
+        },
+        "backupProgressInMegaBytes":{
+          "shape":"Double",
+          "documentation":"<p>The size in megabytes of the data that has been backed up to a snapshot.</p>"
+        },
+        "currentBackupRateInMegaBytesPerSecond":{
+          "shape":"Double",
+          "documentation":"<p>The rate at which data is backed up into a snapshot in megabytes per second.</p>"
+        },
+        "elapsedTimeInSeconds":{
+          "shape":"Long",
+          "documentation":"<p>The amount of time it took to back up data into a snapshot.</p>"
+        },
+        "estimatedSecondsToCompletion":{
+          "shape":"Long",
+          "documentation":"<p>The estimated amount of seconds until the snapshot completes backup.</p>"
+        },
+        "kmsKeyId":{
+          "shape":"KmsKeyId",
+          "documentation":"<p>The unique identifier of the KMS key used to encrypt the snapshot.</p>"
+        },
+        "namespaceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the namespace the snapshot was created from.</p>"
+        },
+        "namespaceName":{
+          "shape":"String",
+          "documentation":"<p>The name of the namepsace.</p>"
+        },
+        "ownerAccount":{
+          "shape":"String",
+          "documentation":"<p>The owner Amazon Web Services; account of the snapshot.</p>"
+        },
+        "snapshotArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the snapshot.</p>"
+        },
+        "snapshotCreateTime":{
+          "shape":"SyntheticTimestamp_date_time",
+          "documentation":"<p>The timestamp of when the snapshot was created.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot.</p>"
+        },
+        "snapshotRemainingDays":{
+          "shape":"Integer",
+          "documentation":"<p>The amount of days until the snapshot is deleted.</p>"
+        },
+        "snapshotRetentionPeriod":{
+          "shape":"Integer",
+          "documentation":"<p>The period of time, in days, of how long the snapshot is retained.</p>"
+        },
+        "snapshotRetentionStartTime":{
+          "shape":"SyntheticTimestamp_date_time",
+          "documentation":"<p>The timestamp of when data within the snapshot started getting retained.</p>"
+        },
+        "status":{
+          "shape":"SnapshotStatus",
+          "documentation":"<p>The status of the snapshot.</p>"
+        },
+        "totalBackupSizeInMegaBytes":{
+          "shape":"Double",
+          "documentation":"<p>The total size, in megabytes, of how big the snapshot is.</p>"
+        }
+      },
+      "documentation":"<p>A snapshot object that contains databases.</p>"
+    },
+    "SnapshotList":{
+      "type":"list",
+      "member":{"shape":"Snapshot"}
+    },
+    "SnapshotStatus":{
+      "type":"string",
+      "enum":[
+        "AVAILABLE",
+        "CREATING",
+        "DELETED",
+        "CANCELLED",
+        "FAILED",
+        "COPYING"
+      ]
+    },
+    "String":{"type":"string"},
+    "SubnetId":{"type":"string"},
+    "SubnetIdList":{
+      "type":"list",
+      "member":{"shape":"SubnetId"}
+    },
+    "SyntheticTimestamp_date_time":{
+      "type":"timestamp",
+      "timestampFormat":"iso8601"
+    },
+    "Tag":{
+      "type":"structure",
+      "required":[
+        "key",
+        "value"
+      ],
+      "members":{
+        "key":{
+          "shape":"TagKey",
+          "documentation":"<p>The key to use in the tag.</p>"
+        },
+        "value":{
+          "shape":"TagValue",
+          "documentation":"<p>The value of the tag.</p>"
+        }
+      },
+      "documentation":"<p>A map of key-value pairs.</p>"
+    },
+    "TagKey":{
+      "type":"string",
+      "max":128,
+      "min":1
+    },
+    "TagKeyList":{
+      "type":"list",
+      "member":{"shape":"TagKey"},
+      "max":200,
+      "min":0
+    },
+    "TagList":{
+      "type":"list",
+      "member":{"shape":"Tag"},
+      "max":200,
+      "min":0
+    },
+    "TagResourceRequest":{
+      "type":"structure",
+      "required":[
+        "resourceArn",
+        "tags"
+      ],
+      "members":{
+        "resourceArn":{
+          "shape":"AmazonResourceName",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the resource to tag.</p>"
+        },
+        "tags":{
+          "shape":"TagList",
+          "documentation":"<p>The map of the key-value pairs used to tag the resource.</p>"
+        }
+      }
+    },
+    "TagResourceResponse":{
+      "type":"structure",
+      "members":{
+      }
+    },
+    "TagValue":{
+      "type":"string",
+      "max":256,
+      "min":0
+    },
+    "ThrottlingException":{
+      "type":"structure",
+      "members":{
+        "code":{"shape":"String"},
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>The request was denied due to request throttling.</p>",
+      "exception":true,
+      "retryable":{"throttling":false}
+    },
+    "Timestamp":{"type":"timestamp"},
+    "TooManyTagsException":{
+      "type":"structure",
+      "members":{
+        "message":{"shape":"String"},
+        "resourceName":{
+          "shape":"AmazonResourceName",
+          "documentation":"<p>The name of the resource that exceeded the number of tags allowed for a resource.</p>"
+        }
+      },
+      "documentation":"<p>The request exceeded the number of tags allowed for a resource.</p>",
+      "exception":true
+    },
+    "UntagResourceRequest":{
+      "type":"structure",
+      "required":[
+        "resourceArn",
+        "tagKeys"
+      ],
+      "members":{
+        "resourceArn":{
+          "shape":"AmazonResourceName",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the resource to remove tags from.</p>"
+        },
+        "tagKeys":{
+          "shape":"TagKeyList",
+          "documentation":"<p>The tag or set of tags to remove from the resource.</p>"
+        }
+      }
+    },
+    "UntagResourceResponse":{
+      "type":"structure",
+      "members":{
+      }
+    },
+    "UpdateEndpointAccessRequest":{
+      "type":"structure",
+      "required":["endpointName"],
+      "members":{
+        "endpointName":{
+          "shape":"String",
+          "documentation":"<p>The name of the VPC endpoint to update.</p>"
+        },
+        "vpcSecurityGroupIds":{
+          "shape":"VpcSecurityGroupIdList",
+          "documentation":"<p>The list of VPC security groups associated with the endpoint after the endpoint is modified.</p>"
+        }
+      }
+    },
+    "UpdateEndpointAccessResponse":{
+      "type":"structure",
+      "members":{
+        "endpoint":{
+          "shape":"EndpointAccess",
+          "documentation":"<p>The updated VPC endpoint.</p>"
+        }
+      }
+    },
+    "UpdateNamespaceRequest":{
+      "type":"structure",
+      "required":["namespaceName"],
+      "members":{
+        "adminUserPassword":{
+          "shape":"DbPassword",
+          "documentation":"<p>The password of the administrator for the first database created in the namespace.</p>"
+        },
+        "adminUsername":{
+          "shape":"DbUser",
+          "documentation":"<p>The username of the administrator for the first database created in the namespace.</p>"
+        },
+        "defaultIamRoleArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace.</p>"
+        },
+        "iamRoles":{
+          "shape":"IamRoleArnList",
+          "documentation":"<p>A list of IAM roles to associate with the namespace.</p>"
+        },
+        "kmsKeyId":{
+          "shape":"String",
+          "documentation":"<p>The ID of the Amazon Web Services Key Management Service key used to encrypt your data.</p>"
+        },
+        "logExports":{
+          "shape":"LogExportList",
+          "documentation":"<p>The types of logs the namespace can export. The export types are <code>userlog</code>, <code>connectionlog</code>, and <code>useractivitylog</code>.</p>"
+        },
+        "namespaceName":{
+          "shape":"NamespaceName",
+          "documentation":"<p>The name of the namespace.</p>"
+        }
+      }
+    },
+    "UpdateNamespaceResponse":{
+      "type":"structure",
+      "required":["namespace"],
+      "members":{
+        "namespace":{
+          "shape":"Namespace",
+          "documentation":"<p>A list of tag instances.</p>"
+        }
+      }
+    },
+    "UpdateSnapshotRequest":{
+      "type":"structure",
+      "required":["snapshotName"],
+      "members":{
+        "retentionPeriod":{
+          "shape":"Integer",
+          "documentation":"<p>The new retention period of the snapshot.</p>"
+        },
+        "snapshotName":{
+          "shape":"String",
+          "documentation":"<p>The name of the snapshot.</p>"
+        }
+      }
+    },
+    "UpdateSnapshotResponse":{
+      "type":"structure",
+      "members":{
+        "snapshot":{
+          "shape":"Snapshot",
+          "documentation":"<p>The updated snapshot object.</p>"
+        }
+      }
+    },
+    "UpdateUsageLimitRequest":{
+      "type":"structure",
+      "required":["usageLimitId"],
+      "members":{
+        "amount":{
+          "shape":"Long",
+          "documentation":"<p>The new limit amount. For more information about this parameter.</p>"
+        },
+        "breachAction":{
+          "shape":"UsageLimitBreachAction",
+          "documentation":"<p>The new action that Amazon Redshift Serverless takes when the limit is reached.</p>"
+        },
+        "usageLimitId":{
+          "shape":"String",
+          "documentation":"<p>The identifier of the usage limit to update.</p>"
+        }
+      }
+    },
+    "UpdateUsageLimitResponse":{
+      "type":"structure",
+      "members":{
+        "usageLimit":{
+          "shape":"UsageLimit",
+          "documentation":"<p>The updated usage limit object.</p>"
+        }
+      }
+    },
+    "UpdateWorkgroupRequest":{
+      "type":"structure",
+      "required":["workgroupName"],
+      "members":{
+        "baseCapacity":{
+          "shape":"Integer",
+          "documentation":"<p>The new base data warehouse capacity in Redshift Processing Units (RPUs).</p>"
+        },
+        "configParameters":{
+          "shape":"ConfigParameterList",
+          "documentation":"<p>An array of parameters to set for advanced control over a database. The options are <code>datestyle</code>, <code>enable_user_activity_logging</code>, <code>query_group</code>, <code>search_path</code>, and <code>max_query_execution_time</code>.</p>"
+        },
+        "enhancedVpcRouting":{
+          "shape":"Boolean",
+          "documentation":"<p>The value that specifies whether to turn on enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC.</p>"
+        },
+        "publiclyAccessible":{
+          "shape":"Boolean",
+          "documentation":"<p>A value that specifies whether the workgroup can be accessible from a public network.</p>"
+        },
+        "securityGroupIds":{
+          "shape":"SecurityGroupIdList",
+          "documentation":"<p>An array of security group IDs to associate with the workgroup.</p>"
+        },
+        "subnetIds":{
+          "shape":"SubnetIdList",
+          "documentation":"<p>An array of VPC subnet IDs to associate with the workgroup.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup to update.</p>"
+        }
+      }
+    },
+    "UpdateWorkgroupResponse":{
+      "type":"structure",
+      "required":["workgroup"],
+      "members":{
+        "workgroup":{
+          "shape":"Workgroup",
+          "documentation":"<p>The updated workgroup object.</p>"
+        }
+      }
+    },
+    "UsageLimit":{
+      "type":"structure",
+      "members":{
+        "amount":{
+          "shape":"Long",
+          "documentation":"<p>The limit amount. If time-based, this amount is in RPUs consumed per hour. If data-based, this amount is in terabytes (TB). The value must be a positive number.</p>"
+        },
+        "breachAction":{
+          "shape":"UsageLimitBreachAction",
+          "documentation":"<p>The action that Amazon Redshift Serverless takes when the limit is reached.</p>"
+        },
+        "period":{
+          "shape":"UsageLimitPeriod",
+          "documentation":"<p>The time period that the amount applies to. A weekly period begins on Sunday. The default is monthly.</p>"
+        },
+        "resourceArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the Amazon Redshift Serverless resource.</p>"
+        },
+        "usageLimitArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the resource associated with the usage limit.</p>"
+        },
+        "usageLimitId":{
+          "shape":"String",
+          "documentation":"<p>The identifier of the usage limit.</p>"
+        },
+        "usageType":{
+          "shape":"UsageLimitUsageType",
+          "documentation":"<p>The Amazon Redshift Serverless feature to limit.</p>"
+        }
+      },
+      "documentation":"<p>The usage limit object.</p>"
+    },
+    "UsageLimitBreachAction":{
+      "type":"string",
+      "enum":[
+        "log",
+        "emit-metric",
+        "deactivate"
+      ]
+    },
+    "UsageLimitPeriod":{
+      "type":"string",
+      "enum":[
+        "daily",
+        "weekly",
+        "monthly"
+      ]
+    },
+    "UsageLimitUsageType":{
+      "type":"string",
+      "enum":[
+        "serverless-compute",
+        "cross-region-datasharing"
+      ]
+    },
+    "UsageLimits":{
+      "type":"list",
+      "member":{"shape":"UsageLimit"},
+      "max":100,
+      "min":1
+    },
+    "ValidationException":{
+      "type":"structure",
+      "required":["message"],
+      "members":{
+        "message":{"shape":"String"}
+      },
+      "documentation":"<p>The input failed to satisfy the constraints specified by an AWS service.</p>",
+      "exception":true
+    },
+    "VpcEndpoint":{
+      "type":"structure",
+      "members":{
+        "networkInterfaces":{
+          "shape":"NetworkInterfaceList",
+          "documentation":"<p>One or more network interfaces of the endpoint. Also known as an interface endpoint.</p>"
+        },
+        "vpcEndpointId":{
+          "shape":"String",
+          "documentation":"<p>The connection endpoint ID for connecting to Amazon Redshift Serverless.</p>"
+        },
+        "vpcId":{
+          "shape":"String",
+          "documentation":"<p>The VPC identifier that the endpoint is associated with.</p>"
+        }
+      },
+      "documentation":"<p>The connection endpoint for connecting to Amazon Redshift Serverless through the proxy.</p>"
+    },
+    "VpcEndpointList":{
+      "type":"list",
+      "member":{"shape":"VpcEndpoint"}
+    },
+    "VpcSecurityGroupId":{"type":"string"},
+    "VpcSecurityGroupIdList":{
+      "type":"list",
+      "member":{"shape":"VpcSecurityGroupId"}
+    },
+    "VpcSecurityGroupMembership":{
+      "type":"structure",
+      "members":{
+        "status":{
+          "shape":"String",
+          "documentation":"<p>The status of the VPC security group.</p>"
+        },
+        "vpcSecurityGroupId":{
+          "shape":"VpcSecurityGroupId",
+          "documentation":"<p>The unique identifier of the VPC security group.</p>"
+        }
+      },
+      "documentation":"<p>Describes the members of a VPC security group.</p>"
+    },
+    "VpcSecurityGroupMembershipList":{
+      "type":"list",
+      "member":{"shape":"VpcSecurityGroupMembership"}
+    },
+    "Workgroup":{
+      "type":"structure",
+      "members":{
+        "baseCapacity":{
+          "shape":"Integer",
+          "documentation":"<p>The base data warehouse capacity of the workgroup in Redshift Processing Units (RPUs).</p>"
+        },
+        "configParameters":{
+          "shape":"ConfigParameterList",
+          "documentation":"<p>An array of parameters to set for finer control over a database. The options are <code>datestyle</code>, <code>enable_user_activity_logging</code>, <code>query_group</code>, <code>search_path</code>, and <code>max_query_execution_time</code>.</p>"
+        },
+        "creationDate":{
+          "shape":"SyntheticTimestamp_date_time",
+          "documentation":"<p>The creation date of the workgroup.</p>"
+        },
+        "endpoint":{
+          "shape":"Endpoint",
+          "documentation":"<p>The endpoint that is created from the workgroup.</p>"
+        },
+        "enhancedVpcRouting":{
+          "shape":"Boolean",
+          "documentation":"<p>The value that specifies whether to enable enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC.</p>"
+        },
+        "namespaceName":{
+          "shape":"String",
+          "documentation":"<p>The namespace the workgroup is associated with.</p>"
+        },
+        "publiclyAccessible":{
+          "shape":"Boolean",
+          "documentation":"<p>A value that specifies whether the workgroup can be accessible from a public network</p>"
+        },
+        "securityGroupIds":{
+          "shape":"SecurityGroupIdList",
+          "documentation":"<p>An array of security group IDs to associate with the workgroup.</p>"
+        },
+        "status":{
+          "shape":"WorkgroupStatus",
+          "documentation":"<p>The status of the workgroup.</p>"
+        },
+        "subnetIds":{
+          "shape":"SubnetIdList",
+          "documentation":"<p>An array of subnet IDs the workgroup is associated with.</p>"
+        },
+        "workgroupArn":{
+          "shape":"String",
+          "documentation":"<p>The Amazon Resource Name (ARN) that links to the workgroup.</p>"
+        },
+        "workgroupId":{
+          "shape":"String",
+          "documentation":"<p>The unique identifier of the workgroup.</p>"
+        },
+        "workgroupName":{
+          "shape":"WorkgroupName",
+          "documentation":"<p>The name of the workgroup.</p>"
+        }
+      },
+      "documentation":"<p>The collection of computing resources from which an endpoint is created.</p>"
+    },
+    "WorkgroupList":{
+      "type":"list",
+      "member":{"shape":"Workgroup"}
+    },
+    "WorkgroupName":{
+      "type":"string",
+      "max":64,
+      "min":3,
+      "pattern":"^[a-z0-9-]+$"
+    },
+    "WorkgroupStatus":{
+      "type":"string",
+      "enum":[
+        "CREATING",
+        "AVAILABLE",
+        "MODIFYING",
+        "DELETING"
+      ]
+    }
+  },
+  "documentation":"<p> <i>This is prerelease documentation for Amazon Redshift Serverless, which is in preview release. The documentation and the feature are both subject to change. We recommend that you use this feature only in test environments, and not in production environments. For preview terms and conditions, see Beta Service Participation in <a href=\"https://docs.aws.amazon.com/https:/aws.amazon.com/service-terms\">Amazon Web Services Service Terms</a>.</i> </p> <p>This is an interface reference for Amazon Redshift Serverless. It contains documentation for one of the programming or command line interfaces you can use to manage Amazon Redshift Serverless. </p> <p>Amazon Redshift Serverless automatically provisions data warehouse capacity and intelligently scales the underlying resources based on workload demands. Amazon Redshift Serverless adjusts capacity in seconds to deliver consistently high performance and simplified operations for even the most demanding and volatile workloads. Amazon Redshift Serverless lets you focus on using your data to acquire new insights for your business and customers. </p> <p> To learn more about Amazon Redshift Serverless, see <a href=\"https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-whatis.html\">What is Amazon Redshift Serverless</a>. </p>"
+}
diff --git a/contrib/python/botocore/py3/botocore/data/secretsmanager/2017-10-17/service-2.json b/contrib/python/botocore/py3/botocore/data/secretsmanager/2017-10-17/service-2.json
index aa84e5c7c8..eaf6163b55 100644
--- a/contrib/python/botocore/py3/botocore/data/secretsmanager/2017-10-17/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/secretsmanager/2017-10-17/service-2.json
@@ -175,7 +175,7 @@
         {"shape":"InvalidNextTokenException"},
         {"shape":"InternalServiceError"}
       ],
-      "documentation":"<p>Lists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion. To see secrets marked for deletion, use the Secrets Manager console.</p> <p>To list the versions of a secret, use <a>ListSecretVersionIds</a>.</p> <p>To get the secret value from <code>SecretString</code> or <code>SecretBinary</code>, call <a>GetSecretValue</a>.</p> <p>For information about finding secrets in the console, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_search-secret.html\">Find secrets in Secrets Manager</a>.</p> <p> <b>Required permissions: </b> <code>secretsmanager:ListSecrets</code>. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions\"> IAM policy actions for Secrets Manager</a> and <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html\">Authentication and access control in Secrets Manager</a>. </p>"
+      "documentation":"<p>Lists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion. To see secrets marked for deletion, use the Secrets Manager console.</p> <p>ListSecrets is eventually consistent, however it might not reflect changes from the last five minutes. To get the latest information for a specific secret, use <a>DescribeSecret</a>.</p> <p>To list the versions of a secret, use <a>ListSecretVersionIds</a>.</p> <p>To get the secret value from <code>SecretString</code> or <code>SecretBinary</code>, call <a>GetSecretValue</a>.</p> <p>For information about finding secrets in the console, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_search-secret.html\">Find secrets in Secrets Manager</a>.</p> <p> <b>Required permissions: </b> <code>secretsmanager:ListSecrets</code>. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions\"> IAM policy actions for Secrets Manager</a> and <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html\">Authentication and access control in Secrets Manager</a>. </p>"
     },
     "PutResourcePolicy":{
       "name":"PutResourcePolicy",
@@ -213,7 +213,7 @@
         {"shape":"InternalServiceError"},
         {"shape":"DecryptionFailure"}
       ],
-      "documentation":"<p>Creates a new version with a new encrypted secret value and attaches it to the secret. The version can contain a new <code>SecretString</code> value or a new <code>SecretBinary</code> value. </p> <p>We recommend you avoid calling <code>PutSecretValue</code> at a sustained rate of more than once every 10 minutes. When you update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you call <code>PutSecretValue</code> more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions.</p> <p>You can specify the staging labels to attach to the new version in <code>VersionStages</code>. If you don't include <code>VersionStages</code>, then Secrets Manager automatically moves the staging label <code>AWSCURRENT</code> to this version. If this operation creates the first version for the secret, then Secrets Manager automatically attaches the staging label <code>AWSCURRENT</code> to it .</p> <p>If this operation moves the staging label <code>AWSCURRENT</code> from another version to this version, then Secrets Manager also automatically moves the staging label <code>AWSPREVIOUS</code> to the version that <code>AWSCURRENT</code> was removed from.</p> <p>This operation is idempotent. If a version with a <code>VersionId</code> with the same value as the <code>ClientRequestToken</code> parameter already exists, and you specify the same secret data, the operation succeeds but does nothing. However, if the secret data is different, then the operation fails because you can't modify an existing version; you can only create new ones.</p> <p> <b>Required permissions: </b> <code>secretsmanager:PutSecretValue</code>. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions\"> IAM policy actions for Secrets Manager</a> and <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html\">Authentication and access control in Secrets Manager</a>. </p>"
+      "documentation":"<p>Creates a new version with a new encrypted secret value and attaches it to the secret. The version can contain a new <code>SecretString</code> value or a new <code>SecretBinary</code> value. </p> <p>We recommend you avoid calling <code>PutSecretValue</code> at a sustained rate of more than once every 10 minutes. When you update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you call <code>PutSecretValue</code> more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions.</p> <p>You can specify the staging labels to attach to the new version in <code>VersionStages</code>. If you don't include <code>VersionStages</code>, then Secrets Manager automatically moves the staging label <code>AWSCURRENT</code> to this version. If this operation creates the first version for the secret, then Secrets Manager automatically attaches the staging label <code>AWSCURRENT</code> to it .</p> <p>If this operation moves the staging label <code>AWSCURRENT</code> from another version to this version, then Secrets Manager also automatically moves the staging label <code>AWSPREVIOUS</code> to the version that <code>AWSCURRENT</code> was removed from.</p> <p>This operation is idempotent. If you call this operation with a <code>ClientRequestToken</code> that matches an existing version's VersionId, and you specify the same secret data, the operation succeeds but does nothing. However, if the secret data is different, then the operation fails because you can't modify an existing version; you can only create new ones.</p> <p> <b>Required permissions: </b> <code>secretsmanager:PutSecretValue</code>. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions\"> IAM policy actions for Secrets Manager</a> and <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html\">Authentication and access control in Secrets Manager</a>. </p>"
     },
     "RemoveRegionsFromReplication":{
       "name":"RemoveRegionsFromReplication",
@@ -345,7 +345,7 @@
         {"shape":"PreconditionNotMetException"},
         {"shape":"DecryptionFailure"}
       ],
-      "documentation":"<p>Modifies the details of a secret, including metadata and the secret value. To change the secret value, you can also use <a>PutSecretValue</a>.</p> <p>To change the rotation configuration of a secret, use <a>RotateSecret</a> instead.</p> <p>We recommend you avoid calling <code>UpdateSecret</code> at a sustained rate of more than once every 10 minutes. When you call <code>UpdateSecret</code> to update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you update the secret value more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions.</p> <p>If you include <code>SecretString</code> or <code>SecretBinary</code> to create a new secret version, Secrets Manager automatically attaches the staging label <code>AWSCURRENT</code> to the new version. </p> <p>If you call this operation with a <code>VersionId</code> that matches an existing version's <code>ClientRequestToken</code>, the operation results in an error. You can't modify an existing version, you can only create a new version. To remove a version, remove all staging labels from it. See <a>UpdateSecretVersionStage</a>.</p> <p>If you don't specify an KMS encryption key, Secrets Manager uses the Amazon Web Services managed key <code>aws/secretsmanager</code>. If this key doesn't already exist in your account, then Secrets Manager creates it for you automatically. All users and roles in the Amazon Web Services account automatically have access to use <code>aws/secretsmanager</code>. Creating <code>aws/secretsmanager</code> can result in a one-time significant delay in returning the result. </p> <p>If the secret is in a different Amazon Web Services account from the credentials calling the API, then you can't use <code>aws/secretsmanager</code> to encrypt the secret, and you must create and use a customer managed key. </p> <p> <b>Required permissions: </b> <code>secretsmanager:UpdateSecret</code>. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions\"> IAM policy actions for Secrets Manager</a> and <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html\">Authentication and access control in Secrets Manager</a>. If you use a customer managed key, you must also have <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permissions on the key. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html\"> Secret encryption and decryption</a>.</p>"
+      "documentation":"<p>Modifies the details of a secret, including metadata and the secret value. To change the secret value, you can also use <a>PutSecretValue</a>.</p> <p>To change the rotation configuration of a secret, use <a>RotateSecret</a> instead.</p> <p>We recommend you avoid calling <code>UpdateSecret</code> at a sustained rate of more than once every 10 minutes. When you call <code>UpdateSecret</code> to update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you update the secret value more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions.</p> <p>If you include <code>SecretString</code> or <code>SecretBinary</code> to create a new secret version, Secrets Manager automatically attaches the staging label <code>AWSCURRENT</code> to the new version. </p> <p>If you call this operation with a <code>ClientRequestToken</code> that matches an existing version's <code>VersionId</code>, the operation results in an error. You can't modify an existing version, you can only create a new version. To remove a version, remove all staging labels from it. See <a>UpdateSecretVersionStage</a>.</p> <p>If you don't specify an KMS encryption key, Secrets Manager uses the Amazon Web Services managed key <code>aws/secretsmanager</code>. If this key doesn't already exist in your account, then Secrets Manager creates it for you automatically. All users and roles in the Amazon Web Services account automatically have access to use <code>aws/secretsmanager</code>. Creating <code>aws/secretsmanager</code> can result in a one-time significant delay in returning the result. </p> <p>If the secret is in a different Amazon Web Services account from the credentials calling the API, then you can't use <code>aws/secretsmanager</code> to encrypt the secret, and you must create and use a customer managed key. </p> <p> <b>Required permissions: </b> <code>secretsmanager:UpdateSecret</code>. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions\"> IAM policy actions for Secrets Manager</a> and <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html\">Authentication and access control in Secrets Manager</a>. If you use a customer managed key, you must also have <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permissions on the key. For more information, see <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html\"> Secret encryption and decryption</a>.</p>"
     },
     "UpdateSecretVersionStage":{
       "name":"UpdateSecretVersionStage",
diff --git a/contrib/python/botocore/py3/botocore/data/securityhub/2018-10-26/service-2.json b/contrib/python/botocore/py3/botocore/data/securityhub/2018-10-26/service-2.json
index cd24d79096..ac9835e698 100644
--- a/contrib/python/botocore/py3/botocore/data/securityhub/2018-10-26/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/securityhub/2018-10-26/service-2.json
@@ -2158,6 +2158,104 @@
       },
       "documentation":"<p>Provides details about the CNAME record that is added to the DNS database for domain validation.</p>"
     },
+    "AwsCloudFormationStackDetails":{
+      "type":"structure",
+      "members":{
+        "Capabilities":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>The capabilities allowed in the stack. </p>"
+        },
+        "CreationTime":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The time at which the stack was created. </p>"
+        },
+        "Description":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A user-defined description associated with the stack. </p>"
+        },
+        "DisableRollback":{
+          "shape":"Boolean",
+          "documentation":"<p>Boolean to enable or disable rollback on stack creation failures. </p>"
+        },
+        "DriftInformation":{
+          "shape":"AwsCloudFormationStackDriftInformationDetails",
+          "documentation":"<p>Information about whether a stack's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any values specified as template parameters. </p>"
+        },
+        "EnableTerminationProtection":{
+          "shape":"Boolean",
+          "documentation":"<p>Whether termination protection is enabled for the stack. </p>"
+        },
+        "LastUpdatedTime":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The time the nested stack was last updated. This field will only be returned if the stack has been updated at least once.</p>"
+        },
+        "NotificationArns":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>The Amazon Resource Names (ARNs) of the Amazon SNS topic to which stack-related events are published. </p>"
+        },
+        "Outputs":{
+          "shape":"AwsCloudFormationStackOutputsList",
+          "documentation":"<p>A list of output structures. </p>"
+        },
+        "RoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ARN of an IAM role that's associated with the stack. </p>"
+        },
+        "StackId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Unique identifier of the stack. </p>"
+        },
+        "StackName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name associated with the stack. </p>"
+        },
+        "StackStatus":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Current status of the stack. </p>"
+        },
+        "StackStatusReason":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Success or failure message associated with the stack status. </p>"
+        },
+        "TimeoutInMinutes":{
+          "shape":"Integer",
+          "documentation":"<p>The length of time, in minutes, that CloudFormation waits for the nested stack to reach the <code>CREATE_COMPLETE</code> state. </p>"
+        }
+      },
+      "documentation":"<p>Nests a stack as a resource in a top-level template. Nested stacks are stacks created as resources for another stack.</p>"
+    },
+    "AwsCloudFormationStackDriftInformationDetails":{
+      "type":"structure",
+      "members":{
+        "StackDriftStatus":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Status of the stack's actual configuration compared to its expected template configuration. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the stack's conformity to its expected template configuration. </p>"
+    },
+    "AwsCloudFormationStackOutputsDetails":{
+      "type":"structure",
+      "members":{
+        "Description":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A user-defined description associated with the output. </p>"
+        },
+        "OutputKey":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The key associated with the output. </p>"
+        },
+        "OutputValue":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The value associated with the output. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the CloudFormation stack output. </p>"
+    },
+    "AwsCloudFormationStackOutputsList":{
+      "type":"list",
+      "member":{"shape":"AwsCloudFormationStackOutputsDetails"}
+    },
     "AwsCloudFrontDistributionCacheBehavior":{
       "type":"structure",
       "members":{
@@ -2176,7 +2274,7 @@
           "documentation":"<p>The cache behaviors for the distribution.</p>"
         }
       },
-      "documentation":"<p>Provides information about caching for the distribution.</p>"
+      "documentation":"<p>Provides information about caching for the CloudFront distribution.</p>"
     },
     "AwsCloudFrontDistributionCacheBehaviorsItemList":{
       "type":"list",
@@ -2190,7 +2288,7 @@
           "documentation":"<p>The protocol that viewers can use to access the files in an origin. You can specify the following options:</p> <ul> <li> <p> <code>allow-all</code> - Viewers can use HTTP or HTTPS.</p> </li> <li> <p> <code>redirect-to-https</code> - CloudFront responds to HTTP requests with an HTTP status code of 301 (Moved Permanently) and the HTTPS URL. The viewer then uses the new URL to resubmit.</p> </li> <li> <p> <code>https-only</code> - CloudFront responds to HTTP request with an HTTP status code of 403 (Forbidden).</p> </li> </ul>"
         }
       },
-      "documentation":"<p>Contains information about the default cache configuration for the distribution.</p>"
+      "documentation":"<p>Contains information about the default cache configuration for the CloudFront distribution.</p>"
     },
     "AwsCloudFrontDistributionDetails":{
       "type":"structure",
@@ -2244,7 +2342,7 @@
           "documentation":"<p>A unique identifier that specifies the WAF web ACL, if any, to associate with this distribution.</p>"
         }
       },
-      "documentation":"<p>A distribution configuration.</p>"
+      "documentation":"<p>A CloudFront distribution configuration.</p>"
     },
     "AwsCloudFrontDistributionLogging":{
       "type":"structure",
@@ -2266,7 +2364,37 @@
           "documentation":"<p>An optional string that you want CloudFront to use as a prefix to the access log filenames for this distribution.</p>"
         }
       },
-      "documentation":"<p>A complex type that controls whether access logs are written for the distribution.</p>"
+      "documentation":"<p>A complex type that controls whether access logs are written for the CloudFront distribution.</p>"
+    },
+    "AwsCloudFrontDistributionOriginCustomOriginConfig":{
+      "type":"structure",
+      "members":{
+        "HttpPort":{
+          "shape":"Integer",
+          "documentation":"<p>The HTTP port that CloudFront uses to connect to the origin. </p>"
+        },
+        "HttpsPort":{
+          "shape":"Integer",
+          "documentation":"<p>The HTTPS port that CloudFront uses to connect to the origin. </p>"
+        },
+        "OriginKeepaliveTimeout":{
+          "shape":"Integer",
+          "documentation":"<p>Specifies how long, in seconds, CloudFront persists its connection to the origin. </p>"
+        },
+        "OriginProtocolPolicy":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the protocol (HTTP or HTTPS) that CloudFront uses to connect to the origin. </p>"
+        },
+        "OriginReadTimeout":{
+          "shape":"Integer",
+          "documentation":"<p>Specifies how long, in seconds, CloudFront waits for a response from the origin. </p>"
+        },
+        "OriginSslProtocols":{
+          "shape":"AwsCloudFrontDistributionOriginSslProtocols",
+          "documentation":"<p>Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. </p>"
+        }
+      },
+      "documentation":"<p>A custom origin. A custom origin is any origin that is not an Amazon S3 bucket, with one exception. An Amazon S3 bucket that is <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html\">configured with static website hosting</a> is a custom origin. </p>"
     },
     "AwsCloudFrontDistributionOriginGroup":{
       "type":"structure",
@@ -2276,7 +2404,7 @@
           "documentation":"<p>Provides the criteria for an origin group to fail over.</p>"
         }
       },
-      "documentation":"<p>Information about an origin group for the distribution.</p>"
+      "documentation":"<p>Information about an origin group for the CloudFront distribution.</p>"
     },
     "AwsCloudFrontDistributionOriginGroupFailover":{
       "type":"structure",
@@ -2314,7 +2442,7 @@
           "documentation":"<p>The list of origin groups.</p>"
         }
       },
-      "documentation":"<p>Provides information about origin groups that are associated with the distribution.</p>"
+      "documentation":"<p>Provides information about origin groups that are associated with the CloudFront distribution.</p>"
     },
     "AwsCloudFrontDistributionOriginGroupsItemList":{
       "type":"list",
@@ -2338,9 +2466,13 @@
         "S3OriginConfig":{
           "shape":"AwsCloudFrontDistributionOriginS3OriginConfig",
           "documentation":"<p>An origin that is an S3 bucket that is not configured with static website hosting.</p>"
+        },
+        "CustomOriginConfig":{
+          "shape":"AwsCloudFrontDistributionOriginCustomOriginConfig",
+          "documentation":"<p>An origin that is not an Amazon S3 bucket, with one exception. If the Amazon S3 bucket is configured with static website hosting, use this attribute. If the Amazon S3 bucket is not configured with static website hosting, use the <code>S3OriginConfig</code> type instead. </p>"
         }
       },
-      "documentation":"<p>A complex type that describes the S3 bucket, HTTP server (for example, a web server), AWS Elemental MediaStore, or other server from which CloudFront gets your files.</p>"
+      "documentation":"<p>A complex type that describes the Amazon S3 bucket, HTTP server (for example, a web server), AWS Elemental MediaStore, or other server from which CloudFront gets your files.</p>"
     },
     "AwsCloudFrontDistributionOriginItemList":{
       "type":"list",
@@ -2354,7 +2486,21 @@
           "documentation":"<p>The CloudFront origin access identity to associate with the origin.</p>"
         }
       },
-      "documentation":"<p>Information about an origin that is an S3 bucket that is not configured with static website hosting.</p>"
+      "documentation":"<p>Information about an origin that is an Amazon S3 bucket that is not configured with static website hosting.</p>"
+    },
+    "AwsCloudFrontDistributionOriginSslProtocols":{
+      "type":"structure",
+      "members":{
+        "Items":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>A list that contains allowed SSL/TLS protocols for this distribution. </p>"
+        },
+        "Quantity":{
+          "shape":"Integer",
+          "documentation":"<p>The number of SSL/TLS protocols that you want to allow CloudFront to use when establishing an HTTPS connection with this origin. </p>"
+        }
+      },
+      "documentation":"<p>A complex type that contains information about the SSL/TLS protocols that CloudFront can use when establishing an HTTPS connection with your origin. </p>"
     },
     "AwsCloudFrontDistributionOrigins":{
       "type":"structure",
@@ -2364,7 +2510,7 @@
           "documentation":"<p>A complex type that contains origins or origin groups for this distribution.</p>"
         }
       },
-      "documentation":"<p>A complex type that contains information about origins and origin groups for this distribution.</p>"
+      "documentation":"<p>A complex type that contains information about origins and origin groups for this CloudFront distribution.</p>"
     },
     "AwsCloudFrontDistributionViewerCertificate":{
       "type":"structure",
@@ -2398,7 +2544,7 @@
           "documentation":"<p>The viewers that the distribution accepts HTTPS connections from.</p>"
         }
       },
-      "documentation":"<p>Provides information about the TLS/SSL configuration that the distribution uses to communicate with viewers.</p>"
+      "documentation":"<p>Provides information about the TLS/SSL configuration that the CloudFront distribution uses to communicate with viewers.</p>"
     },
     "AwsCloudTrailTrailDetails":{
       "type":"structure",
@@ -2466,6 +2612,118 @@
       },
       "documentation":"<p>Provides details about a CloudTrail trail.</p>"
     },
+    "AwsCloudWatchAlarmDetails":{
+      "type":"structure",
+      "members":{
+        "ActionsEnabled":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether actions should be executed during any changes to the alarm state. </p>"
+        },
+        "AlarmActions":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>The list of actions, specified as Amazon Resource Names (ARNs) to execute when this alarm transitions into an <code>ALARM</code> state from any other state. </p>"
+        },
+        "AlarmArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ARN of the alarm. </p>"
+        },
+        "AlarmConfigurationUpdatedTimestamp":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The time stamp of the last update to the alarm configuration. </p>"
+        },
+        "AlarmDescription":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The description of the alarm. </p>"
+        },
+        "AlarmName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the alarm. If you don't specify a name, CloudFront generates a unique physical ID and uses that ID for the alarm name. </p>"
+        },
+        "ComparisonOperator":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The arithmetic operation to use when comparing the specified statistic and threshold. The specified statistic value is used as the first operand. </p>"
+        },
+        "DatapointsToAlarm":{
+          "shape":"Integer",
+          "documentation":"<p>The number of datapoints that must be breaching to trigger the alarm. </p>"
+        },
+        "Dimensions":{
+          "shape":"AwsCloudWatchAlarmDimensionsList",
+          "documentation":"<p>The dimensions for the metric associated with the alarm. </p>"
+        },
+        "EvaluateLowSampleCountPercentile":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Used only for alarms based on percentiles. If <code>ignore</code>, the alarm state does not change during periods with too few data points to be statistically significant. If <code>evaluate</code> or this parameter is not used, the alarm is always evaluated and possibly changes state no matter how many data points are available. </p>"
+        },
+        "EvaluationPeriods":{
+          "shape":"Integer",
+          "documentation":"<p>The number of periods over which data is compared to the specified threshold. </p>"
+        },
+        "ExtendedStatistic":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The percentile statistic for the metric associated with the alarm. </p>"
+        },
+        "InsufficientDataActions":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>The actions to execute when this alarm transitions to the <code>INSUFFICIENT_DATA</code> state from any other state. Each action is specified as an ARN. </p>"
+        },
+        "MetricName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the metric associated with the alarm. This is required for an alarm based on a metric. For an alarm based on a math expression, you use <code>Metrics</code> instead and you can't specify <code>MetricName</code>. </p>"
+        },
+        "Namespace":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The namespace of the metric associated with the alarm. This is required for an alarm based on a metric. For an alarm based on a math expression, you can't specify <code>Namespace</code> and you use <code>Metrics</code> instead. </p>"
+        },
+        "OkActions":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>The actions to execute when this alarm transitions to the <code>OK</code> state from any other state. Each action is specified as an ARN. </p>"
+        },
+        "Period":{
+          "shape":"Integer",
+          "documentation":"<p>The period, in seconds, over which the statistic is applied. This is required for an alarm based on a metric. </p>"
+        },
+        "Statistic":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The statistic for the metric associated with the alarm, other than percentile. For percentile statistics, use <code>ExtendedStatistic</code>.</p> <p>For an alarm based on a metric, you must specify either <code>Statistic</code> or <code>ExtendedStatistic</code> but not both.</p> <p>For an alarm based on a math expression, you can't specify <code>Statistic</code>. Instead, you use <code>Metrics</code>.</p>"
+        },
+        "Threshold":{
+          "shape":"Double",
+          "documentation":"<p>The value to compare with the specified statistic. </p>"
+        },
+        "ThresholdMetricId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>n an alarm based on an anomaly detection model, this is the ID of the <code>ANOMALY_DETECTION_BAND</code> function used as the threshold for the alarm. </p>"
+        },
+        "TreatMissingData":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Sets how this alarm is to handle missing data points. </p>"
+        },
+        "Unit":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The unit of the metric associated with the alarm. </p>"
+        }
+      },
+      "documentation":"<p>Specifies an alarm and associates it with the specified metric or metric math expression. </p>"
+    },
+    "AwsCloudWatchAlarmDimensionsDetails":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of a dimension. </p>"
+        },
+        "Value":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The value of a dimension. </p>"
+        }
+      },
+      "documentation":"<p>Details about the dimensions for the metric associated with the alarm. </p>"
+    },
+    "AwsCloudWatchAlarmDimensionsList":{
+      "type":"list",
+      "member":{"shape":"AwsCloudWatchAlarmDimensionsDetails"}
+    },
     "AwsCodeBuildProjectArtifactsDetails":{
       "type":"structure",
       "members":{
@@ -3192,9 +3450,43 @@
         "NetworkInterfaces":{
           "shape":"AwsEc2InstanceNetworkInterfacesList",
           "documentation":"<p>The identifiers of the network interfaces for the EC2 instance. The details for each network interface are in a corresponding <code>AwsEc2NetworkInterfacesDetails</code> object.</p>"
+        },
+        "VirtualizationType":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The virtualization type of the Amazon Machine Image (AMI) required to launch the instance. </p>"
+        },
+        "MetadataOptions":{
+          "shape":"AwsEc2InstanceMetadataOptions",
+          "documentation":"<p>Details about the metadata options for the Amazon EC2 instance. </p>"
+        }
+      },
+      "documentation":"<p>The details of an Amazon EC2 instance.</p>"
+    },
+    "AwsEc2InstanceMetadataOptions":{
+      "type":"structure",
+      "members":{
+        "HttpEndpoint":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Enables or disables the HTTP metadata endpoint on the instance. </p>"
+        },
+        "HttpProtocolIpv6":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Enables or disables the IPv6 endpoint for the instance metadata service. </p>"
+        },
+        "HttpPutResponseHopLimit":{
+          "shape":"Integer",
+          "documentation":"<p>The desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. </p>"
+        },
+        "HttpTokens":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The state of token usage for your instance metadata requests. </p>"
+        },
+        "InstanceMetadataTags":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies whether to allow access to instance tags from the instance metadata. </p>"
         }
       },
-      "documentation":"<p>The details of an EC2 instance.</p>"
+      "documentation":"<p>Metadata options that allow you to configure and secure the Amazon EC2 instance.</p>"
     },
     "AwsEc2InstanceNetworkInterfacesDetails":{
       "type":"structure",
@@ -3204,7 +3496,7 @@
           "documentation":"<p>The identifier of the network interface. The details are in a corresponding <code>AwsEc2NetworkInterfacesDetails</code> object.</p>"
         }
       },
-      "documentation":"<p>Identifies a network interface for the EC2 instance.</p>"
+      "documentation":"<p>Identifies a network interface for the Amazon EC2 instance.</p>"
     },
     "AwsEc2InstanceNetworkInterfacesList":{
       "type":"list",
@@ -3260,7 +3552,7 @@
           "documentation":"<p>The set of rules in the network ACL.</p>"
         }
       },
-      "documentation":"<p>Contains details about an EC2 network access control list (ACL).</p>"
+      "documentation":"<p>Contains details about an Amazon EC2 network access control list (ACL).</p>"
     },
     "AwsEc2NetworkAclEntry":{
       "type":"structure",
@@ -3287,7 +3579,7 @@
         },
         "Protocol":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The protocol that the rule applies to. To deny or allow access to all protocols, use the value -1.</p>"
+          "documentation":"<p>The protocol that the rule applies to. To deny or allow access to all protocols, use the value <code>-1</code>.</p>"
         },
         "RuleAction":{
           "shape":"NonEmptyString",
@@ -3454,14 +3746,14 @@
           "documentation":"<p>[VPC only] The outbound rules associated with the security group.</p>"
         }
       },
-      "documentation":"<p>Details about an EC2 security group.</p>"
+      "documentation":"<p>Details about an Amazon EC2 security group.</p>"
     },
     "AwsEc2SecurityGroupIpPermission":{
       "type":"structure",
       "members":{
         "IpProtocol":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The IP protocol name (<code>tcp</code>, <code>udp</code>, <code>icmp</code>, <code>icmpv6</code>) or number.</p> <p>[VPC only] Use <code>-1</code> to specify all protocols.</p> <p>When authorizing security group rules, specifying -1 or a protocol number other than <code>tcp</code>, <code>udp</code>, <code>icmp</code>, or <code>icmpv6</code> allows traffic on all ports, regardless of any port range you specify.</p> <p>For <code>tcp</code>, <code>udp</code>, and <code>icmp</code>, you must specify a port range.</p> <p>For <code>icmpv6</code>, the port range is optional. If you omit the port range, traffic for all types and codes is allowed. </p>"
+          "documentation":"<p>The IP protocol name (<code>tcp</code>, <code>udp</code>, <code>icmp</code>, <code>icmpv6</code>) or number.</p> <p>[VPC only] Use <code>-1</code> to specify all protocols.</p> <p>When authorizing security group rules, specifying <code>-1</code> or a protocol number other than <code>tcp</code>, <code>udp</code>, <code>icmp</code>, or <code>icmpv6</code> allows traffic on all ports, regardless of any port range you specify.</p> <p>For <code>tcp</code>, <code>udp</code>, and <code>icmp</code>, you must specify a port range.</p> <p>For <code>icmpv6</code>, the port range is optional. If you omit the port range, traffic for all types and codes is allowed. </p>"
         },
         "FromPort":{
           "shape":"Integer",
@@ -3469,7 +3761,7 @@
         },
         "ToPort":{
           "shape":"Integer",
-          "documentation":"<p>The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.</p> <p>A value of -1 indicates all ICMP/ICMPv6 codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.</p>"
+          "documentation":"<p>The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.</p> <p>A value of <code>-1</code> indicates all ICMP/ICMPv6 codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.</p>"
         },
         "UserIdGroupPairs":{
           "shape":"AwsEc2SecurityGroupUserIdGroupPairList",
@@ -3628,6 +3920,60 @@
       },
       "documentation":"<p>Contains information about a subnet in Amazon EC2.</p>"
     },
+    "AwsEc2TransitGatewayDetails":{
+      "type":"structure",
+      "members":{
+        "Id":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the transit gateway. </p>"
+        },
+        "Description":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The description of the transit gateway. </p>"
+        },
+        "DefaultRouteTablePropagation":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Turn on or turn off automatic propagation of routes to the default propagation route table. </p>"
+        },
+        "AutoAcceptSharedAttachments":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Turn on or turn off automatic acceptance of attachment requests. </p>"
+        },
+        "DefaultRouteTableAssociation":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Turn on or turn off automatic association with the default association route table. </p>"
+        },
+        "TransitGatewayCidrBlocks":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>The transit gateway Classless Inter-Domain Routing (CIDR) blocks. </p>"
+        },
+        "AssociationDefaultRouteTableId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the default association route table. </p>"
+        },
+        "PropagationDefaultRouteTableId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the default propagation route table. </p>"
+        },
+        "VpnEcmpSupport":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Turn on or turn off Equal Cost Multipath Protocol (ECMP) support. </p>"
+        },
+        "DnsSupport":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Turn on or turn off DNS support. </p>"
+        },
+        "MulticastSupport":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates whether multicast is supported on the transit gateway. </p>"
+        },
+        "AmazonSideAsn":{
+          "shape":"Integer",
+          "documentation":"<p>A private Autonomous System Number (ASN) for the Amazon side of a BGP session. </p>"
+        }
+      },
+      "documentation":"<p>Information about an Amazon Web Services Amazon EC2 Transit Gateway that interconnects virtual private clouds (VPCs) and on-premises networks. </p>"
+    },
     "AwsEc2VolumeAttachment":{
       "type":"structure",
       "members":{
@@ -3661,9 +4007,13 @@
           "shape":"NonEmptyString",
           "documentation":"<p>Indicates when the volume was created.</p> <p>Uses the <code>date-time</code> format specified in <a href=\"https://tools.ietf.org/html/rfc3339#section-5.6\">RFC 3339 section 5.6, Internet Date/Time Format</a>. The value cannot contain spaces. For example, <code>2020-03-22T13:22:13.933Z</code>.</p>"
         },
+        "DeviceName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The device name for the volume that is attached to the instance. </p>"
+        },
         "Encrypted":{
           "shape":"Boolean",
-          "documentation":"<p>Whether the volume is encrypted.</p>"
+          "documentation":"<p>Specifies whether the volume is encrypted.</p>"
         },
         "Size":{
           "shape":"Integer",
@@ -3684,6 +4034,18 @@
         "Attachments":{
           "shape":"AwsEc2VolumeAttachmentList",
           "documentation":"<p>The volume attachments.</p>"
+        },
+        "VolumeId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the volume. </p>"
+        },
+        "VolumeType":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The volume type. </p>"
+        },
+        "VolumeScanStatus":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates whether the volume was scanned or skipped. </p>"
         }
       },
       "documentation":"<p>Details about an EC2 volume.</p>"
@@ -3774,6 +4136,80 @@
       "type":"list",
       "member":{"shape":"AwsEc2VpcEndpointServiceServiceTypeDetails"}
     },
+    "AwsEc2VpcPeeringConnectionDetails":{
+      "type":"structure",
+      "members":{
+        "AccepterVpcInfo":{
+          "shape":"AwsEc2VpcPeeringConnectionVpcInfoDetails",
+          "documentation":"<p>Information about the accepter VPC. </p>"
+        },
+        "ExpirationTime":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The time at which an unaccepted VPC peering connection will expire. </p>"
+        },
+        "RequesterVpcInfo":{
+          "shape":"AwsEc2VpcPeeringConnectionVpcInfoDetails",
+          "documentation":"<p>Information about the requester VPC. </p>"
+        },
+        "Status":{
+          "shape":"AwsEc2VpcPeeringConnectionStatusDetails",
+          "documentation":"<p>The status of the VPC peering connection. </p>"
+        },
+        "VpcPeeringConnectionId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the VPC peering connection. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about a VPC peering connection between two VPCs: a requester VPC that you own and an accepter VPC with which to create the connection. </p>"
+    },
+    "AwsEc2VpcPeeringConnectionStatusDetails":{
+      "type":"structure",
+      "members":{
+        "Code":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The status of the VPC peering connection. </p>"
+        },
+        "Message":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A message that provides more information about the status, if applicable. </p>"
+        }
+      },
+      "documentation":"<p>Details about the status of the VPC peering connection. </p>"
+    },
+    "AwsEc2VpcPeeringConnectionVpcInfoDetails":{
+      "type":"structure",
+      "members":{
+        "CidrBlock":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The IPv4 CIDR block for the VPC. </p>"
+        },
+        "CidrBlockSet":{
+          "shape":"VpcInfoCidrBlockSetList",
+          "documentation":"<p>Information about the IPv4 CIDR blocks for the VPC. </p>"
+        },
+        "Ipv6CidrBlockSet":{
+          "shape":"VpcInfoIpv6CidrBlockSetList",
+          "documentation":"<p>The IPv6 CIDR block for the VPC. </p>"
+        },
+        "OwnerId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the Amazon Web Services account that owns the VPC. </p>"
+        },
+        "PeeringOptions":{
+          "shape":"VpcInfoPeeringOptionsDetails",
+          "documentation":"<p>Information about the VPC peering connection options for the accepter or requester VPC. </p>"
+        },
+        "Region":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Web Services Region in which the VPC is located. </p>"
+        },
+        "VpcId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the VPC. </p>"
+        }
+      },
+      "documentation":"<p>Describes a VPC in a VPC peering connection. </p>"
+    },
     "AwsEc2VpnConnectionDetails":{
       "type":"structure",
       "members":{
@@ -4145,6 +4581,14 @@
     "AwsEcsClusterDetails":{
       "type":"structure",
       "members":{
+        "ClusterArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the cluster. </p>"
+        },
+        "ActiveServicesCount":{
+          "shape":"Integer",
+          "documentation":"<p>The number of services that are running on the cluster in an <code>ACTIVE</code> state. You can view these services with the Amazon ECS <a href=\"https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html\"> <code>ListServices</code> </a> API operation. </p>"
+        },
         "CapacityProviders":{
           "shape":"NonEmptyStringList",
           "documentation":"<p>The short name of one or more capacity providers to associate with the cluster.</p>"
@@ -4160,9 +4604,51 @@
         "DefaultCapacityProviderStrategy":{
           "shape":"AwsEcsClusterDefaultCapacityProviderStrategyList",
           "documentation":"<p>The default capacity provider strategy for the cluster. The default capacity provider strategy is used when services or tasks are run without a specified launch type or capacity provider strategy.</p>"
+        },
+        "ClusterName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A name that you use to identify your cluster. </p>"
+        },
+        "RegisteredContainerInstancesCount":{
+          "shape":"Integer",
+          "documentation":"<p>The number of container instances registered into the cluster. This includes container instances in both <code>ACTIVE</code> and <code>DRAINING</code> status. </p>"
+        },
+        "RunningTasksCount":{
+          "shape":"Integer",
+          "documentation":"<p>The number of tasks in the cluster that are in the <code>RUNNING</code> state. </p>"
+        },
+        "Status":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The status of the cluster. </p>"
         }
       },
-      "documentation":"<p>provides details about an ECS cluster.</p>"
+      "documentation":"<p>Provides details about an Amazon ECS cluster.</p>"
+    },
+    "AwsEcsContainerDetails":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the container. </p>"
+        },
+        "Image":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The image used for the container. </p>"
+        },
+        "MountPoints":{
+          "shape":"AwsMountPointList",
+          "documentation":"<p>The mount points for data volumes in your container. </p>"
+        },
+        "Privileged":{
+          "shape":"Boolean",
+          "documentation":"<p>When this parameter is true, the container is given elevated privileges on the host container instance (similar to the root user). </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an Amazon ECS container. </p>"
+    },
+    "AwsEcsContainerDetailsList":{
+      "type":"list",
+      "member":{"shape":"AwsEcsContainerDetails"}
     },
     "AwsEcsServiceCapacityProviderStrategyDetails":{
       "type":"structure",
@@ -5052,7 +5538,7 @@
           "documentation":"<p>The data volume definitions for the task.</p>"
         }
       },
-      "documentation":"<p>details about a task definition. A task definition describes the container and volume definitions of an Amazon Elastic Container Service task.</p>"
+      "documentation":"<p>Details about a task definition. A task definition describes the container and volume definitions of an Amazon Elastic Container Service task.</p>"
     },
     "AwsEcsTaskDefinitionInferenceAcceleratorsDetails":{
       "type":"structure",
@@ -5228,6 +5714,156 @@
       "type":"list",
       "member":{"shape":"AwsEcsTaskDefinitionVolumesDetails"}
     },
+    "AwsEcsTaskDetails":{
+      "type":"structure",
+      "members":{
+        "ClusterArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the cluster that hosts the task. </p>"
+        },
+        "TaskDefinitionArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ARN of the task definition that creates the task. </p>"
+        },
+        "Version":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The version counter for the task. </p>"
+        },
+        "CreatedAt":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Unix timestamp for the time when the task was created. More specifically, it's for the time when the task entered the <code>PENDING</code> state. </p>"
+        },
+        "StartedAt":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Unix timestamp for the time when the task started. More specifically, it's for the time when the task transitioned from the <code>PENDING</code> state to the <code>RUNNING</code> state. </p>"
+        },
+        "StartedBy":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The tag specified when a task is started. If an Amazon ECS service started the task, the <code>startedBy</code> parameter contains the deployment ID of that service. </p>"
+        },
+        "Group":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the task group that's associated with the task. </p>"
+        },
+        "Volumes":{
+          "shape":"AwsEcsTaskVolumeDetailsList",
+          "documentation":"<p>Details about the data volume that is used in a task definition. </p>"
+        },
+        "Containers":{
+          "shape":"AwsEcsContainerDetailsList",
+          "documentation":"<p>The containers that are associated with the task. </p>"
+        }
+      },
+      "documentation":"<p>Provides details about a task in a cluster. </p>"
+    },
+    "AwsEcsTaskVolumeDetails":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This name is referenced in the <code>sourceVolume</code> parameter of container definition <code>mountPoints</code>. </p>"
+        },
+        "Host":{
+          "shape":"AwsEcsTaskVolumeHostDetails",
+          "documentation":"<p>This parameter is specified when you use bind mount host volumes. The contents of the <code>host</code> parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about a data volume that's used in a task definition. </p>"
+    },
+    "AwsEcsTaskVolumeDetailsList":{
+      "type":"list",
+      "member":{"shape":"AwsEcsTaskVolumeDetails"}
+    },
+    "AwsEcsTaskVolumeHostDetails":{
+      "type":"structure",
+      "members":{
+        "SourcePath":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>When the <code>host</code> parameter is used, specify a <code>sourcePath</code> to declare the path on the host container instance that's presented to the container. </p>"
+        }
+      },
+      "documentation":"<p>Provides details on a container instance bind mount host volume. </p>"
+    },
+    "AwsEfsAccessPointDetails":{
+      "type":"structure",
+      "members":{
+        "AccessPointId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the Amazon EFS access point. </p>"
+        },
+        "Arn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the Amazon EFS access point. </p>"
+        },
+        "ClientToken":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The opaque string specified in the request to ensure idempotent creation. </p>"
+        },
+        "FileSystemId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the Amazon EFS file system that the access point applies to. </p>"
+        },
+        "PosixUser":{
+          "shape":"AwsEfsAccessPointPosixUserDetails",
+          "documentation":"<p>The full POSIX identity, including the user ID, group ID, and secondary group IDs on the access point, that is used for all file operations by NFS clients using the access point. </p>"
+        },
+        "RootDirectory":{
+          "shape":"AwsEfsAccessPointRootDirectoryDetails",
+          "documentation":"<p>The directory on the Amazon EFS file system that the access point exposes as the root directory to NFS clients using the access point. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an Amazon EFS access point. </p>"
+    },
+    "AwsEfsAccessPointPosixUserDetails":{
+      "type":"structure",
+      "members":{
+        "Gid":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The POSIX group ID used for all file system operations using this access point. </p>"
+        },
+        "SecondaryGids":{
+          "shape":"NonEmptyStringList",
+          "documentation":"<p>Secondary POSIX group IDs used for all file system operations using this access point. </p>"
+        },
+        "Uid":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The POSIX user ID used for all file system operations using this access point. </p>"
+        }
+      },
+      "documentation":"<p>Provides details for all file system operations using this Amazon EFS access point. </p>"
+    },
+    "AwsEfsAccessPointRootDirectoryCreationInfoDetails":{
+      "type":"structure",
+      "members":{
+        "OwnerGid":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the POSIX group ID to apply to the root directory. </p>"
+        },
+        "OwnerUid":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the POSIX user ID to apply to the root directory. </p>"
+        },
+        "Permissions":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the POSIX permissions to apply to the root directory, in the format of an octal number representing the file's mode bits. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the settings that Amazon EFS uses to create the root directory when a client connects to an access point. </p>"
+    },
+    "AwsEfsAccessPointRootDirectoryDetails":{
+      "type":"structure",
+      "members":{
+        "CreationInfo":{
+          "shape":"AwsEfsAccessPointRootDirectoryCreationInfoDetails",
+          "documentation":"<p>Specifies the POSIX IDs and permissions to apply to the access point's root directory. </p>"
+        },
+        "Path":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the path on the Amazon EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system. A path can have up to four subdirectories. If the specified path does not exist, you are required to provide <code>CreationInfo</code>. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the directory on the Amazon EFS file system that the access point exposes as the root directory to NFS clients using the access point. </p>"
+    },
     "AwsEksClusterDetails":{
       "type":"structure",
       "members":{
@@ -5569,7 +6205,7 @@
         },
         "KmsKeyId":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The KMS key ID. Takes the form 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a.</p>"
+          "documentation":"<p>The KMS key ID. Takes the form <code>1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a</code>.</p>"
         }
       },
       "documentation":"<p>Details about the configuration for encryption at rest.</p>"
@@ -6517,6 +7153,46 @@
       "type":"list",
       "member":{"shape":"AwsIamUserPolicy"}
     },
+    "AwsKinesisStreamDetails":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the Kinesis stream. If you don't specify a name, CloudFront generates a unique physical ID and uses that ID for the stream name. </p>"
+        },
+        "Arn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the Kinesis data stream. </p>"
+        },
+        "StreamEncryption":{
+          "shape":"AwsKinesisStreamStreamEncryptionDetails",
+          "documentation":"<p>When specified, enables or updates server-side encryption using an KMS key for a specified stream. Removing this property from your stack template and updating your stack disables encryption. </p>"
+        },
+        "ShardCount":{
+          "shape":"Integer",
+          "documentation":"<p>The number of shards that the stream uses. </p>"
+        },
+        "RetentionPeriodHours":{
+          "shape":"Integer",
+          "documentation":"<p>The number of hours for the data records that are stored in shards to remain accessible. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an Amazon Kinesis data stream. </p>"
+    },
+    "AwsKinesisStreamStreamEncryptionDetails":{
+      "type":"structure",
+      "members":{
+        "EncryptionType":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The encryption type to use. </p>"
+        },
+        "KeyId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The globally unique identifier for the customer-managed KMS key to use for encryption. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about stream encryption. </p>"
+    },
     "AwsKmsKeyDetails":{
       "type":"structure",
       "members":{
@@ -6546,7 +7222,7 @@
         },
         "Description":{
           "shape":"NonEmptyString",
-          "documentation":"<p>A description of the key.</p>"
+          "documentation":"<p>A description of the KMS key.</p>"
         },
         "KeyRotationStatus":{
           "shape":"Boolean",
@@ -6758,6 +7434,24 @@
       "documentation":"<p>Details about a Lambda layer version.</p>"
     },
     "AwsLambdaLayerVersionNumber":{"type":"long"},
+    "AwsMountPoint":{
+      "type":"structure",
+      "members":{
+        "SourceVolume":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the volume to mount. Must be a volume name referenced in the <code>name</code> parameter of task definition <code>volume</code>. </p>"
+        },
+        "ContainerPath":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The path on the container to mount the host volume at. </p>"
+        }
+      },
+      "documentation":"<p>Details for a volume mount point that's used in a container definition. </p>"
+    },
+    "AwsMountPointList":{
+      "type":"list",
+      "member":{"shape":"AwsMountPoint"}
+    },
     "AwsNetworkFirewallFirewallDetails":{
       "type":"structure",
       "members":{
@@ -6878,6 +7572,24 @@
       },
       "documentation":"<p>Details about an Network Firewall rule group. Rule groups are used to inspect and control network traffic. Stateless rule groups apply to individual packets. Stateful rule groups apply to packets in the context of their traffic flow.</p> <p>Rule groups are referenced in firewall policies. </p>"
     },
+    "AwsOpenSearchServiceDomainAdvancedSecurityOptionsDetails":{
+      "type":"structure",
+      "members":{
+        "Enabled":{
+          "shape":"Boolean",
+          "documentation":"<p>Enables fine-grained access control. </p>"
+        },
+        "InternalUserDatabaseEnabled":{
+          "shape":"Boolean",
+          "documentation":"<p>Enables the internal user database. </p>"
+        },
+        "MasterUserOptions":{
+          "shape":"AwsOpenSearchServiceDomainMasterUserOptionsDetails",
+          "documentation":"<p>Specifies information about the master user of the domain. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about domain access control options. </p>"
+    },
     "AwsOpenSearchServiceDomainClusterConfigDetails":{
       "type":"structure",
       "members":{
@@ -6992,6 +7704,10 @@
         "DomainEndpoints":{
           "shape":"FieldMap",
           "documentation":"<p>The domain endpoints. Used if the OpenSearch domain resides in a VPC.</p> <p>This is a map of key-value pairs. The key is always <code>vpc</code>. The value is the endpoint.</p>"
+        },
+        "AdvancedSecurityOptions":{
+          "shape":"AwsOpenSearchServiceDomainAdvancedSecurityOptionsDetails",
+          "documentation":"<p>Specifies options for fine-grained access control. </p>"
         }
       },
       "documentation":"<p>Information about an Amazon OpenSearch Service domain.</p>"
@@ -7068,6 +7784,24 @@
       },
       "documentation":"<p>Configures the CloudWatch Logs to publish for the OpenSearch domain.</p>"
     },
+    "AwsOpenSearchServiceDomainMasterUserOptionsDetails":{
+      "type":"structure",
+      "members":{
+        "MasterUserArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Resource Name (ARN) for the master user. </p>"
+        },
+        "MasterUserName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The username for the master user. </p>"
+        },
+        "MasterUserPassword":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The password for the master user. </p>"
+        }
+      },
+      "documentation":"<p>Specifies information about the master user of the domain. </p>"
+    },
     "AwsOpenSearchServiceDomainNodeToNodeEncryptionOptionsDetails":{
       "type":"structure",
       "members":{
@@ -8292,7 +9026,7 @@
         },
         "ManualSnapshotRetentionPeriod":{
           "shape":"Integer",
-          "documentation":"<p>The number of days that manual snapshots are retained in the destination region after they are copied from a source region.</p> <p>If the value is -1, then the manual snapshot is retained indefinitely.</p> <p>Valid values: Either -1 or an integer between 1 and 3,653</p>"
+          "documentation":"<p>The number of days that manual snapshots are retained in the destination region after they are copied from a source region.</p> <p>If the value is <code>-1</code>, then the manual snapshot is retained indefinitely.</p> <p>Valid values: Either <code>-1</code> or an integer between 1 and 3,653</p>"
         },
         "RetentionPeriod":{
           "shape":"Integer",
@@ -8444,7 +9178,7 @@
         },
         "ManualSnapshotRetentionPeriod":{
           "shape":"Integer",
-          "documentation":"<p>The default number of days to retain a manual snapshot.</p> <p>If the value is -1, the snapshot is retained indefinitely.</p> <p>This setting doesn't change the retention period of existing snapshots.</p> <p>Valid values: Either -1 or an integer between 1 and 3,653</p>"
+          "documentation":"<p>The default number of days to retain a manual snapshot.</p> <p>If the value is <code>-1</code>, the snapshot is retained indefinitely.</p> <p>This setting doesn't change the retention period of existing snapshots.</p> <p>Valid values: Either <code>-1</code> or an integer between 1 and 3,653</p>"
         },
         "MasterUsername":{
           "shape":"NonEmptyString",
@@ -9429,6 +10163,10 @@
           "shape":"ProcessDetails",
           "documentation":"<p>The details of process-related information about a finding.</p>"
         },
+        "Threats":{
+          "shape":"ThreatList",
+          "documentation":"<p>Details about the threat detected in a security finding and the file paths that were affected by the threat. </p>"
+        },
         "ThreatIntelIndicators":{
           "shape":"ThreatIntelIndicatorList",
           "documentation":"<p>Threat intelligence details related to a finding.</p>"
@@ -9917,18 +10655,46 @@
         },
         "Subscription":{
           "shape":"AwsSnsTopicSubscriptionList",
-          "documentation":"<p>Subscription is an embedded property that describes the subscription endpoints of an SNS topic.</p>"
+          "documentation":"<p>Subscription is an embedded property that describes the subscription endpoints of an Amazon SNS topic.</p>"
         },
         "TopicName":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The name of the topic.</p>"
+          "documentation":"<p>The name of the Amazon SNS topic.</p>"
         },
         "Owner":{
           "shape":"NonEmptyString",
           "documentation":"<p>The subscription's owner.</p>"
+        },
+        "SqsSuccessFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates successful message delivery status for an Amazon SNS topic that is subscribed to an Amazon SQS endpoint. </p>"
+        },
+        "SqsFailureFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates failed message delivery status for an Amazon SNS topic that is subscribed to an Amazon SQS endpoint. </p>"
+        },
+        "ApplicationSuccessFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates failed message delivery status for an Amazon SNS topic that is subscribed to a platform application endpoint. </p>"
+        },
+        "FirehoseSuccessFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates successful message delivery status for an Amazon SNS topic that is subscribed to an Amazon Kinesis Data Firehose endpoint. </p>"
+        },
+        "FirehoseFailureFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates failed message delivery status for an Amazon SNS topic that is subscribed to an Amazon Kinesis Data Firehose endpoint. </p>"
+        },
+        "HttpSuccessFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates successful message delivery status for an Amazon SNS topic that is subscribed to an HTTP endpoint. </p>"
+        },
+        "HttpFailureFeedbackRoleArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Indicates failed message delivery status for an Amazon SNS topic that is subscribed to an HTTP endpoint. </p>"
         }
       },
-      "documentation":"<p>A wrapper type for the topic's ARN.</p>"
+      "documentation":"<p>Provides information about an Amazon SNS topic to which notifications can be published.</p>"
     },
     "AwsSnsTopicSubscription":{
       "type":"structure",
@@ -10172,27 +10938,307 @@
       "type":"list",
       "member":{"shape":"AwsWafRegionalRateBasedRuleMatchPredicate"}
     },
+    "AwsWafRegionalRuleDetails":{
+      "type":"structure",
+      "members":{
+        "MetricName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A name for the metrics for the rule. </p>"
+        },
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A descriptive name for the rule. </p>"
+        },
+        "PredicateList":{
+          "shape":"AwsWafRegionalRulePredicateList",
+          "documentation":"<p>Specifies the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, and <code>SizeConstraintSet</code> objects that you want to add to a rule and, for each object, indicates whether you want to negate the settings. </p>"
+        },
+        "RuleId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the rule. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an WAF Regional rule. This rule identifies the web requests that you want to allow, block, or count. </p>"
+    },
+    "AwsWafRegionalRuleGroupDetails":{
+      "type":"structure",
+      "members":{
+        "MetricName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A name for the metrics for this rule group. </p>"
+        },
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The descriptive name of the rule group. </p>"
+        },
+        "RuleGroupId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the rule group. </p>"
+        },
+        "Rules":{
+          "shape":"AwsWafRegionalRuleGroupRulesList",
+          "documentation":"<p>Provides information about the rule statements used to identify the web requests that you want to allow, block, or count. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an WAF Regional rule group. The rule group is a collection of rules for inspecting and controlling web requests. </p>"
+    },
+    "AwsWafRegionalRuleGroupRulesActionDetails":{
+      "type":"structure",
+      "members":{
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, and <code>SizeConstraintSet</code> objects that you want to add to a rule and, for each object, indicates whether you want to negate the settings.</p>"
+        }
+      },
+      "documentation":"<p>Describes the action that AWS WAF should take on a web request when it matches the criteria defined in the rule. </p>"
+    },
+    "AwsWafRegionalRuleGroupRulesDetails":{
+      "type":"structure",
+      "members":{
+        "Action":{
+          "shape":"AwsWafRegionalRuleGroupRulesActionDetails",
+          "documentation":"<p>The action that WAF should take on a web request when it matches the criteria defined in the rule. </p>"
+        },
+        "Priority":{
+          "shape":"Integer",
+          "documentation":"<p>If you define more than one rule in a web ACL, WAF evaluates each request against the rules in order based on the value of <code>Priority</code>. </p>"
+        },
+        "RuleId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID for a rule. </p>"
+        },
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The type of rule in the rule group. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the rules attached to a rule group </p>"
+    },
+    "AwsWafRegionalRuleGroupRulesList":{
+      "type":"list",
+      "member":{"shape":"AwsWafRegionalRuleGroupRulesDetails"}
+    },
+    "AwsWafRegionalRulePredicateList":{
+      "type":"list",
+      "member":{"shape":"AwsWafRegionalRulePredicateListDetails"}
+    },
+    "AwsWafRegionalRulePredicateListDetails":{
+      "type":"structure",
+      "members":{
+        "DataId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A unique identifier for a predicate in a rule, such as <code>ByteMatchSetId</code> or <code>IPSetId</code>. </p>"
+        },
+        "Negated":{
+          "shape":"Boolean",
+          "documentation":"<p>Specifies if you want WAF to allow, block, or count requests based on the settings in the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, or <code>SizeConstraintSet</code>. </p>"
+        },
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The type of predicate in a rule, such as <code>ByteMatch</code> or <code>IPSet</code>. </p>"
+        }
+      },
+      "documentation":"<p>Provides details about the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, and <code>SizeConstraintSet</code> objects that you want to add to a rule and, for each object, indicates whether you want to negate the settings. </p>"
+    },
+    "AwsWafRegionalWebAclDetails":{
+      "type":"structure",
+      "members":{
+        "DefaultAction":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The action to perform if none of the rules contained in the web ACL match. </p>"
+        },
+        "MetricName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A name for the metrics for this web ACL. </p>"
+        },
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A descriptive name for the web ACL. </p>"
+        },
+        "RulesList":{
+          "shape":"AwsWafRegionalWebAclRulesList",
+          "documentation":"<p>An array that contains the action for each rule in a web ACL, the priority of the rule, and the ID of the rule. </p>"
+        },
+        "WebAclId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the web ACL. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the web access control list (web ACL). The web ACL contains the rules that identify the requests that you want to allow, block, or count. </p>"
+    },
+    "AwsWafRegionalWebAclRulesList":{
+      "type":"list",
+      "member":{"shape":"AwsWafRegionalWebAclRulesListDetails"}
+    },
+    "AwsWafRegionalWebAclRulesListActionDetails":{
+      "type":"structure",
+      "members":{
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>For actions that are associated with a rule, the action that WAF takes when a web request matches all conditions in a rule. </p>"
+        }
+      },
+      "documentation":"<p>The action that WAF takes when a web request matches all conditions in the rule, such as allow, block, or count the request. </p>"
+    },
+    "AwsWafRegionalWebAclRulesListDetails":{
+      "type":"structure",
+      "members":{
+        "Action":{
+          "shape":"AwsWafRegionalWebAclRulesListActionDetails",
+          "documentation":"<p>The action that AWS WAF takes when a web request matches all conditions in the rule, such as allow, block, or count the request. </p>"
+        },
+        "OverrideAction":{
+          "shape":"AwsWafRegionalWebAclRulesListOverrideActionDetails",
+          "documentation":"<p>Overrides the rule evaluation result in the rule group. </p>"
+        },
+        "Priority":{
+          "shape":"Integer",
+          "documentation":"<p>The order in which WAF evaluates the rules in a web ACL. </p>"
+        },
+        "RuleId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of an WAF Regional rule to associate with a web ACL. </p>"
+        },
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>For actions that are associated with a rule, the action that WAF takes when a web request matches all conditions in a rule. </p>"
+        }
+      },
+      "documentation":"<p>A combination of <code>ByteMatchSet</code>, <code>IPSet</code>, and/or <code>SqlInjectionMatchSet</code> objects that identify the web requests that you want to allow, block, or count. </p>"
+    },
+    "AwsWafRegionalWebAclRulesListOverrideActionDetails":{
+      "type":"structure",
+      "members":{
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Overrides the rule evaluation result in the rule group. </p>"
+        }
+      },
+      "documentation":"<p>Provides details about the action to use in the place of the action that results from the rule group evaluation. </p>"
+    },
+    "AwsWafRuleDetails":{
+      "type":"structure",
+      "members":{
+        "MetricName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the metrics for this rule. </p>"
+        },
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A descriptive name for the rule. </p>"
+        },
+        "PredicateList":{
+          "shape":"AwsWafRulePredicateList",
+          "documentation":"<p>Specifies the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, and <code>SizeConstraintSet</code> objects that you want to add to a rule and, for each object, indicates whether you want to negate the settings. </p>"
+        },
+        "RuleId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the WAF rule. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about a WAF rule. This rule specifies the web requests that you want to allow, block, or count. </p>"
+    },
+    "AwsWafRuleGroupDetails":{
+      "type":"structure",
+      "members":{
+        "MetricName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the metrics for this rule group. </p>"
+        },
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the rule group. </p>"
+        },
+        "RuleGroupId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ID of the rule group. </p>"
+        },
+        "Rules":{
+          "shape":"AwsWafRuleGroupRulesList",
+          "documentation":"<p>Provides information about the rules attached to the rule group. These rules identify the web requests that you want to allow, block, or count. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an WAF rule group. A rule group is a collection of rules for inspecting and controlling web requests. </p>"
+    },
+    "AwsWafRuleGroupRulesActionDetails":{
+      "type":"structure",
+      "members":{
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The action that WAF should take on a web request when it matches the rule's statement.</p>"
+        }
+      },
+      "documentation":"<p>Provides information about what action WAF should take on a web request when it matches the criteria defined in the rule. </p>"
+    },
+    "AwsWafRuleGroupRulesDetails":{
+      "type":"structure",
+      "members":{
+        "Action":{
+          "shape":"AwsWafRuleGroupRulesActionDetails",
+          "documentation":"<p>Provides information about what action WAF should take on a web request when it matches the criteria defined in the rule. </p>"
+        },
+        "Priority":{
+          "shape":"Integer",
+          "documentation":"<p>If you define more than one rule in a web ACL, WAF evaluates each request against the rules in order based on the value of <code>Priority</code>.</p>"
+        },
+        "RuleId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The rule ID for a rule. </p>"
+        },
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The type of rule. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the rules attached to the rule group. These rules identify the web requests that you want to allow, block, or count. </p>"
+    },
+    "AwsWafRuleGroupRulesList":{
+      "type":"list",
+      "member":{"shape":"AwsWafRuleGroupRulesDetails"}
+    },
+    "AwsWafRulePredicateList":{
+      "type":"list",
+      "member":{"shape":"AwsWafRulePredicateListDetails"}
+    },
+    "AwsWafRulePredicateListDetails":{
+      "type":"structure",
+      "members":{
+        "DataId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>A unique identifier for a predicate in a rule, such as <code>ByteMatchSetId</code> or <code>IPSetId</code>. </p>"
+        },
+        "Negated":{
+          "shape":"Boolean",
+          "documentation":"<p>Specifies if you want WAF to allow, block, or count requests based on the settings in the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, or <code>SizeConstraintSet</code>. </p>"
+        },
+        "Type":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The type of predicate in a rule, such as <code>ByteMatch</code> or <code>IPSet</code>. </p>"
+        }
+      },
+      "documentation":"<p>Provides details about the <code>ByteMatchSet</code>, <code>IPSet</code>, <code>SqlInjectionMatchSet</code>, <code>XssMatchSet</code>, <code>RegexMatchSet</code>, <code>GeoMatchSet</code>, and <code>SizeConstraintSet</code> objects that you want to add to a rule and, for each object, indicates whether you want to negate the settings. </p>"
+    },
     "AwsWafWebAclDetails":{
       "type":"structure",
       "members":{
         "Name":{
           "shape":"NonEmptyString",
-          "documentation":"<p>A friendly name or description of the WebACL. You can't change the name of a WebACL after you create it.</p>"
+          "documentation":"<p>A friendly name or description of the web ACL. You can't change the name of a web ACL after you create it.</p>"
         },
         "DefaultAction":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The action to perform if none of the rules contained in the WebACL match.</p>"
+          "documentation":"<p>The action to perform if none of the rules contained in the web ACL match.</p>"
         },
         "Rules":{
           "shape":"AwsWafWebAclRuleList",
-          "documentation":"<p>An array that contains the action for each rule in a WebACL, the priority of the rule, and the ID of the rule.</p>"
+          "documentation":"<p>An array that contains the action for each rule in a web ACL, the priority of the rule, and the ID of the rule.</p>"
         },
         "WebAclId":{
           "shape":"NonEmptyString",
-          "documentation":"<p>A unique identifier for a WebACL.</p>"
+          "documentation":"<p>A unique identifier for a web ACL.</p>"
         }
       },
-      "documentation":"<p>Details about an WAF WebACL.</p>"
+      "documentation":"<p>Provides information about an WAF web access control list (web ACL).</p>"
     },
     "AwsWafWebAclRule":{
       "type":"structure",
@@ -10207,11 +11253,11 @@
         },
         "OverrideAction":{
           "shape":"WafOverrideAction",
-          "documentation":"<p>Use the <code>OverrideAction</code> to test your RuleGroup.</p> <p>Any rule in a RuleGroup can potentially block a request. If you set the <code>OverrideAction</code> to <code>None</code>, the RuleGroup blocks a request if any individual rule in the RuleGroup matches the request and is configured to block that request.</p> <p>However, if you first want to test the RuleGroup, set the <code>OverrideAction</code> to <code>Count</code>. The RuleGroup then overrides any block action specified by individual rules contained within the group. Instead of blocking matching requests, those requests are counted.</p> <p> <code>ActivatedRule</code>|<code>OverrideAction</code> applies only when updating or adding a RuleGroup to a WebACL. In this case you do not use <code>ActivatedRule</code>|<code>Action</code>. For all other update requests, <code>ActivatedRule</code>|<code>Action</code> is used instead of <code>ActivatedRule</code>|<code>OverrideAction</code>. </p>"
+          "documentation":"<p>Use the <code>OverrideAction</code> to test your <code>RuleGroup</code>.</p> <p>Any rule in a <code>RuleGroup</code> can potentially block a request. If you set the <code>OverrideAction</code> to <code>None</code>, the <code>RuleGroup</code> blocks a request if any individual rule in the <code>RuleGroup</code> matches the request and is configured to block that request.</p> <p>However, if you first want to test the <code>RuleGroup</code>, set the <code>OverrideAction</code> to <code>Count</code>. The <code>RuleGroup</code> then overrides any block action specified by individual rules contained within the group. Instead of blocking matching requests, those requests are counted.</p> <p> <code>ActivatedRule</code>|<code>OverrideAction</code> applies only when updating or adding a <code>RuleGroup</code> to a web ACL. In this case you do not use <code>ActivatedRule</code> <code>Action</code>. For all other update requests, <code>ActivatedRule</code> <code>Action</code> is used instead of <code>ActivatedRule</code> <code>OverrideAction</code>.</p>"
         },
         "Priority":{
           "shape":"Integer",
-          "documentation":"<p>Specifies the order in which the rules in a WebACL are evaluated. Rules with a lower value for <code>Priority</code> are evaluated before rules with a higher value. The value must be a unique integer. If you add multiple rules to a WebACL, the values do not need to be consecutive.</p>"
+          "documentation":"<p>Specifies the order in which the rules in a web ACL are evaluated. Rules with a lower value for <code>Priority</code> are evaluated before rules with a higher value. The value must be a unique integer. If you add multiple rules to a web ACL, the values do not need to be consecutive.</p>"
         },
         "RuleId":{
           "shape":"NonEmptyString",
@@ -10222,7 +11268,7 @@
           "documentation":"<p>The rule type.</p> <p>Valid values: <code>REGULAR</code> | <code>RATE_BASED</code> | <code>GROUP</code> </p> <p>The default is <code>REGULAR</code>.</p>"
         }
       },
-      "documentation":"<p>Details for a rule in an WAF WebACL.</p>"
+      "documentation":"<p>Details for a rule in an WAF web ACL.</p>"
     },
     "AwsWafWebAclRuleList":{
       "type":"list",
@@ -10559,21 +11605,33 @@
     "ContainerDetails":{
       "type":"structure",
       "members":{
+        "ContainerRuntime":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The runtime of the container. </p>"
+        },
         "Name":{
           "shape":"NonEmptyString",
           "documentation":"<p>The name of the container related to a finding.</p>"
         },
         "ImageId":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The identifier of the image related to a finding.</p>"
+          "documentation":"<p>The identifier of the container image related to a finding.</p>"
         },
         "ImageName":{
           "shape":"NonEmptyString",
-          "documentation":"<p>The name of the image related to a finding.</p>"
+          "documentation":"<p>The name of the container image related to a finding.</p>"
         },
         "LaunchedAt":{
           "shape":"NonEmptyString",
           "documentation":"<p>Indicates when the container started.</p> <p>Uses the <code>date-time</code> format specified in <a href=\"https://tools.ietf.org/html/rfc3339#section-5.6\">RFC 3339 section 5.6, Internet Date/Time Format</a>. The value cannot contain spaces. For example, <code>2020-03-22T13:22:13.933Z</code>.</p>"
+        },
+        "VolumeMounts":{
+          "shape":"VolumeMountList",
+          "documentation":"<p>Provides information about the mounting of a volume in a container. </p>"
+        },
+        "Privileged":{
+          "shape":"Boolean",
+          "documentation":"<p>When this parameter is <code>true</code>, the container is given elevated privileges on the host container instance (similar to the root user). </p>"
         }
       },
       "documentation":"<p>Container details related to a finding.</p>"
@@ -11302,6 +12360,32 @@
       "key":{"shape":"NonEmptyString"},
       "value":{"shape":"NonEmptyString"}
     },
+    "FilePathList":{
+      "type":"list",
+      "member":{"shape":"FilePaths"}
+    },
+    "FilePaths":{
+      "type":"structure",
+      "members":{
+        "FilePath":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Path to the infected or suspicious file on the resource it was detected on. </p>"
+        },
+        "FileName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the infected or suspicious file corresponding to the hash. </p>"
+        },
+        "ResourceId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the resource on which the threat was detected. </p>"
+        },
+        "Hash":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The hash value for the infected or suspicious file. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the file paths that were affected by the threat. </p>"
+    },
     "FindingAggregator":{
       "type":"structure",
       "members":{
@@ -11664,11 +12748,11 @@
       "members":{
         "Code":{
           "shape":"Integer",
-          "documentation":"<p>The ICMP code for which to deny or allow access. To deny or allow all codes, use the value -1.</p>"
+          "documentation":"<p>The ICMP code for which to deny or allow access. To deny or allow all codes, use the value <code>-1</code>.</p>"
         },
         "Type":{
           "shape":"Integer",
-          "documentation":"<p>The ICMP type for which to deny or allow access. To deny or allow all types, use the value -1.</p>"
+          "documentation":"<p>The ICMP type for which to deny or allow access. To deny or allow all types, use the value <code>-1</code>.</p>"
         }
       },
       "documentation":"<p>An Internet Control Message Protocol (ICMP) type and code.</p>"
@@ -12936,11 +14020,11 @@
         },
         "AwsEc2Volume":{
           "shape":"AwsEc2VolumeDetails",
-          "documentation":"<p>Details for an EC2 volume.</p>"
+          "documentation":"<p>Details for an Amazon EC2 volume.</p>"
         },
         "AwsEc2Vpc":{
           "shape":"AwsEc2VpcDetails",
-          "documentation":"<p>Details for an EC2 VPC.</p>"
+          "documentation":"<p>Details for an Amazon EC2 VPC.</p>"
         },
         "AwsEc2Eip":{
           "shape":"AwsEc2EipDetails",
@@ -13068,7 +14152,7 @@
         },
         "AwsWafWebAcl":{
           "shape":"AwsWafWebAclDetails",
-          "documentation":"<p>Details for an WAF WebACL.</p>"
+          "documentation":"<p>Details for an WAF web ACL.</p>"
         },
         "AwsRdsDbSnapshot":{
           "shape":"AwsRdsDbSnapshotDetails",
@@ -13084,7 +14168,11 @@
         },
         "AwsEcsCluster":{
           "shape":"AwsEcsClusterDetails",
-          "documentation":"<p>Details about an ECS cluster.</p>"
+          "documentation":"<p>Details about an Amazon ECS cluster.</p>"
+        },
+        "AwsEcsContainer":{
+          "shape":"AwsEcsContainerDetails",
+          "documentation":"<p>Provides information about a Docker container that's part of a task. </p>"
         },
         "AwsEcsTaskDefinition":{
           "shape":"AwsEcsTaskDefinitionDetails",
@@ -13112,7 +14200,7 @@
         },
         "AwsEc2VpnConnection":{
           "shape":"AwsEc2VpnConnectionDetails",
-          "documentation":"<p>Details about an EC2 VPN connection.</p>"
+          "documentation":"<p>Details about an Amazon EC2 VPN connection.</p>"
         },
         "AwsEcrContainerImage":{
           "shape":"AwsEcrContainerImageDetails",
@@ -13161,6 +14249,54 @@
         "AwsRdsDbSecurityGroup":{
           "shape":"AwsRdsDbSecurityGroupDetails",
           "documentation":"<p>Details about an Amazon RDS DB security group.</p>"
+        },
+        "AwsKinesisStream":{
+          "shape":"AwsKinesisStreamDetails",
+          "documentation":"<p>Details about an Amazon Kinesis data stream.</p>"
+        },
+        "AwsEc2TransitGateway":{
+          "shape":"AwsEc2TransitGatewayDetails",
+          "documentation":"<p>Details about an Amazon EC2 transit gateway that interconnects your virtual private clouds (VPC) and on-premises networks.</p>"
+        },
+        "AwsEfsAccessPoint":{
+          "shape":"AwsEfsAccessPointDetails",
+          "documentation":"<p>Details about an Amazon EFS access point. An access point is an application-specific view into an EFS file system that applies an operating system user and group, and a file system path, to any file system request made through the access point. </p>"
+        },
+        "AwsCloudFormationStack":{
+          "shape":"AwsCloudFormationStackDetails",
+          "documentation":"<p>Details about an CloudFormation stack. A stack is a collection of Amazon Web Services resources that you can manage as a single unit.</p>"
+        },
+        "AwsCloudWatchAlarm":{
+          "shape":"AwsCloudWatchAlarmDetails",
+          "documentation":"<p>Details about an Amazon CloudWatch alarm. An alarm allows you to monitor and receive alerts about your Amazon Web Services resources and applications across multiple Regions.</p>"
+        },
+        "AwsEc2VpcPeeringConnection":{
+          "shape":"AwsEc2VpcPeeringConnectionDetails",
+          "documentation":"<p>Details about an Amazon EC2 VPC peering connection. A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them privately. </p>"
+        },
+        "AwsWafRegionalRuleGroup":{
+          "shape":"AwsWafRegionalRuleGroupDetails",
+          "documentation":"<p>Details about an WAF rule group for Regional resources. </p>"
+        },
+        "AwsWafRegionalRule":{
+          "shape":"AwsWafRegionalRuleDetails",
+          "documentation":"<p>Details about an WAF rule for Regional resources. </p>"
+        },
+        "AwsWafRegionalWebAcl":{
+          "shape":"AwsWafRegionalWebAclDetails",
+          "documentation":"<p>Details about an WAF web access control list (web ACL) for Regional resources. </p>"
+        },
+        "AwsWafRule":{
+          "shape":"AwsWafRuleDetails",
+          "documentation":"<p>Details about an WAF rule for global resources. </p>"
+        },
+        "AwsWafRuleGroup":{
+          "shape":"AwsWafRuleGroupDetails",
+          "documentation":"<p>Details about an WAF rule group for global resources. </p>"
+        },
+        "AwsEcsTask":{
+          "shape":"AwsEcsTaskDetails",
+          "documentation":"<p>Details about a task in a cluster. </p>"
         }
       },
       "documentation":"<p>Additional details about a resource related to a finding.</p> <p>To provide the details, use the object that corresponds to the resource type. For example, if the resource type is <code>AwsEc2Instance</code>, then you use the <code>AwsEc2Instance</code> object to provide the details.</p> <p>If the type-specific object does not contain all of the fields you want to populate, then you use the <code>Other</code> object to populate those additional fields.</p> <p>You also use the <code>Other</code> object to populate the details when the selected type does not have a corresponding object.</p>"
@@ -14013,6 +15149,28 @@
       "type":"string",
       "max":256
     },
+    "Threat":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the threat. </p>"
+        },
+        "Severity":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The severity of the threat. </p>"
+        },
+        "ItemCount":{
+          "shape":"Integer",
+          "documentation":"<p>This total number of items in which the threat has been detected. </p>"
+        },
+        "FilePaths":{
+          "shape":"FilePathList",
+          "documentation":"<p>Provides information about the file paths that were affected by the threat. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the threat detected in a security finding and the file paths that were affected by the threat. </p>"
+    },
     "ThreatIntelIndicator":{
       "type":"structure",
       "members":{
@@ -14074,6 +15232,10 @@
         "URL"
       ]
     },
+    "ThreatList":{
+      "type":"list",
+      "member":{"shape":"Threat"}
+    },
     "Timestamp":{
       "type":"timestamp",
       "timestampFormat":"iso8601"
@@ -14294,6 +15456,70 @@
         "BENIGN_POSITIVE"
       ]
     },
+    "VolumeMount":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the volume. </p>"
+        },
+        "MountPath":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The path in the container at which the volume should be mounted. </p>"
+        }
+      },
+      "documentation":"<p>Describes the mounting of a volume in a container. </p>"
+    },
+    "VolumeMountList":{
+      "type":"list",
+      "member":{"shape":"VolumeMount"}
+    },
+    "VpcInfoCidrBlockSetDetails":{
+      "type":"structure",
+      "members":{
+        "CidrBlock":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The IPv4 CIDR block for the VPC. </p>"
+        }
+      },
+      "documentation":"<p>Provides details about the IPv4 CIDR blocks for the VPC. </p>"
+    },
+    "VpcInfoCidrBlockSetList":{
+      "type":"list",
+      "member":{"shape":"VpcInfoCidrBlockSetDetails"}
+    },
+    "VpcInfoIpv6CidrBlockSetDetails":{
+      "type":"structure",
+      "members":{
+        "Ipv6CidrBlock":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The IPv6 CIDR block for the VPC. </p>"
+        }
+      },
+      "documentation":"<p>Provides details about the IPv6 CIDR blocks for the VPC. </p>"
+    },
+    "VpcInfoIpv6CidrBlockSetList":{
+      "type":"list",
+      "member":{"shape":"VpcInfoIpv6CidrBlockSetDetails"}
+    },
+    "VpcInfoPeeringOptionsDetails":{
+      "type":"structure",
+      "members":{
+        "AllowDnsResolutionFromRemoteVpc":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether a local VPC can resolve public DNS hostnames to private IP addresses when queried from instances in a peer VPC. </p>"
+        },
+        "AllowEgressFromLocalClassicLinkToRemoteVpc":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether a local ClassicLink connection can communicate with the peer VPC over the VPC peering connection. </p>"
+        },
+        "AllowEgressFromLocalVpcToRemoteClassicLink":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether a local VPC can communicate with a ClassicLink connection in the peer VPC over the VPC peering connection. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about the VPC peering connection options for the accepter or requester VPC. </p>"
+    },
     "Vulnerability":{
       "type":"structure",
       "required":["Id"],
@@ -14361,7 +15587,7 @@
       "members":{
         "Type":{
           "shape":"NonEmptyString",
-          "documentation":"<p>Specifies how you want WAF to respond to requests that match the settings in a rule.</p> <p>Valid settings include the following:</p> <ul> <li> <p> <code>ALLOW</code> - WAF allows requests</p> </li> <li> <p> <code>BLOCK</code> - WAF blocks requests</p> </li> <li> <p> <code>COUNT</code> - WAF increments a counter of the requests that match all of the conditions in the rule. WAF then continues to inspect the web request based on the remaining rules in the web ACL. You can't specify <code>COUNT</code> for the default action for a WebACL.</p> </li> </ul>"
+          "documentation":"<p>Specifies how you want WAF to respond to requests that match the settings in a rule.</p> <p>Valid settings include the following:</p> <ul> <li> <p> <code>ALLOW</code> - WAF allows requests</p> </li> <li> <p> <code>BLOCK</code> - WAF blocks requests</p> </li> <li> <p> <code>COUNT</code> - WAF increments a counter of the requests that match all of the conditions in the rule. WAF then continues to inspect the web request based on the remaining rules in the web ACL. You can't specify <code>COUNT</code> for the default action for a web ACL.</p> </li> </ul>"
         }
       },
       "documentation":"<p>Details about the action that CloudFront or WAF takes when a web request matches the conditions in the rule. </p>"
diff --git a/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/paginators-1.json b/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/paginators-1.json
index 8c9a3bd7c9..55281fb779 100644
--- a/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/paginators-1.json
+++ b/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/paginators-1.json
@@ -23,6 +23,12 @@
       "output_token": "nextToken",
       "limit_key": "maxResults",
       "result_key": "attributeGroups"
+    },
+    "ListAttributeGroupsForApplication": {
+      "input_token": "nextToken",
+      "output_token": "nextToken",
+      "limit_key": "maxResults",
+      "result_key": "attributeGroupsDetails"
     }
   }
 }
diff --git a/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/service-2.json b/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/service-2.json
index 9dfd7f6a6a..926c51a56b 100644
--- a/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/servicecatalog-appregistry/2020-06-24/service-2.json
@@ -25,7 +25,8 @@
         {"shape":"ResourceNotFoundException"},
         {"shape":"ValidationException"},
         {"shape":"InternalServerException"},
-        {"shape":"ServiceQuotaExceededException"}
+        {"shape":"ServiceQuotaExceededException"},
+        {"shape":"ConflictException"}
       ],
       "documentation":"<p>Associates an attribute group with an application to augment the application's metadata with the group's attributes. This feature enables applications to be described with user-defined details that are machine-readable, such as third-party integrations.</p>"
     },
@@ -41,7 +42,8 @@
         {"shape":"ResourceNotFoundException"},
         {"shape":"InternalServerException"},
         {"shape":"ServiceQuotaExceededException"},
-        {"shape":"ConflictException"}
+        {"shape":"ConflictException"},
+        {"shape":"ValidationException"}
       ],
       "documentation":"<p>Associates a resource with an application. Both the resource and the application can be specified either by ID or name.</p>"
     },
@@ -57,7 +59,8 @@
       "errors":[
         {"shape":"ServiceQuotaExceededException"},
         {"shape":"ConflictException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"}
       ],
       "documentation":"<p>Creates a new application that is the top-level node in a hierarchy of related cloud resource abstractions.</p>"
     },
@@ -133,7 +136,8 @@
       "output":{"shape":"DisassociateResourceResponse"},
       "errors":[
         {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"}
       ],
       "documentation":"<p>Disassociates a resource from application. Both the resource and the application can be specified either by ID or name.</p>"
     },
@@ -148,7 +152,8 @@
       "errors":[
         {"shape":"ResourceNotFoundException"},
         {"shape":"ValidationException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ConflictException"}
       ],
       "documentation":"<p>Retrieves metadata information about one of your applications. The application can be specified either by its unique ID or by its name (which is unique within one account in one region at a given point in time). Specify by ID in automated workflows if you want to make sure that the exact same application is returned or a <code>ResourceNotFoundException</code> is thrown, avoiding the ABA addressing problem.</p>"
     },
@@ -179,7 +184,8 @@
       "errors":[
         {"shape":"ResourceNotFoundException"},
         {"shape":"ValidationException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ConflictException"}
       ],
       "documentation":"<p>Retrieves an attribute group, either by its name or its ID. The attribute group can be specified either by its unique ID or by its name.</p>"
     },
@@ -245,6 +251,22 @@
       "documentation":"<p>Lists all attribute groups which you have access to. Results are paginated.</p>",
       "idempotent":true
     },
+    "ListAttributeGroupsForApplication":{
+      "name":"ListAttributeGroupsForApplication",
+      "http":{
+        "method":"GET",
+        "requestUri":"/applications/{application}/attribute-group-details"
+      },
+      "input":{"shape":"ListAttributeGroupsForApplicationRequest"},
+      "output":{"shape":"ListAttributeGroupsForApplicationResponse"},
+      "errors":[
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ValidationException"},
+        {"shape":"InternalServerException"}
+      ],
+      "documentation":"<p>Lists the details of all attribute groups associated with a specific application. The results display in pages.</p>",
+      "idempotent":true
+    },
     "ListTagsForResource":{
       "name":"ListTagsForResource",
       "http":{
@@ -316,7 +338,8 @@
       "errors":[
         {"shape":"ResourceNotFoundException"},
         {"shape":"ConflictException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ValidationException"}
       ],
       "documentation":"<p>Updates an existing application with new attributes.</p>"
     },
@@ -545,6 +568,28 @@
       "type":"string",
       "pattern":"arn:aws[-a-z]*:servicecatalog:[a-z]{2}(-gov)?-[a-z]+-\\d:\\d{12}:/attribute-groups/[a-z0-9]+"
     },
+    "AttributeGroupDetails":{
+      "type":"structure",
+      "members":{
+        "id":{
+          "shape":"AttributeGroupId",
+          "documentation":"<p>The unique identifier of the attribute group.</p>"
+        },
+        "arn":{
+          "shape":"AttributeGroupArn",
+          "documentation":"<p>The Amazon resource name (ARN) that specifies the attribute group.</p>"
+        },
+        "name":{
+          "shape":"Name",
+          "documentation":"<p>The name of the attribute group. </p>"
+        }
+      },
+      "documentation":"<p> The details related to a specific AttributeGroup. </p>"
+    },
+    "AttributeGroupDetailsList":{
+      "type":"list",
+      "member":{"shape":"AttributeGroupDetails"}
+    },
     "AttributeGroupId":{
       "type":"string",
       "max":26,
@@ -1078,6 +1123,44 @@
         }
       }
     },
+    "ListAttributeGroupsForApplicationRequest":{
+      "type":"structure",
+      "required":["application"],
+      "members":{
+        "application":{
+          "shape":"ApplicationSpecifier",
+          "documentation":"<p>The name or ID of the application.</p>",
+          "location":"uri",
+          "locationName":"application"
+        },
+        "nextToken":{
+          "shape":"NextToken",
+          "documentation":"<p>This token retrieves the next page of results after a previous API call.</p>",
+          "location":"querystring",
+          "locationName":"nextToken"
+        },
+        "maxResults":{
+          "shape":"MaxResults",
+          "documentation":"<p>The upper bound of the number of results to return. The value cannot exceed 25. If you omit this parameter, it defaults to 25. This value is optional.</p>",
+          "box":true,
+          "location":"querystring",
+          "locationName":"maxResults"
+        }
+      }
+    },
+    "ListAttributeGroupsForApplicationResponse":{
+      "type":"structure",
+      "members":{
+        "attributeGroupsDetails":{
+          "shape":"AttributeGroupDetailsList",
+          "documentation":"<p> The details related to a specific AttributeGroup. </p>"
+        },
+        "nextToken":{
+          "shape":"NextToken",
+          "documentation":"<p>The token to use to get the next page of results after a previous API call.</p>"
+        }
+      }
+    },
     "ListAttributeGroupsRequest":{
       "type":"structure",
       "members":{
@@ -1394,7 +1477,7 @@
         },
         "name":{
           "shape":"Name",
-          "documentation":"<p>The new name of the application. The name must be unique in the region in which you are updating the application.</p>",
+          "documentation":"<p>Deprecated: The new name of the application. The name must be unique in the region in which you are updating the application. Please do not use this field as we have stopped supporting name updates.</p>",
           "deprecated":true,
           "deprecatedMessage":"Name update for application is deprecated."
         },
@@ -1425,7 +1508,7 @@
         },
         "name":{
           "shape":"Name",
-          "documentation":"<p>The new name of the attribute group. The name must be unique in the region in which you are updating the attribute group.</p>",
+          "documentation":"<p>Deprecated: The new name of the attribute group. The name must be unique in the region in which you are updating the attribute group. Please do not use this field as we have stopped supporting name updates.</p>",
           "deprecated":true,
           "deprecatedMessage":"Name update for attribute group is deprecated."
         },
diff --git a/contrib/python/botocore/py3/botocore/data/workspaces/2015-04-08/service-2.json b/contrib/python/botocore/py3/botocore/data/workspaces/2015-04-08/service-2.json
index b785118d96..7e82844649 100644
--- a/contrib/python/botocore/py3/botocore/data/workspaces/2015-04-08/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/workspaces/2015-04-08/service-2.json
@@ -1651,7 +1651,7 @@
       "members":{
         "LogoUrl":{
           "shape":"ClientUrl",
-          "documentation":"<p>The logo URL. This is the link where users can download the logo image. The only supported image format is <code>.png</code>.</p>"
+          "documentation":"<p>The logo URL. The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p>"
         },
         "SupportEmail":{
           "shape":"ClientEmail",
@@ -1677,7 +1677,7 @@
       "members":{
         "Logo":{
           "shape":"DefaultLogo",
-          "documentation":"<p>The logo. This is the link where users can download the logo image. The only image format accepted is <code>.png</code>.</p>"
+          "documentation":"<p>The logo. The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p>"
         },
         "SupportEmail":{
           "shape":"ClientEmail",
@@ -2405,6 +2405,7 @@
       "pattern":"^ami\\-([a-f0-9]{8}|[a-f0-9]{17})$"
     },
     "ErrorType":{"type":"string"},
+    "ExceptionErrorCode":{"type":"string"},
     "ExceptionMessage":{"type":"string"},
     "FailedCreateWorkspaceRequest":{
       "type":"structure",
@@ -2565,7 +2566,7 @@
         },
         "IngestionProcess":{
           "shape":"WorkspaceImageIngestionProcess",
-          "documentation":"<p>The ingestion process to be used when importing the image, depending on which protocol you want to use for your BYOL Workspace image, either PCoIP or WorkSpaces Streaming Protocol (WSP). To use WSP, specify a value that ends in <code>_WSP</code>. To use PCoIP, specify a value that does not end in <code>_WSP</code>. </p> <p>For non-GPU-enabled images (bundles other than Graphics.g4dn, GraphicsPro.g4dn, Graphics, or GraphicsPro), specify <code>BYOL_REGULAR</code> or <code>BYOL_REGULAR_WSP</code>, depending on the protocol.</p> <note> <p>Use <code>BYOL_GRAPHICS_G4DN</code> ingestion for both Graphics.g4dn and GraphicsPro.g4dn.</p> </note>"
+          "documentation":"<p>The ingestion process to be used when importing the image, depending on which protocol you want to use for your BYOL Workspace image, either PCoIP or WorkSpaces Streaming Protocol (WSP). To use WSP, specify a value that ends in <code>_WSP</code>. To use PCoIP, specify a value that does not end in <code>_WSP</code>. </p> <p>For non-GPU-enabled bundles (bundles other than Graphics or GraphicsPro), specify <code>BYOL_REGULAR</code> or <code>BYOL_REGULAR_WSP</code>, depending on the protocol.</p>"
         },
         "ImageName":{
           "shape":"WorkspaceImageName",
@@ -2581,7 +2582,7 @@
         },
         "Applications":{
           "shape":"ApplicationList",
-          "documentation":"<p>If specified, the version of Microsoft Office to subscribe to. Valid only for Windows 10 BYOL images. For more information about subscribing to Office for BYOL images, see <a href=\"https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html\"> Bring Your Own Windows Desktop Licenses</a>.</p> <note> <ul> <li> <p>Although this parameter is an array, only one item is allowed at this time</p> </li> <li> <p>Microsoft Office 2016 application subscription through AWS is currently not supported for Graphics.g4dn Bring Your Own License (BYOL) images</p> </li> </ul> </note>"
+          "documentation":"<p>If specified, the version of Microsoft Office to subscribe to. Valid only for Windows 10 BYOL images. For more information about subscribing to Office for BYOL images, see <a href=\"https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html\"> Bring Your Own Windows Desktop Licenses</a>.</p> <note> <p>Although this parameter is an array, only one item is allowed at this time.</p> </note>"
         }
       }
     },
@@ -2628,15 +2629,15 @@
       "members":{
         "LogoUrl":{
           "shape":"ClientUrl",
-          "documentation":"<p>The logo. This is the link where users can download the logo image. This is the standard-resolution display that has a 1:1 pixel density (or @1x), where one pixel is equal to one point.</p>"
+          "documentation":"<p>The logo. This is the standard-resolution display that has a 1:1 pixel density (or @1x), where one pixel is equal to one point. The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p>"
         },
         "Logo2xUrl":{
           "shape":"ClientUrl",
-          "documentation":"<p>The @2x version of the logo. This is the higher resolution display that offers a scale factor of 2.0 (or @2x).</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
+          "documentation":"<p>The @2x version of the logo. This is the higher resolution display that offers a scale factor of 2.0 (or @2x). The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
         },
         "Logo3xUrl":{
           "shape":"ClientUrl",
-          "documentation":"<p>The @3x version of the logo. This is the higher resolution display that offers a scale factor of 3.0 (or @3x).</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
+          "documentation":"<p>The @3x version of the logo. This is the higher resolution display that offers a scale factor of 3.0 (or @3x).The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
         },
         "SupportEmail":{
           "shape":"ClientEmail",
@@ -2662,15 +2663,15 @@
       "members":{
         "Logo":{
           "shape":"IosLogo",
-          "documentation":"<p>The logo. This is the link where users can download the logo image. This is the standard-resolution display that has a 1:1 pixel density (or @1x), where one pixel is equal to one point.</p>"
+          "documentation":"<p>The logo. This is the standard-resolution display that has a 1:1 pixel density (or @1x), where one pixel is equal to one point. The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p>"
         },
         "Logo2x":{
           "shape":"Ios2XLogo",
-          "documentation":"<p>The @2x version of the logo. This is the higher resolution display that offers a scale factor of 2.0 (or @2x).</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
+          "documentation":"<p>The @2x version of the logo. This is the higher resolution display that offers a scale factor of 2.0 (or @2x). The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
         },
         "Logo3x":{
           "shape":"Ios3XLogo",
-          "documentation":"<p>The @3x version of the logo. This is the higher resolution display that offers a scale factor of 3.0 (or @3x).</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
+          "documentation":"<p>The @3x version of the logo. This is the higher resolution display that offers a scale factor of 3.0 (or @3x). The only image format accepted is a binary data object that is converted from a <code>.png</code> file.</p> <note> <p> For more information about iOS image size and resolution, see <a href=\"https://developer.apple.com/design/human-interface-guidelines/ios/icons-and-images/image-size-and-resolution/\">Image Size and Resolution </a> in the <i>Apple Human Interface Guidelines</i>.</p> </note>"
         },
         "SupportEmail":{
           "shape":"ClientEmail",
@@ -3026,7 +3027,14 @@
     "OperationNotSupportedException":{
       "type":"structure",
       "members":{
-        "message":{"shape":"ExceptionMessage"}
+        "message":{
+          "shape":"ExceptionMessage",
+          "documentation":"<p>The exception error message.</p>"
+        },
+        "reason":{
+          "shape":"ExceptionErrorCode",
+          "documentation":"<p>The exception error reason.</p>"
+        }
       },
       "documentation":"<p>This operation is not supported.</p>",
       "exception":true
diff --git a/contrib/python/botocore/py3/botocore/docs/method.py b/contrib/python/botocore/py3/botocore/docs/method.py
index 0f7c60f6cc..44c97d6e42 100644
--- a/contrib/python/botocore/py3/botocore/docs/method.py
+++ b/contrib/python/botocore/py3/botocore/docs/method.py
@@ -11,6 +11,7 @@
 # ANY KIND, either express or implied. See the License for the specific
 # language governing permissions and limitations under the License.
 import inspect
+import types
 
 from botocore.docs.example import (
     RequestExampleDocumenter,
@@ -101,14 +102,18 @@ def document_custom_signature(
     :param exclude: The names of the parameters to exclude from
         documentation.
     """
-    argspec = inspect.getfullargspec(method)
-    signature_params = inspect.formatargspec(
-        args=argspec.args[1:],
-        varargs=argspec.varargs,
-        varkw=argspec.varkw,
-        defaults=argspec.defaults,
-    )
-    signature_params = signature_params.lstrip('(')
+    signature = inspect.signature(method)
+    # "raw" class methods are FunctionType and they include "self" param
+    # object methods are MethodType and they skip the "self" param
+    if isinstance(method, types.FunctionType):
+        self_param = next(iter(signature.parameters))
+        self_kind = signature.parameters[self_param].kind
+        # safety check that we got the right parameter
+        assert self_kind == inspect.Parameter.POSITIONAL_OR_KEYWORD
+        new_params = signature.parameters.copy()
+        del new_params[self_param]
+        signature = signature.replace(parameters=new_params.values())
+    signature_params = str(signature).lstrip('(')
     signature_params = signature_params.rstrip(')')
     section.style.start_sphinx_py_method(name, signature_params)
 
diff --git a/contrib/python/botocore/py3/botocore/exceptions.py b/contrib/python/botocore/py3/botocore/exceptions.py
index 089add9e61..6867e0239c 100644
--- a/contrib/python/botocore/py3/botocore/exceptions.py
+++ b/contrib/python/botocore/py3/botocore/exceptions.py
@@ -635,7 +635,7 @@ class InvalidRetryConfigurationError(BotoCoreError):
 
     fmt = (
         'Cannot provide retry configuration for "{retry_config_option}". '
-        'Valid retry configuration options are: \'max_attempts\''
+        'Valid retry configuration options are: {valid_options}'
     )
 
 
@@ -653,7 +653,7 @@ class InvalidRetryModeError(InvalidRetryConfigurationError):
 
     fmt = (
         'Invalid value provided to "mode": "{provided_retry_mode}" must '
-        'be one of: "legacy", "standard", "adaptive"'
+        'be one of: {valid_modes}'
     )