intermediate changes

ref:f03116b357e155fd8d7cce5be1d21a2dee3f4d6a

11 files changed, 443 insertions, 61 deletions

diff --git a/contrib/python/boto3/py3/.dist-info/METADATA b/contrib/python/boto3/py3/.dist-info/METADATA
index 4f16833d860..e7fbde789d6 100644
--- a/contrib/python/boto3/py3/.dist-info/METADATA
+++ b/contrib/python/boto3/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boto3
-Version: 1.22.6
+Version: 1.22.7
 Summary: The AWS SDK for Python
 Home-page: https://github.com/boto/boto3
 Author: Amazon Web Services
@@ -22,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.10
 Requires-Python: >= 3.6
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: botocore (<1.26.0,>=1.25.6)
+Requires-Dist: botocore (<1.26.0,>=1.25.7)
 Requires-Dist: jmespath (<2.0.0,>=0.7.1)
 Requires-Dist: s3transfer (<0.6.0,>=0.5.0)
 Provides-Extra: crt
diff --git a/contrib/python/boto3/py3/boto3/__init__.py b/contrib/python/boto3/py3/boto3/__init__.py
index 7c9810c9860..3099fed84e9 100644
--- a/contrib/python/boto3/py3/boto3/__init__.py
+++ b/contrib/python/boto3/py3/boto3/__init__.py
@@ -17,7 +17,7 @@ from boto3.compat import _warn_deprecated_python
 from boto3.session import Session
 
 __author__ = 'Amazon Web Services'
-__version__ = '1.22.6'
+__version__ = '1.22.7'
 
 
 # The default Boto3 session; autoloaded when needed.
diff --git a/contrib/python/botocore/py3/.dist-info/METADATA b/contrib/python/botocore/py3/.dist-info/METADATA
index dd25cffc35d..b7ea1a580a7 100644
--- a/contrib/python/botocore/py3/.dist-info/METADATA
+++ b/contrib/python/botocore/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: botocore
-Version: 1.25.6
+Version: 1.25.7
 Summary: Low-level, data-driven core of boto 3.
 Home-page: https://github.com/boto/botocore
 Author: Amazon Web Services
diff --git a/contrib/python/botocore/py3/botocore/__init__.py b/contrib/python/botocore/py3/botocore/__init__.py
index 2d20b70cab3..37e8f5c3c00 100644
--- a/contrib/python/botocore/py3/botocore/__init__.py
+++ b/contrib/python/botocore/py3/botocore/__init__.py
@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.25.6'
+__version__ = '1.25.7'
 
 
 class NullHandler(logging.Handler):
diff --git a/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/paginators-1.json b/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/paginators-1.json
index ea142457a6a..e9a5d58d557 100644
--- a/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/paginators-1.json
+++ b/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/paginators-1.json
@@ -1,3 +1,70 @@
 {
-  "pagination": {}
+  "pagination": {
+    "ListBackupJobs": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "BackupJobs"
+    },
+    "ListBackupPlanTemplates": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "BackupPlanTemplatesList"
+    },
+    "ListBackupPlanVersions": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "BackupPlanVersionsList"
+    },
+    "ListBackupPlans": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "BackupPlansList"
+    },
+    "ListBackupSelections": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "BackupSelectionsList"
+    },
+    "ListBackupVaults": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "BackupVaultList"
+    },
+    "ListCopyJobs": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "CopyJobs"
+    },
+    "ListProtectedResources": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "Results"
+    },
+    "ListRecoveryPointsByBackupVault": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "RecoveryPoints"
+    },
+    "ListRecoveryPointsByResource": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "RecoveryPoints"
+    },
+    "ListRestoreJobs": {
+      "input_token": "NextToken",
+      "output_token": "NextToken",
+      "limit_key": "MaxResults",
+      "result_key": "RestoreJobs"
+    }
+  }
 }
diff --git a/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/service-2.json b/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/service-2.json
index 3a9bc05d899..1fdca02cb79 100644
--- a/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/backup/2018-11-15/service-2.json
@@ -2852,7 +2852,7 @@
         },
         "ControlScope":{
           "shape":"ControlScope",
-          "documentation":"<p>The scope of a control. The control scope defines what the control will evaluate. Three examples of control scopes are: a specific backup plan, all backup plans with a specific tag, or all backup plans. For more information, see <code>ControlScope</code>.</p>"
+          "documentation":"<p>The scope of a control. The control scope defines what the control will evaluate. Three examples of control scopes are: a specific backup plan, all backup plans with a specific tag, or all backup plans. For more information, see <a href=\"aws-backup/latest/devguide/API_ControlScope.html\"> <code>ControlScope</code>.</a> </p>"
         }
       },
       "documentation":"<p>Contains detailed information about all of the controls of a framework. Each framework must contain at least one control.</p>"
@@ -3279,6 +3279,18 @@
           "documentation":"<p>The account ID to list the jobs from. Returns only backup jobs associated with the specified account ID.</p> <p>If used from an Organizations management account, passing <code>*</code> returns all jobs across the organization.</p>",
           "location":"querystring",
           "locationName":"accountId"
+        },
+        "ByCompleteAfter":{
+          "shape":"timestamp",
+          "documentation":"<p>Returns only backup jobs completed after a date expressed in Unix format and Coordinated Universal Time (UTC).</p>",
+          "location":"querystring",
+          "locationName":"completeAfter"
+        },
+        "ByCompleteBefore":{
+          "shape":"timestamp",
+          "documentation":"<p>Returns only backup jobs completed before a date expressed in Unix format and Coordinated Universal Time (UTC).</p>",
+          "location":"querystring",
+          "locationName":"completeBefore"
         }
       }
     },
@@ -3521,6 +3533,18 @@
           "documentation":"<p>The account ID to list the jobs from. Returns only copy jobs associated with the specified account ID.</p>",
           "location":"querystring",
           "locationName":"accountId"
+        },
+        "ByCompleteBefore":{
+          "shape":"timestamp",
+          "documentation":"<p>Returns only copy jobs completed before a date expressed in Unix format and Coordinated Universal Time (UTC).</p>",
+          "location":"querystring",
+          "locationName":"completeBefore"
+        },
+        "ByCompleteAfter":{
+          "shape":"timestamp",
+          "documentation":"<p>Returns only copy jobs completed after a date expressed in Unix format and Coordinated Universal Time (UTC).</p>",
+          "location":"querystring",
+          "locationName":"completeAfter"
         }
       }
     },
@@ -3827,6 +3851,18 @@
           "documentation":"<p>Returns only restore jobs associated with the specified job status.</p>",
           "location":"querystring",
           "locationName":"status"
+        },
+        "ByCompleteBefore":{
+          "shape":"timestamp",
+          "documentation":"<p>Returns only copy jobs completed before a date expressed in Unix format and Coordinated Universal Time (UTC).</p>",
+          "location":"querystring",
+          "locationName":"completeBefore"
+        },
+        "ByCompleteAfter":{
+          "shape":"timestamp",
+          "documentation":"<p>Returns only copy jobs completed after a date expressed in Unix format and Coordinated Universal Time (UTC).</p>",
+          "location":"querystring",
+          "locationName":"completeAfter"
         }
       }
     },
diff --git a/contrib/python/botocore/py3/botocore/data/endpoints.json b/contrib/python/botocore/py3/botocore/data/endpoints.json
index 15795230b2e..1d0cdd5215d 100644
--- a/contrib/python/botocore/py3/botocore/data/endpoints.json
+++ b/contrib/python/botocore/py3/botocore/data/endpoints.json
@@ -1224,26 +1224,126 @@
       },
       "appmesh" : {
         "endpoints" : {
-          "af-south-1" : { },
-          "ap-east-1" : { },
-          "ap-northeast-1" : { },
-          "ap-northeast-2" : { },
-          "ap-south-1" : { },
-          "ap-southeast-1" : { },
-          "ap-southeast-2" : { },
-          "ca-central-1" : { },
-          "eu-central-1" : { },
-          "eu-north-1" : { },
-          "eu-south-1" : { },
-          "eu-west-1" : { },
-          "eu-west-2" : { },
-          "eu-west-3" : { },
-          "me-south-1" : { },
-          "sa-east-1" : { },
-          "us-east-1" : { },
-          "us-east-2" : { },
-          "us-west-1" : { },
-          "us-west-2" : { }
+          "af-south-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.af-south-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ap-east-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ap-east-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ap-northeast-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ap-northeast-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ap-northeast-2" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ap-northeast-2.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ap-south-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ap-south-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ap-southeast-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ap-southeast-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ap-southeast-2" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ap-southeast-2.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "ca-central-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.ca-central-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "eu-central-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.eu-central-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "eu-north-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.eu-north-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "eu-south-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.eu-south-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "eu-west-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.eu-west-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "eu-west-2" : {
+            "variants" : [ {
+              "hostname" : "appmesh.eu-west-2.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "eu-west-3" : {
+            "variants" : [ {
+              "hostname" : "appmesh.eu-west-3.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "me-south-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.me-south-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "sa-east-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.sa-east-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "us-east-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.us-east-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "us-east-2" : {
+            "variants" : [ {
+              "hostname" : "appmesh.us-east-2.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "us-west-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.us-west-1.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "us-west-2" : {
+            "variants" : [ {
+              "hostname" : "appmesh.us-west-2.api.aws",
+              "tags" : [ "dualstack" ]
+            } ]
+          }
         }
       },
       "apprunner" : {
@@ -12129,12 +12229,60 @@
           "eu-west-1" : { },
           "eu-west-2" : { },
           "eu-west-3" : { },
+          "fips-us-east-1" : {
+            "credentialScope" : {
+              "region" : "us-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "synthetics-fips.us-east-1.amazonaws.com"
+          },
+          "fips-us-east-2" : {
+            "credentialScope" : {
+              "region" : "us-east-2"
+            },
+            "deprecated" : true,
+            "hostname" : "synthetics-fips.us-east-2.amazonaws.com"
+          },
+          "fips-us-west-1" : {
+            "credentialScope" : {
+              "region" : "us-west-1"
+            },
+            "deprecated" : true,
+            "hostname" : "synthetics-fips.us-west-1.amazonaws.com"
+          },
+          "fips-us-west-2" : {
+            "credentialScope" : {
+              "region" : "us-west-2"
+            },
+            "deprecated" : true,
+            "hostname" : "synthetics-fips.us-west-2.amazonaws.com"
+          },
           "me-south-1" : { },
           "sa-east-1" : { },
-          "us-east-1" : { },
-          "us-east-2" : { },
-          "us-west-1" : { },
-          "us-west-2" : { }
+          "us-east-1" : {
+            "variants" : [ {
+              "hostname" : "synthetics-fips.us-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-east-2" : {
+            "variants" : [ {
+              "hostname" : "synthetics-fips.us-east-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-west-1" : {
+            "variants" : [ {
+              "hostname" : "synthetics-fips.us-west-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-west-2" : {
+            "variants" : [ {
+              "hostname" : "synthetics-fips.us-west-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          }
         }
       },
       "tagging" : {
@@ -13258,8 +13406,18 @@
       },
       "appmesh" : {
         "endpoints" : {
-          "cn-north-1" : { },
-          "cn-northwest-1" : { }
+          "cn-north-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.cn-north-1.api.amazonwebservices.com.cn",
+              "tags" : [ "dualstack" ]
+            } ]
+          },
+          "cn-northwest-1" : {
+            "variants" : [ {
+              "hostname" : "appmesh.cn-northwest-1.api.amazonwebservices.com.cn",
+              "tags" : [ "dualstack" ]
+            } ]
+          }
         }
       },
       "appsync" : {
@@ -17539,8 +17697,32 @@
       },
       "synthetics" : {
         "endpoints" : {
-          "us-gov-east-1" : { },
-          "us-gov-west-1" : { }
+          "fips-us-gov-east-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "synthetics-fips.us-gov-east-1.amazonaws.com"
+          },
+          "fips-us-gov-west-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-west-1"
+            },
+            "deprecated" : true,
+            "hostname" : "synthetics-fips.us-gov-west-1.amazonaws.com"
+          },
+          "us-gov-east-1" : {
+            "variants" : [ {
+              "hostname" : "synthetics-fips.us-gov-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-gov-west-1" : {
+            "variants" : [ {
+              "hostname" : "synthetics-fips.us-gov-west-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          }
         }
       },
       "tagging" : {
diff --git a/contrib/python/botocore/py3/botocore/data/iotsecuretunneling/2018-10-05/service-2.json b/contrib/python/botocore/py3/botocore/data/iotsecuretunneling/2018-10-05/service-2.json
index 622d36f63a7..c77fb9405d9 100644
--- a/contrib/python/botocore/py3/botocore/data/iotsecuretunneling/2018-10-05/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/iotsecuretunneling/2018-10-05/service-2.json
@@ -24,7 +24,7 @@
       "errors":[
         {"shape":"ResourceNotFoundException"}
       ],
-      "documentation":"<p>Closes a tunnel identified by the unique tunnel id. When a <code>CloseTunnel</code> request is received, we close the WebSocket connections between the client and proxy server so no data can be transmitted.</p>"
+      "documentation":"<p>Closes a tunnel identified by the unique tunnel id. When a <code>CloseTunnel</code> request is received, we close the WebSocket connections between the client and proxy server so no data can be transmitted.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CloseTunnel</a> action.</p>"
     },
     "DescribeTunnel":{
       "name":"DescribeTunnel",
@@ -37,7 +37,7 @@
       "errors":[
         {"shape":"ResourceNotFoundException"}
       ],
-      "documentation":"<p>Gets information about a tunnel identified by the unique tunnel id.</p>"
+      "documentation":"<p>Gets information about a tunnel identified by the unique tunnel id.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">DescribeTunnel</a> action.</p>"
     },
     "ListTagsForResource":{
       "name":"ListTagsForResource",
@@ -60,7 +60,7 @@
       },
       "input":{"shape":"ListTunnelsRequest"},
       "output":{"shape":"ListTunnelsResponse"},
-      "documentation":"<p>List all tunnels for an AWS account. Tunnels are listed by creation time in descending order, newer tunnels will be listed before older tunnels.</p>"
+      "documentation":"<p>List all tunnels for an Amazon Web Services account. Tunnels are listed by creation time in descending order, newer tunnels will be listed before older tunnels.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">ListTunnels</a> action.</p>"
     },
     "OpenTunnel":{
       "name":"OpenTunnel",
@@ -73,7 +73,20 @@
       "errors":[
         {"shape":"LimitExceededException"}
       ],
-      "documentation":"<p>Creates a new tunnel, and returns two client access tokens for clients to use to connect to the AWS IoT Secure Tunneling proxy server.</p>"
+      "documentation":"<p>Creates a new tunnel, and returns two client access tokens for clients to use to connect to the IoT Secure Tunneling proxy server.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">OpenTunnel</a> action.</p>"
+    },
+    "RotateTunnelAccessToken":{
+      "name":"RotateTunnelAccessToken",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"RotateTunnelAccessTokenRequest"},
+      "output":{"shape":"RotateTunnelAccessTokenResponse"},
+      "errors":[
+        {"shape":"ResourceNotFoundException"}
+      ],
+      "documentation":"<p>Revokes the current client access token (CAT) and returns new CAT for clients to use when reconnecting to secure tunneling to access the same tunnel.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">RotateTunnelAccessToken</a> action.</p> <note> <p>Rotating the CAT doesn't extend the tunnel duration. For example, say the tunnel duration is 12 hours and the tunnel has already been open for 4 hours. When you rotate the access tokens, the new tokens that are generated can only be used for the remaining 8 hours.</p> </note>"
     },
     "TagResource":{
       "name":"TagResource",
@@ -112,6 +125,14 @@
       "type":"string",
       "sensitive":true
     },
+    "ClientMode":{
+      "type":"string",
+      "enum":[
+        "SOURCE",
+        "DESTINATION",
+        "ALL"
+      ]
+    },
     "CloseTunnelRequest":{
       "type":"structure",
       "required":["tunnelId"],
@@ -122,7 +143,7 @@
         },
         "delete":{
           "shape":"DeleteFlag",
-          "documentation":"<p>When set to true, AWS IoT Secure Tunneling deletes the tunnel data immediately.</p>",
+          "documentation":"<p>When set to true, IoT Secure Tunneling deletes the tunnel data immediately.</p>",
           "box":true
         }
       }
@@ -188,7 +209,7 @@
         },
         "services":{
           "shape":"ServiceList",
-          "documentation":"<p>A list of service names that identity the target application. The AWS IoT client running on the destination device reads this value and uses it to look up a port or an IP address and a port. The AWS IoT client instantiates the local proxy which uses this information to connect to the destination application.</p>"
+          "documentation":"<p>A list of service names that identify the target application. The IoT client running on the destination device reads this value and uses it to look up a port or an IP address and a port. The IoT client instantiates the local proxy, which uses this information to connect to the destination application.</p>"
         }
       },
       "documentation":"<p>The destination configuration.</p>"
@@ -235,7 +256,7 @@
         },
         "nextToken":{
           "shape":"NextToken",
-          "documentation":"<p>A token to retrieve the next set of results.</p>"
+          "documentation":"<p>To retrieve the next set of results, the nextToken value from a previous response; otherwise null to receive the first set of results.</p>"
         }
       }
     },
@@ -244,11 +265,11 @@
       "members":{
         "tunnelSummaries":{
           "shape":"TunnelSummaryList",
-          "documentation":"<p>A short description of the tunnels in an AWS account.</p>"
+          "documentation":"<p>A short description of the tunnels in an Amazon Web Services account.</p>"
         },
         "nextToken":{
           "shape":"NextToken",
-          "documentation":"<p>A token to used to retrieve the next set of results.</p>"
+          "documentation":"<p>The token to use to get the next set of results, or null if there are no additional results.</p>"
         }
       }
     },
@@ -291,15 +312,15 @@
         },
         "tunnelArn":{
           "shape":"TunnelArn",
-          "documentation":"<p>The Amazon Resource Name for the tunnel. The tunnel ARN format is <code>arn:aws:tunnel:&lt;region&gt;:&lt;account-id&gt;:tunnel/&lt;tunnel-id&gt;</code> </p>"
+          "documentation":"<p>The Amazon Resource Name for the tunnel.</p>"
         },
         "sourceAccessToken":{
           "shape":"ClientAccessToken",
-          "documentation":"<p>The access token the source local proxy uses to connect to AWS IoT Secure Tunneling.</p>"
+          "documentation":"<p>The access token the source local proxy uses to connect to IoT Secure Tunneling.</p>"
         },
         "destinationAccessToken":{
           "shape":"ClientAccessToken",
-          "documentation":"<p>The access token the destination local proxy uses to connect to AWS IoT Secure Tunneling.</p>"
+          "documentation":"<p>The access token the destination local proxy uses to connect to IoT Secure Tunneling.</p>"
         }
       }
     },
@@ -311,6 +332,41 @@
       "documentation":"<p>Thrown when an operation is attempted on a resource that does not exist.</p>",
       "exception":true
     },
+    "RotateTunnelAccessTokenRequest":{
+      "type":"structure",
+      "required":[
+        "tunnelId",
+        "clientMode"
+      ],
+      "members":{
+        "tunnelId":{
+          "shape":"TunnelId",
+          "documentation":"<p>The tunnel for which you want to rotate the access tokens.</p>"
+        },
+        "clientMode":{
+          "shape":"ClientMode",
+          "documentation":"<p>The mode of the client that will use the client token, which can be either the source or destination, or both source and destination.</p>"
+        },
+        "destinationConfig":{"shape":"DestinationConfig"}
+      }
+    },
+    "RotateTunnelAccessTokenResponse":{
+      "type":"structure",
+      "members":{
+        "tunnelArn":{
+          "shape":"TunnelArn",
+          "documentation":"<p>The Amazon Resource Name for the tunnel.</p>"
+        },
+        "sourceAccessToken":{
+          "shape":"ClientAccessToken",
+          "documentation":"<p>The client access token that the source local proxy uses to connect to IoT Secure Tunneling.</p>"
+        },
+        "destinationAccessToken":{
+          "shape":"ClientAccessToken",
+          "documentation":"<p>The client access token that the destination local proxy uses to connect to IoT Secure Tunneling.</p>"
+        }
+      }
+    },
     "Service":{
       "type":"string",
       "max":128,
@@ -417,7 +473,7 @@
         },
         "tunnelArn":{
           "shape":"TunnelArn",
-          "documentation":"<p>The Amazon Resource Name (ARN) of a tunnel. The tunnel ARN format is <code>arn:aws:tunnel:&lt;region&gt;:&lt;account-id&gt;:tunnel/&lt;tunnel-id&gt;</code> </p>"
+          "documentation":"<p>The Amazon Resource Name (ARN) of a tunnel.</p>"
         },
         "status":{
           "shape":"TunnelStatus",
@@ -483,7 +539,7 @@
         },
         "tunnelArn":{
           "shape":"TunnelArn",
-          "documentation":"<p>The Amazon Resource Name of the tunnel. The tunnel ARN format is <code>arn:aws:tunnel:&lt;region&gt;:&lt;account-id&gt;:tunnel/&lt;tunnel-id&gt;</code> </p>"
+          "documentation":"<p>The Amazon Resource Name of the tunnel. </p>"
         },
         "status":{
           "shape":"TunnelStatus",
@@ -531,5 +587,5 @@
       }
     }
   },
-  "documentation":"<fullname>AWS IoT Secure Tunneling</fullname> <p>AWS IoT Secure Tunnling enables you to create remote connections to devices deployed in the field.</p> <p>For more information about how AWS IoT Secure Tunneling works, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html\">AWS IoT Secure Tunneling</a>.</p>"
+  "documentation":"<fullname>IoT Secure Tunneling</fullname> <p>IoT Secure Tunneling creates remote connections to devices deployed in the field.</p> <p>For more information about how IoT Secure Tunneling works, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html\">IoT Secure Tunneling</a>.</p>"
 }
diff --git a/contrib/python/botocore/py3/botocore/data/lightsail/2016-11-28/service-2.json b/contrib/python/botocore/py3/botocore/data/lightsail/2016-11-28/service-2.json
index a8f527e7f93..54b76fbbef2 100644
--- a/contrib/python/botocore/py3/botocore/data/lightsail/2016-11-28/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/lightsail/2016-11-28/service-2.json
@@ -1917,7 +1917,7 @@
         {"shape":"UnauthenticatedException"},
         {"shape":"InvalidInputException"}
       ],
-      "documentation":"<p>Returns a list of TLS security policies that you can apply to Lightsail load balancers.</p> <p>For more information about load balancer TLS security policies, see <a href=\"https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy\">Load balancer TLS security policies</a> in the <i>Amazon Lightsail Developer Guide</i>.</p>"
+      "documentation":"<p>Returns a list of TLS security policies that you can apply to Lightsail load balancers.</p> <p>For more information about load balancer TLS security policies, see <a href=\"https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy\">Configuring TLS security policies on your Amazon Lightsail load balancers</a> in the <i>Amazon Lightsail Developer Guide</i>.</p>"
     },
     "GetLoadBalancers":{
       "name":"GetLoadBalancers",
@@ -5225,7 +5225,7 @@
         },
         "tlsPolicyName":{
           "shape":"string",
-          "documentation":"<p>The name of the TLS policy to apply to the load balancer.</p> <p>Use the <a href=\"https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsPolicies.html\">GetLoadBalancerTlsPolicies</a> action to get a list of TLS policy names that you can specify.</p> <p>For more information about load balancer TLS policies, see <a href=\"https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy\">Load balancer TLS security policies</a> in the <i>Amazon Lightsail Developer Guide</i>.</p>"
+          "documentation":"<p>The name of the TLS policy to apply to the load balancer.</p> <p>Use the <a href=\"https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsPolicies.html\">GetLoadBalancerTlsPolicies</a> action to get a list of TLS policy names that you can specify.</p> <p>For more information about load balancer TLS policies, see <a href=\"https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy\">Configuring TLS security policies on your Amazon Lightsail load balancers</a> in the <i>Amazon Lightsail Developer Guide</i>.</p>"
         }
       }
     },
@@ -9042,7 +9042,7 @@
         },
         "tlsPolicyName":{
           "shape":"ResourceName",
-          "documentation":"<p>The name of the TLS security policy for the load balancer.</p> <p>The following TLS security policy names are possible:</p> <ul> <li> <p> <code>TLS-2016-08</code> </p> </li> <li> <p> <code>TLS-FS-Res-1-2-2019-08</code> </p> </li> </ul>"
+          "documentation":"<p>The name of the TLS security policy for the load balancer.</p>"
         }
       },
       "documentation":"<p>Describes a load balancer.</p>"
@@ -9350,7 +9350,7 @@
       "members":{
         "name":{
           "shape":"ResourceName",
-          "documentation":"<p>The name of the TLS security policy.</p> <p>The following TLS security policy names are possible:</p> <ul> <li> <p> <code>TLS-2016-08</code> </p> </li> <li> <p> <code>TLS-FS-Res-1-2-2019-08</code> </p> </li> </ul> <p>You can specify either of these values for the <code>tlsSecurityPolicyName</code> request parameter in the <a href=\"https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateLoadBalancer.html\">CreateLoadBalancer</a> action, and the <code>attributeValue</code> request parameter in the <a href=\"https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateLoadBalancerAttribute.html\">UpdateLoadBalancerAttribute</a> action.</p>"
+          "documentation":"<p>The name of the TLS security policy.</p>"
         },
         "isDefault":{
           "shape":"boolean",
@@ -9362,14 +9362,14 @@
         },
         "protocols":{
           "shape":"StringList",
-          "documentation":"<p>The protocols used in a given TLS security policy.</p> <p>The following protocols are possible:</p> <ul> <li> <p> <code>Protocol-TLSv1</code> </p> </li> <li> <p> <code>Protocol-TLSv1.1</code> </p> </li> <li> <p> <code>Protocol-TLSv1.2</code> </p> </li> </ul>"
+          "documentation":"<p>The protocols used in a given TLS security policy.</p>"
         },
         "ciphers":{
           "shape":"StringList",
           "documentation":"<p>The ciphers used by the TLS security policy.</p> <p>The ciphers are listed in order of preference.</p>"
         }
       },
-      "documentation":"<p>Describes the TLS security policies that are available for Lightsail load balancers.</p> <p>For more information about load balancer TLS security policies, see <a href=\"https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy\">Load balancer TLS security policies</a> in the <i>Amazon Lightsail Developer Guide</i>.</p>"
+      "documentation":"<p>Describes the TLS security policies that are available for Lightsail load balancers.</p> <p>For more information about load balancer TLS security policies, see <a href=\"https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy\">Configuring TLS security policies on your Amazon Lightsail load balancers</a> in the <i>Amazon Lightsail Developer Guide</i>.</p>"
     },
     "LoadBalancerTlsPolicyList":{
       "type":"list",
@@ -11324,7 +11324,7 @@
         },
         "attributeValue":{
           "shape":"StringMax256",
-          "documentation":"<p>The value that you want to specify for the attribute name.</p> <p>The following values are supported depending on what you specify for the <code>attributeName</code> request parameter:</p> <ul> <li> <p>If you specify <code>HealthCheckPath</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be the path to ping on the target (for example, <code>/weather/us/wa/seattle</code>).</p> </li> <li> <p>If you specify <code>SessionStickinessEnabled</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be <code>true</code> or <code>false</code>.</p> </li> <li> <p>If you specify <code>SessionStickiness_LB_CookieDurationSeconds</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be an interger that represents the cookie duration in seconds.</p> </li> <li> <p>If you specify <code>HttpsRedirectionEnabled</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be <code>true</code> or <code>false</code>.</p> </li> <li> <p>If you specify <code>TlsPolicyName</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be <code>TLS version 1.0, 1.1, and 1.2</code> or <code>TLS version 1.2</code>.</p> </li> </ul>"
+          "documentation":"<p>The value that you want to specify for the attribute name.</p> <p>The following values are supported depending on what you specify for the <code>attributeName</code> request parameter:</p> <ul> <li> <p>If you specify <code>HealthCheckPath</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be the path to ping on the target (for example, <code>/weather/us/wa/seattle</code>).</p> </li> <li> <p>If you specify <code>SessionStickinessEnabled</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be <code>true</code> to activate session stickiness or <code>false</code> to deactivate session stickiness.</p> </li> <li> <p>If you specify <code>SessionStickiness_LB_CookieDurationSeconds</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be an interger that represents the cookie duration in seconds.</p> </li> <li> <p>If you specify <code>HttpsRedirectionEnabled</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be <code>true</code> to activate HTTP to HTTPS redirection or <code>false</code> to deactivate HTTP to HTTPS redirection.</p> </li> <li> <p>If you specify <code>TlsPolicyName</code> for the <code>attributeName</code> request parameter, then the <code>attributeValue</code> request parameter must be the name of the TLS policy.</p> <p>Use the <a href=\"https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsPolicies.html\">GetLoadBalancerTlsPolicies</a> action to get a list of TLS policy names that you can specify.</p> </li> </ul>"
         }
       }
     },
diff --git a/contrib/python/botocore/py3/botocore/data/ssm/2014-11-06/service-2.json b/contrib/python/botocore/py3/botocore/data/ssm/2014-11-06/service-2.json
index d8c5efc6ec6..76403077d76 100644
--- a/contrib/python/botocore/py3/botocore/data/ssm/2014-11-06/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/ssm/2014-11-06/service-2.json
@@ -110,7 +110,8 @@
         {"shape":"InvalidOutputLocation"},
         {"shape":"InvalidParameters"},
         {"shape":"InvalidTarget"},
-        {"shape":"InvalidSchedule"}
+        {"shape":"InvalidSchedule"},
+        {"shape":"InvalidTargetMaps"}
       ],
       "documentation":"<p>A State Manager association defines the state that you want to maintain on your managed nodes. For example, an association can specify that anti-virus software must be installed and running on your managed nodes, or that certain ports must be closed. For static targets, the association specifies a schedule for when the configuration is reapplied. For dynamic targets, such as an Amazon Web Services resource group or an Amazon Web Services autoscaling group, State Manager, a capability of Amazon Web Services Systems Manager applies the configuration when new managed nodes are added to the group. The association also specifies actions to take when applying the configuration. For example, an association for anti-virus software might run once a day. If the software isn't installed, then State Manager installs it. If the software is installed, but the service isn't running, then the association might instruct State Manager to start the service. </p>"
     },
@@ -133,7 +134,8 @@
         {"shape":"UnsupportedPlatformType"},
         {"shape":"InvalidOutputLocation"},
         {"shape":"InvalidTarget"},
-        {"shape":"InvalidSchedule"}
+        {"shape":"InvalidSchedule"},
+        {"shape":"InvalidTargetMaps"}
       ],
       "documentation":"<p>Associates the specified Amazon Web Services Systems Manager document (SSM document) with the specified managed nodes or targets.</p> <p>When you associate a document with one or more managed nodes using IDs or tags, Amazon Web Services Systems Manager Agent (SSM Agent) running on the managed node processes the document and configures the node as specified.</p> <p>If you associate a document with a managed node that already has an associated document, the system returns the AssociationAlreadyExists exception.</p>"
     },
@@ -1919,7 +1921,8 @@
         {"shape":"InvalidDocument"},
         {"shape":"InvalidTarget"},
         {"shape":"InvalidAssociationVersion"},
-        {"shape":"AssociationVersionLimitExceeded"}
+        {"shape":"AssociationVersionLimitExceeded"},
+        {"shape":"InvalidTargetMaps"}
       ],
       "documentation":"<p>Updates an association. You can update the association name and version, the document version, schedule, parameters, and Amazon Simple Storage Service (Amazon S3) output. When you call <code>UpdateAssociation</code>, the system removes all optional parameters from the request and overwrites the association with null values for those parameters. This is by design. You must specify all optional parameters in the call, even if you are not changing the parameters. This includes the <code>Name</code> parameter. Before calling this API action, we recommend that you call the <a>DescribeAssociation</a> API operation and make a note of all optional parameters required for your <code>UpdateAssociation</code> call.</p> <p>In order to call this API operation, your Identity and Access Management (IAM) user account, group, or role must be configured with permission to call the <a>DescribeAssociation</a> API operation. If you don't have permission to call <code>DescribeAssociation</code>, then you receive the following error: <code>An error occurred (AccessDeniedException) when calling the UpdateAssociation operation: User: &lt;user_arn&gt; isn't authorized to perform: ssm:DescribeAssociation on resource: &lt;resource_arn&gt;</code> </p> <important> <p>When you update an association, the association immediately runs against the specified targets. You can add the <code>ApplyOnlyAtCronInterval</code> parameter to run the association during the next schedule run.</p> </important>"
     },
@@ -2372,6 +2375,11 @@
           "shape":"ScheduleOffset",
           "documentation":"<p>Number of days to wait after the scheduled day to run an association.</p>",
           "box":true
+        },
+        "TargetMaps":{
+          "shape":"TargetMaps",
+          "documentation":"<p>A key-value mapping of document parameters to target resources. Both Targets and TargetMaps can't be specified together.</p>",
+          "box":true
         }
       },
       "documentation":"<p>Describes an association of a Amazon Web Services Systems Manager document (SSM document) and a managed node.</p>"
@@ -2496,6 +2504,11 @@
           "shape":"ScheduleOffset",
           "documentation":"<p>Number of days to wait after the scheduled day to run an association.</p>",
           "box":true
+        },
+        "TargetMaps":{
+          "shape":"TargetMaps",
+          "documentation":"<p>A key-value mapping of document parameters to target resources. Both Targets and TargetMaps can't be specified together.</p>",
+          "box":true
         }
       },
       "documentation":"<p>Describes the parameters for a document.</p>"
@@ -2914,6 +2927,11 @@
           "shape":"ScheduleOffset",
           "documentation":"<p>Number of days to wait after the scheduled day to run an association.</p>",
           "box":true
+        },
+        "TargetMaps":{
+          "shape":"TargetMaps",
+          "documentation":"<p>A key-value mapping of document parameters to target resources. Both Targets and TargetMaps can't be specified together.</p>",
+          "box":true
         }
       },
       "documentation":"<p>Information about the association version.</p>"
@@ -4374,6 +4392,11 @@
           "shape":"ScheduleOffset",
           "documentation":"<p>Number of days to wait after the scheduled day to run an association.</p>",
           "box":true
+        },
+        "TargetMaps":{
+          "shape":"TargetMaps",
+          "documentation":"<p>A key-value mapping of document parameters to target resources. Both Targets and TargetMaps can't be specified together.</p>",
+          "box":true
         }
       },
       "documentation":"<p>Describes the association of a Amazon Web Services Systems Manager document (SSM document) and a managed node.</p>"
@@ -4463,6 +4486,11 @@
           "shape":"ScheduleOffset",
           "documentation":"<p>Number of days to wait after the scheduled day to run an association. For example, if you specified a cron schedule of <code>cron(0 0 ? * THU#2 *)</code>, you could specify an offset of 3 to run the association each Sunday after the second Thursday of the month. For more information about cron schedules for associations, see <a href=\"https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html\">Reference: Cron and rate expressions for Systems Manager</a> in the <i>Amazon Web Services Systems Manager User Guide</i>. </p> <note> <p>To use offsets, you must specify the <code>ApplyOnlyAtCronInterval</code> parameter. This option tells the system not to run an association immediately after you create it. </p> </note>",
           "box":true
+        },
+        "TargetMaps":{
+          "shape":"TargetMaps",
+          "documentation":"<p>A key-value mapping of document parameters to target resources. Both Targets and TargetMaps can't be specified together.</p>",
+          "box":true
         }
       }
     },
@@ -9121,6 +9149,14 @@
       "documentation":"<p>The target isn't valid or doesn't exist. It might not be configured for Systems Manager or you might not have permission to perform the operation.</p>",
       "exception":true
     },
+    "InvalidTargetMaps":{
+      "type":"structure",
+      "members":{
+        "Message":{"shape":"String"}
+      },
+      "documentation":"<p>TargetMap parameter isn't valid.</p>",
+      "exception":true
+    },
     "InvalidTypeNameException":{
       "type":"structure",
       "members":{
@@ -15348,6 +15384,11 @@
           "shape":"ScheduleOffset",
           "documentation":"<p>Number of days to wait after the scheduled day to run an association. For example, if you specified a cron schedule of <code>cron(0 0 ? * THU#2 *)</code>, you could specify an offset of 3 to run the association each Sunday after the second Thursday of the month. For more information about cron schedules for associations, see <a href=\"https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html\">Reference: Cron and rate expressions for Systems Manager</a> in the <i>Amazon Web Services Systems Manager User Guide</i>. </p> <note> <p>To use offsets, you must specify the <code>ApplyOnlyAtCronInterval</code> parameter. This option tells the system not to run an association immediately after you create it. </p> </note>",
           "box":true
+        },
+        "TargetMaps":{
+          "shape":"TargetMaps",
+          "documentation":"<p>A key-value mapping of document parameters to target resources. Both Targets and TargetMaps can't be specified together.</p>",
+          "box":true
         }
       }
     },
diff --git a/contrib/python/botocore/py3/botocore/vendored/requests/packages/urllib3/__init__.py b/contrib/python/botocore/py3/botocore/vendored/requests/packages/urllib3/__init__.py
index 2434cfc0eb9..88697016b41 100644
--- a/contrib/python/botocore/py3/botocore/vendored/requests/packages/urllib3/__init__.py
+++ b/contrib/python/botocore/py3/botocore/vendored/requests/packages/urllib3/__init__.py
@@ -4,7 +4,7 @@ urllib3 - Thread-safe connection pooling and re-using.
 
 __author__ = 'Andrey Petrov (andrey.petrov@shazow.net)'
 __license__ = 'MIT'
-__version__ = '1.10.4'
+__version__ = ''
 
 
 from . import exceptions