intermediate changes

ref:0304f5d77e7bc5582d40a231ca5144d484fb5ccf

11 files changed, 654 insertions, 43 deletions

diff --git a/contrib/python/boto3/py3/.dist-info/METADATA b/contrib/python/boto3/py3/.dist-info/METADATA
index 23a705e0c1..1012e6306b 100644
--- a/contrib/python/boto3/py3/.dist-info/METADATA
+++ b/contrib/python/boto3/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boto3
-Version: 1.21.34
+Version: 1.21.35
 Summary: The AWS SDK for Python
 Home-page: https://github.com/boto/boto3
 Author: Amazon Web Services
@@ -22,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.10
 Requires-Python: >= 3.6
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: botocore (<1.25.0,>=1.24.34)
+Requires-Dist: botocore (<1.25.0,>=1.24.35)
 Requires-Dist: jmespath (<2.0.0,>=0.7.1)
 Requires-Dist: s3transfer (<0.6.0,>=0.5.0)
 Provides-Extra: crt
diff --git a/contrib/python/boto3/py3/boto3/__init__.py b/contrib/python/boto3/py3/boto3/__init__.py
index 5cf9453e41..24e1ba642e 100644
--- a/contrib/python/boto3/py3/boto3/__init__.py
+++ b/contrib/python/boto3/py3/boto3/__init__.py
@@ -17,7 +17,7 @@ from boto3.compat import _warn_deprecated_python
 from boto3.session import Session
 
 __author__ = 'Amazon Web Services'
-__version__ = '1.21.34'
+__version__ = '1.21.35'
 
 
 # The default Boto3 session; autoloaded when needed.
diff --git a/contrib/python/botocore/py3/.dist-info/METADATA b/contrib/python/botocore/py3/.dist-info/METADATA
index f4b157ba2d..25f13d2838 100644
--- a/contrib/python/botocore/py3/.dist-info/METADATA
+++ b/contrib/python/botocore/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: botocore
-Version: 1.24.34
+Version: 1.24.35
 Summary: Low-level, data-driven core of boto 3.
 Home-page: https://github.com/boto/botocore
 Author: Amazon Web Services
diff --git a/contrib/python/botocore/py3/botocore/__init__.py b/contrib/python/botocore/py3/botocore/__init__.py
index 08c5f44155..a9dd3f91a9 100644
--- a/contrib/python/botocore/py3/botocore/__init__.py
+++ b/contrib/python/botocore/py3/botocore/__init__.py
@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.24.34'
+__version__ = '1.24.35'
 
 
 class NullHandler(logging.Handler):
diff --git a/contrib/python/botocore/py3/botocore/data/config/2014-11-12/service-2.json b/contrib/python/botocore/py3/botocore/data/config/2014-11-12/service-2.json
index 92e2fe9527..a5eab003c9 100644
--- a/contrib/python/botocore/py3/botocore/data/config/2014-11-12/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/config/2014-11-12/service-2.json
@@ -981,7 +981,7 @@
         {"shape":"InsufficientPermissionsException"},
         {"shape":"NoAvailableConfigurationRecorderException"}
       ],
-      "documentation":"<p>Adds or updates an Config rule for evaluating whether your Amazon Web Services resources comply with your desired configurations.</p> <p>You can use this action for custom Config rules and Config managed rules. A custom Config rule is a rule that you develop and maintain. An Config managed rule is a customizable, predefined rule that Config provides.</p> <p>If you are adding a new custom Config rule, you must first create the Lambda function that the rule invokes to evaluate your resources. When you use the <code>PutConfigRule</code> action to add the rule to Config, you must specify the Amazon Resource Name (ARN) that Lambda assigns to the function. Specify the ARN for the <code>SourceIdentifier</code> key. This key is part of the <code>Source</code> object, which is part of the <code>ConfigRule</code> object. </p> <p>If you are adding an Config managed rule, specify the rule's identifier for the <code>SourceIdentifier</code> key. To reference Config managed rule identifiers, see <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html\">About Config managed rules</a>.</p> <p>For any new rule that you add, specify the <code>ConfigRuleName</code> in the <code>ConfigRule</code> object. Do not specify the <code>ConfigRuleArn</code> or the <code>ConfigRuleId</code>. These values are generated by Config for new rules.</p> <p>If you are updating a rule that you added previously, you can specify the rule by <code>ConfigRuleName</code>, <code>ConfigRuleId</code>, or <code>ConfigRuleArn</code> in the <code>ConfigRule</code> data type that you use in this request.</p> <p>The maximum number of rules that Config supports is 150.</p> <p>For information about requesting a rule limit increase, see <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html#limits_config\">Config Limits</a> in the <i>Amazon Web Services General Reference Guide</i>.</p> <p>For more information about developing and using Config rules, see <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html\">Evaluating Amazon Web Services resource Configurations with Config</a> in the <i>Config Developer Guide</i>.</p>"
+      "documentation":"<p>Adds or updates an Config rule for evaluating whether your Amazon Web Services resources comply with your desired configurations.</p> <p>You can use this action for Config custom rules and Config managed rules. A Config custom rule is a rule that you develop and maintain. An Config managed rule is a customizable, predefined rule that Config provides.</p> <p>If you are adding a new Config custom rule, you must first create the Lambda function that the rule invokes to evaluate your resources. When you use the <code>PutConfigRule</code> action to add the rule to Config, you must specify the Amazon Resource Name (ARN) that Lambda assigns to the function. Specify the ARN for the <code>SourceIdentifier</code> key. This key is part of the <code>Source</code> object, which is part of the <code>ConfigRule</code> object. </p> <p>If you are adding an Config managed rule, specify the rule's identifier for the <code>SourceIdentifier</code> key. To reference Config managed rule identifiers, see <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html\">About Config managed rules</a>.</p> <p>For any new rule that you add, specify the <code>ConfigRuleName</code> in the <code>ConfigRule</code> object. Do not specify the <code>ConfigRuleArn</code> or the <code>ConfigRuleId</code>. These values are generated by Config for new rules.</p> <p>If you are updating a rule that you added previously, you can specify the rule by <code>ConfigRuleName</code>, <code>ConfigRuleId</code>, or <code>ConfigRuleArn</code> in the <code>ConfigRule</code> data type that you use in this request.</p> <p>The maximum number of rules that Config supports is 150.</p> <p>For information about requesting a rule limit increase, see <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html#limits_config\">Config Limits</a> in the <i>Amazon Web Services General Reference Guide</i>.</p> <p>For more information about developing and using Config rules, see <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html\">Evaluating Amazon Web Services resource Configurations with Config</a> in the <i>Config Developer Guide</i>.</p>"
     },
     "PutConfigurationAggregator":{
       "name":"PutConfigurationAggregator",
@@ -1099,7 +1099,7 @@
         {"shape":"OrganizationAllFeaturesNotEnabledException"},
         {"shape":"InsufficientPermissionsException"}
       ],
-      "documentation":"<p>Adds or updates organization Config rule for your entire organization evaluating whether your Amazon Web Services resources comply with your desired configurations.</p> <p> Only a master account and a delegated administrator can create or update an organization Config rule. When calling this API with a delegated administrator, you must ensure Organizations <code>ListDelegatedAdministrator</code> permissions are added. </p> <p>This API enables organization service access through the <code>EnableAWSServiceAccess</code> action and creates a service linked role <code>AWSServiceRoleForConfigMultiAccountSetup</code> in the master or delegated administrator account of your organization. The service linked role is created only when the role does not exist in the caller account. Config verifies the existence of role with <code>GetRole</code> action.</p> <p>To use this API with delegated administrator, register a delegated administrator by calling Amazon Web Services Organization <code>register-delegated-administrator</code> for <code>config-multiaccountsetup.amazonaws.com</code>. </p> <p>You can use this action to create both custom Config rules and Config managed rules. If you are adding a new custom Config rule, you must first create Lambda function in the master account or a delegated administrator that the rule invokes to evaluate your resources. You also need to create an IAM role in the managed-account that can be assumed by the Lambda function. When you use the <code>PutOrganizationConfigRule</code> action to add the rule to Config, you must specify the Amazon Resource Name (ARN) that Lambda assigns to the function. If you are adding an Config managed rule, specify the rule's identifier for the <code>RuleIdentifier</code> key.</p> <p>The maximum number of organization Config rules that Config supports is 150 and 3 delegated administrator per organization. </p> <note> <p>Prerequisite: Ensure you call <code>EnableAllFeatures</code> API to enable all features in an organization.</p> <p>Specify either <code>OrganizationCustomRuleMetadata</code> or <code>OrganizationManagedRuleMetadata</code>.</p> </note>"
+      "documentation":"<p>Adds or updates organization Config rule for your entire organization evaluating whether your Amazon Web Services resources comply with your desired configurations.</p> <p> Only a master account and a delegated administrator can create or update an organization Config rule. When calling this API with a delegated administrator, you must ensure Organizations <code>ListDelegatedAdministrator</code> permissions are added. </p> <p>This API enables organization service access through the <code>EnableAWSServiceAccess</code> action and creates a service linked role <code>AWSServiceRoleForConfigMultiAccountSetup</code> in the master or delegated administrator account of your organization. The service linked role is created only when the role does not exist in the caller account. Config verifies the existence of role with <code>GetRole</code> action.</p> <p>To use this API with delegated administrator, register a delegated administrator by calling Amazon Web Services Organization <code>register-delegated-administrator</code> for <code>config-multiaccountsetup.amazonaws.com</code>. </p> <p>You can use this action to create both Config custom rules and Config managed rules. If you are adding a new Config custom rule, you must first create Lambda function in the master account or a delegated administrator that the rule invokes to evaluate your resources. You also need to create an IAM role in the managed-account that can be assumed by the Lambda function. When you use the <code>PutOrganizationConfigRule</code> action to add the rule to Config, you must specify the Amazon Resource Name (ARN) that Lambda assigns to the function. If you are adding an Config managed rule, specify the rule's identifier for the <code>RuleIdentifier</code> key.</p> <p>The maximum number of organization Config rules that Config supports is 150 and 3 delegated administrator per organization. </p> <note> <p>Prerequisite: Ensure you call <code>EnableAllFeatures</code> API to enable all features in an organization.</p> <p>Specify either <code>OrganizationCustomRuleMetadata</code> or <code>OrganizationManagedRuleMetadata</code>.</p> </note>"
     },
     "PutOrganizationConformancePack":{
       "name":"PutOrganizationConformancePack",
@@ -6833,7 +6833,9 @@
         "AWS::CodeDeploy::DeploymentGroup",
         "AWS::EC2::LaunchTemplate",
         "AWS::ECR::PublicRepository",
-        "AWS::GuardDuty::Detector"
+        "AWS::GuardDuty::Detector",
+        "AWS::EMR::SecurityConfiguration",
+        "AWS::SageMaker::CodeRepository"
       ]
     },
     "ResourceTypeList":{
diff --git a/contrib/python/botocore/py3/botocore/data/endpoints.json b/contrib/python/botocore/py3/botocore/data/endpoints.json
index fc3007c34b..0bb4b38cfa 100644
--- a/contrib/python/botocore/py3/botocore/data/endpoints.json
+++ b/contrib/python/botocore/py3/botocore/data/endpoints.json
@@ -6539,8 +6539,32 @@
           "ap-southeast-2" : { },
           "eu-central-1" : { },
           "eu-west-1" : { },
-          "us-east-1" : { },
-          "us-west-2" : { }
+          "fips-us-east-1" : {
+            "credentialScope" : {
+              "region" : "us-east-1"
+            },
+            "deprecated" : true,
+            "hostname" : "iotsitewise-fips.us-east-1.amazonaws.com"
+          },
+          "fips-us-west-2" : {
+            "credentialScope" : {
+              "region" : "us-west-2"
+            },
+            "deprecated" : true,
+            "hostname" : "iotsitewise-fips.us-west-2.amazonaws.com"
+          },
+          "us-east-1" : {
+            "variants" : [ {
+              "hostname" : "iotsitewise-fips.us-east-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          },
+          "us-west-2" : {
+            "variants" : [ {
+              "hostname" : "iotsitewise-fips.us-west-2.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          }
         }
       },
       "iotthingsgraph" : {
@@ -9042,6 +9066,7 @@
           "ap-south-1" : { },
           "ap-southeast-1" : { },
           "ap-southeast-2" : { },
+          "ap-southeast-3" : { },
           "ca-central-1" : {
             "variants" : [ {
               "hostname" : "ram-fips.ca-central-1.amazonaws.com",
@@ -15963,7 +15988,19 @@
       },
       "iotsitewise" : {
         "endpoints" : {
-          "us-gov-west-1" : { }
+          "fips-us-gov-west-1" : {
+            "credentialScope" : {
+              "region" : "us-gov-west-1"
+            },
+            "deprecated" : true,
+            "hostname" : "iotsitewise-fips.us-gov-west-1.amazonaws.com"
+          },
+          "us-gov-west-1" : {
+            "variants" : [ {
+              "hostname" : "iotsitewise-fips.us-gov-west-1.amazonaws.com",
+              "tags" : [ "fips" ]
+            } ]
+          }
         }
       },
       "kafka" : {
diff --git a/contrib/python/botocore/py3/botocore/data/kendra/2019-02-03/service-2.json b/contrib/python/botocore/py3/botocore/data/kendra/2019-02-03/service-2.json
index 5b79ebb374..5ff2cff3b2 100644
--- a/contrib/python/botocore/py3/botocore/data/kendra/2019-02-03/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/kendra/2019-02-03/service-2.json
@@ -423,7 +423,7 @@
         {"shape":"AccessDeniedException"},
         {"shape":"InternalServerException"}
       ],
-      "documentation":"<p>Describes an existing Amazon Kendra index</p>"
+      "documentation":"<p>Describes an existing Amazon Kendra index.</p>"
     },
     "DescribePrincipalMapping":{
       "name":"DescribePrincipalMapping",
@@ -697,7 +697,7 @@
         {"shape":"AccessDeniedException"},
         {"shape":"InternalServerException"}
       ],
-      "documentation":"<p>Lists the Amazon Kendra indexes that you have created.</p>"
+      "documentation":"<p>Lists the Amazon Kendra indexes that you created.</p>"
     },
     "ListQuerySuggestionsBlockLists":{
       "name":"ListQuerySuggestionsBlockLists",
@@ -1375,6 +1375,68 @@
     },
     "Blob":{"type":"blob"},
     "Boolean":{"type":"boolean"},
+    "BoxConfiguration":{
+      "type":"structure",
+      "required":[
+        "EnterpriseId",
+        "SecretArn"
+      ],
+      "members":{
+        "EnterpriseId":{
+          "shape":"EnterpriseId",
+          "documentation":"<p>The identifier of the Box Enterprise platform. You can find the enterprise ID in the Box Developer Console settings or when you create an app in Box and download your authentication credentials. For example, <i>801234567</i>.</p>"
+        },
+        "SecretArn":{
+          "shape":"SecretArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of an Secrets Manager secret that contains the key-value pairs required to connect to your Box platform. The secret must contain a JSON structure with the following keys:</p> <ul> <li> <p>clientID—The identifier of the client OAuth 2.0 authentication application created in Box.</p> </li> <li> <p>clientSecret—A set of characters known only to the OAuth 2.0 authentication application created in Box.</p> </li> <li> <p>publicKeyId—The identifier of the public key contained within an identity certificate.</p> </li> <li> <p>privateKey—A set of characters that make up an encryption key.</p> </li> <li> <p>passphrase—A set of characters that act like a password.</p> </li> </ul> <p>You create an application in Box to generate the keys or credentials required for the secret. For more information, see <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/data-source-box.html#box-authentication\">Authentication for a Box data source</a>.</p>"
+        },
+        "UseChangeLog":{
+          "shape":"Boolean",
+          "documentation":"<p> <code>TRUE</code> to use the Slack change log to determine which documents require updating in the index. Depending on the data source change log's size, it may take longer for Amazon Kendra to use the change log than to scan all of your documents.</p>"
+        },
+        "CrawlComments":{
+          "shape":"Boolean",
+          "documentation":"<p> <code>TRUE</code> to index comments.</p>"
+        },
+        "CrawlTasks":{
+          "shape":"Boolean",
+          "documentation":"<p> <code>TRUE</code> to index the contents of tasks.</p>"
+        },
+        "CrawlWebLinks":{
+          "shape":"Boolean",
+          "documentation":"<p> <code>TRUE</code> to index web links.</p>"
+        },
+        "FileFieldMappings":{
+          "shape":"DataSourceToIndexFieldMappingList",
+          "documentation":"<p>A list of <code>DataSourceToIndexFieldMapping</code> objects that map attributes or field names of Box files to Amazon Kendra index field names. To create custom fields, use the <code>UpdateIndex</code> API before you map to Box fields. For more information, see <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/field-mapping.html\">Mapping data source fields</a>. The Box field names must exist in your Box custom metadata.</p>"
+        },
+        "TaskFieldMappings":{
+          "shape":"DataSourceToIndexFieldMappingList",
+          "documentation":"<p>A list of <code>DataSourceToIndexFieldMapping</code> objects that map attributes or field names of Box tasks to Amazon Kendra index field names. To create custom fields, use the <code>UpdateIndex</code> API before you map to Box fields. For more information, see <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/field-mapping.html\">Mapping data source fields</a>. The Box field names must exist in your Box custom metadata.</p>"
+        },
+        "CommentFieldMappings":{
+          "shape":"DataSourceToIndexFieldMappingList",
+          "documentation":"<p>A list of <code>DataSourceToIndexFieldMapping</code> objects that map attributes or field names of Box comments to Amazon Kendra index field names. To create custom fields, use the <code>UpdateIndex</code> API before you map to Box fields. For more information, see <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/field-mapping.html\">Mapping data source fields</a>. The Box field names must exist in your Box custom metadata.</p>"
+        },
+        "WebLinkFieldMappings":{
+          "shape":"DataSourceToIndexFieldMappingList",
+          "documentation":"<p>A list of <code>DataSourceToIndexFieldMapping</code> objects that map attributes or field names of Box web links to Amazon Kendra index field names. To create custom fields, use the <code>UpdateIndex</code> API before you map to Box fields. For more information, see <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/field-mapping.html\">Mapping data source fields</a>. The Box field names must exist in your Box custom metadata.</p>"
+        },
+        "InclusionPatterns":{
+          "shape":"DataSourceInclusionsExclusionsStrings",
+          "documentation":"<p>A list of regular expression patterns to include certain files and folders in your Box platform. Files and folders that match the patterns are included in the index. Files and folders that don't match the patterns are excluded from the index. If a file or folder matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the file or folder isn't included in the index.</p>"
+        },
+        "ExclusionPatterns":{
+          "shape":"DataSourceInclusionsExclusionsStrings",
+          "documentation":"<p>A list of regular expression patterns to exclude certain files and folders from your Box platform. Files and folders that match the patterns are excluded from the index.Files and folders that don't match the patterns are included in the index. If a file or folder matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the file or folder isn't included in the index.</p>"
+        },
+        "VpcConfiguration":{
+          "shape":"DataSourceVpcConfiguration",
+          "documentation":"<p>Configuration information for an Amazon VPC to connect to your Box. For more information, see <a href=\"https://docs.aws.amazon.com/endra/latest/dg/vpc-configuration.html\">Configuring a VPC</a>.</p>"
+        }
+      },
+      "documentation":"<p>Provides the configuration information to connect to Box as your data source.</p>"
+    },
     "CapacityUnitsConfiguration":{
       "type":"structure",
       "required":[
@@ -1391,7 +1453,7 @@
           "documentation":"<p>The amount of extra query capacity for an index and <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/API_GetQuerySuggestions.html\">GetQuerySuggestions</a> capacity.</p> <p>A single extra capacity unit for an index provides 0.1 queries per second or approximately 8,000 queries per day.</p> <p> <code>GetQuerySuggestions</code> capacity is five times the provisioned query capacity for an index, or the base capacity of 2.5 calls per second, whichever is higher. For example, the base capacity for an index is 0.1 queries per second, and <code>GetQuerySuggestions</code> capacity has a base of 2.5 calls per second. If you add another 0.1 queries per second to total 0.2 queries per second for an index, the <code>GetQuerySuggestions</code> capacity is 2.5 calls per second (higher than five times 0.2 queries per second).</p>"
         }
       },
-      "documentation":"<p>Specifies capacity units configured for your enterprise edition index. You can add and remove capacity units to tune an index to your requirements.</p>"
+      "documentation":"<p>Specifies additional capacity units configured for your Enterprise Edition index. You can add and remove capacity units to fit your usage requirements.</p>"
     },
     "ChangeDetectingColumns":{
       "type":"list",
@@ -2059,11 +2121,11 @@
         },
         "RoleArn":{
           "shape":"RoleArn",
-          "documentation":"<p>An Identity and Access Management(IAM) role that gives Amazon Kendra permissions to access your Amazon CloudWatch logs and metrics. This is also the role used when you use the <code>BatchPutDocument</code> API to index documents from an Amazon S3 bucket.</p>"
+          "documentation":"<p>An Identity and Access Management (IAM) role that gives Amazon Kendra permissions to access your Amazon CloudWatch logs and metrics. This is also the role you use when you call the <code>BatchPutDocument</code> API to index documents from an Amazon S3 bucket.</p>"
         },
         "ServerSideEncryptionConfiguration":{
           "shape":"ServerSideEncryptionConfiguration",
-          "documentation":"<p>The identifier of the KMScustomer managed key (CMK) to use to encrypt data indexed by Amazon Kendra. Amazon Kendra doesn't support asymmetric CMKs.</p>"
+          "documentation":"<p>The identifier of the KMS customer managed key (CMK) that's used to encrypt data indexed by Amazon Kendra. Amazon Kendra doesn't support asymmetric CMKs.</p>"
         },
         "Description":{
           "shape":"Description",
@@ -2268,6 +2330,10 @@
         "SlackConfiguration":{
           "shape":"SlackConfiguration",
           "documentation":"<p>Provides the configuration information to connect to Slack as your data source.</p>"
+        },
+        "BoxConfiguration":{
+          "shape":"BoxConfiguration",
+          "documentation":"<p>Provides the configuration information to connect to Box as your data source.</p>"
         }
       },
       "documentation":"<p>Provides the configuration information for an Amazon Kendra data source.</p>"
@@ -2529,7 +2595,8 @@
         "WEBCRAWLER",
         "WORKDOCS",
         "FSX",
-        "SLACK"
+        "SLACK",
+        "BOX"
       ]
     },
     "DataSourceVpcConfiguration":{
@@ -2949,7 +3016,7 @@
       "members":{
         "Id":{
           "shape":"IndexId",
-          "documentation":"<p>The name of the index to describe.</p>"
+          "documentation":"<p>The identifier of the index to describe.</p>"
         }
       }
     },
@@ -2962,7 +3029,7 @@
         },
         "Id":{
           "shape":"IndexId",
-          "documentation":"<p>The name of the index.</p>"
+          "documentation":"<p>The identifier of the index.</p>"
         },
         "Edition":{
           "shape":"IndexEdition",
@@ -2974,7 +3041,7 @@
         },
         "ServerSideEncryptionConfiguration":{
           "shape":"ServerSideEncryptionConfiguration",
-          "documentation":"<p>The identifier of the KMScustomer master key (CMK) used to encrypt your data. Amazon Kendra doesn't support asymmetric CMKs.</p>"
+          "documentation":"<p>The identifier of the KMScustomer master key (CMK) that is used to encrypt your data. Amazon Kendra doesn't support asymmetric CMKs.</p>"
         },
         "Status":{
           "shape":"IndexStatus",
@@ -2982,7 +3049,7 @@
         },
         "Description":{
           "shape":"Description",
-          "documentation":"<p>The description of the index.</p>"
+          "documentation":"<p>The description for the index.</p>"
         },
         "CreatedAt":{
           "shape":"Timestamp",
@@ -3002,11 +3069,11 @@
         },
         "ErrorMessage":{
           "shape":"ErrorMessage",
-          "documentation":"<p>When th e<code>Status</code> field value is <code>FAILED</code>, the <code>ErrorMessage</code> field contains a message that explains why.</p>"
+          "documentation":"<p>When the <code>Status</code> field value is <code>FAILED</code>, the <code>ErrorMessage</code> field contains a message that explains why.</p>"
         },
         "CapacityUnits":{
           "shape":"CapacityUnitsConfiguration",
-          "documentation":"<p>For Enterprise edition indexes, you can choose to use additional capacity to meet the needs of your application. This contains the capacity units used for the index. A 0 for the query capacity or the storage capacity indicates that the index is using the default capacity for the index.</p>"
+          "documentation":"<p>For Enterprise Edition indexes, you can choose to use additional capacity to meet the needs of your application. This contains the capacity units used for the index. A query or document storage capacity of zero indicates that the index is using the default capacity. For more information on the default capacity for an index and adjusting this, see <a href=\"https://docs.aws.amazon.com/kendra/latest/dg/adjusting-capacity.html\">Adjusting capacity</a>.</p>"
         },
         "UserTokenConfigurations":{
           "shape":"UserTokenConfigurationList",
@@ -3636,6 +3703,12 @@
       "type":"string",
       "enum":["HOME"]
     },
+    "EnterpriseId":{
+      "type":"string",
+      "max":64,
+      "min":1,
+      "pattern":"^[A-Z0-9]*$"
+    },
     "EntityConfiguration":{
       "type":"structure",
       "required":[
@@ -4368,7 +4441,7 @@
       "members":{
         "Name":{
           "shape":"IndexName",
-          "documentation":"<p>The name of the index.</p>"
+          "documentation":"<p>The identifier of the index.</p>"
         },
         "Id":{
           "shape":"IndexId",
@@ -6987,7 +7060,7 @@
         },
         "CapacityUnits":{
           "shape":"CapacityUnitsConfiguration",
-          "documentation":"<p>Sets the number of additional storage and query capacity units that should be used by the index. You can change the capacity of the index up to 5 times per day.</p> <p>If you are using extra storage units, you can't reduce the storage capacity below that required to meet the storage needs for your index.</p>"
+          "documentation":"<p>Sets the number of additional document storage and query capacity units that should be used by the index. You can change the capacity of the index up to 5 times per day, or make 5 API calls.</p> <p>If you are using extra storage units, you can't reduce the storage capacity below what is required to meet the storage needs for your index.</p>"
         },
         "UserTokenConfigurations":{
           "shape":"UserTokenConfigurationList",
diff --git a/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/paginators-1.json b/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/paginators-1.json
index 78c174c91f..7ae81bfda7 100644
--- a/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/paginators-1.json
+++ b/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/paginators-1.json
@@ -59,6 +59,12 @@
       "limit_key": "MaxItems",
       "output_token": "NextMarker",
       "result_key": "FunctionArns"
+    },
+    "ListFunctionUrlConfigs": {
+      "input_token": "Marker",
+      "limit_key": "MaxItems",
+      "output_token": "NextMarker",
+      "result_key": "FunctionUrlConfigs"
     }
   }
 }
diff --git a/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/service-2.json b/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/service-2.json
index a9ba840b36..8b374ffaec 100644
--- a/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/lambda/2015-03-31/service-2.json
@@ -123,6 +123,24 @@
       ],
       "documentation":"<p>Creates a Lambda function. To create a function, you need a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html\">deployment package</a> and an <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html#lambda-intro-execution-role\">execution role</a>. The deployment package is a .zip file archive or container image that contains your function code. The execution role grants the function permission to use Amazon Web Services services, such as Amazon CloudWatch Logs for log streaming and X-Ray for request tracing.</p> <p>You set the package type to <code>Image</code> if the deployment package is a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/lambda-images.html\">container image</a>. For a container image, the code property must include the URI of a container image in the Amazon ECR registry. You do not need to specify the handler and runtime properties. </p> <p>You set the package type to <code>Zip</code> if the deployment package is a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html#gettingstarted-package-zip\">.zip file archive</a>. For a .zip file archive, the code property specifies the location of the .zip file. You must also specify the handler and runtime properties. The code in the deployment package must be compatible with the target instruction set architecture of the function (<code>x86-64</code> or <code>arm64</code>). If you do not specify the architecture, the default value is <code>x86-64</code>.</p> <p>When you create a function, Lambda provisions an instance of the function and its supporting resources. If your function connects to a VPC, this process can take a minute or so. During this time, you can't invoke or modify the function. The <code>State</code>, <code>StateReason</code>, and <code>StateReasonCode</code> fields in the response from <a>GetFunctionConfiguration</a> indicate when the function is ready to invoke. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/functions-states.html\">Function States</a>.</p> <p>A function has an unpublished version, and can have published versions and aliases. The unpublished version changes when you update your function's code and configuration. A published version is a snapshot of your function code and configuration that can't be changed. An alias is a named resource that maps to a version, and can be changed to map to a different version. Use the <code>Publish</code> parameter to create version <code>1</code> of your function from its initial configuration.</p> <p>The other parameters let you configure version-specific and function-level settings. You can modify version-specific settings later with <a>UpdateFunctionConfiguration</a>. Function-level settings apply to both the unpublished and published versions of the function, and include tags (<a>TagResource</a>) and per-function concurrency limits (<a>PutFunctionConcurrency</a>).</p> <p>You can use code signing if your deployment package is a .zip file archive. To enable code signing for this function, specify the ARN of a code-signing configuration. When a user attempts to deploy a code package with <a>UpdateFunctionCode</a>, Lambda checks that the code package has a valid signature from a trusted publisher. The code-signing configuration includes set set of signing profiles, which define the trusted publishers for this function.</p> <p>If another account or an Amazon Web Services service invokes your function, use <a>AddPermission</a> to grant permission by creating a resource-based IAM policy. You can grant permissions at the function level, on a version, or on an alias.</p> <p>To invoke your function directly, use <a>Invoke</a>. To invoke your function in response to events in other Amazon Web Services services, create an event source mapping (<a>CreateEventSourceMapping</a>), or configure a function trigger in the other service. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/lambda-invocation.html\">Invoking Functions</a>.</p>"
     },
+    "CreateFunctionUrlConfig":{
+      "name":"CreateFunctionUrlConfig",
+      "http":{
+        "method":"POST",
+        "requestUri":"/2021-10-31/functions/{FunctionName}/url",
+        "responseCode":201
+      },
+      "input":{"shape":"CreateFunctionUrlConfigRequest"},
+      "output":{"shape":"CreateFunctionUrlConfigResponse"},
+      "errors":[
+        {"shape":"ResourceConflictException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"InvalidParameterValueException"},
+        {"shape":"ServiceException"},
+        {"shape":"TooManyRequestsException"}
+      ],
+      "documentation":"<p>Creates a Lambda function URL with the specified configuration parameters. A function URL is a dedicated HTTP(S) endpoint that you can use to invoke your function.</p>"
+    },
     "DeleteAlias":{
       "name":"DeleteAlias",
       "http":{
@@ -243,6 +261,22 @@
       ],
       "documentation":"<p>Deletes the configuration for asynchronous invocation for a function, version, or alias.</p> <p>To configure options for asynchronous invocation, use <a>PutFunctionEventInvokeConfig</a>.</p>"
     },
+    "DeleteFunctionUrlConfig":{
+      "name":"DeleteFunctionUrlConfig",
+      "http":{
+        "method":"DELETE",
+        "requestUri":"/2021-10-31/functions/{FunctionName}/url",
+        "responseCode":204
+      },
+      "input":{"shape":"DeleteFunctionUrlConfigRequest"},
+      "errors":[
+        {"shape":"ResourceConflictException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ServiceException"},
+        {"shape":"TooManyRequestsException"}
+      ],
+      "documentation":"<p>Deletes a Lambda function URL. When you delete a function URL, you can't recover it. Creating a new function URL results in a different URL address.</p>"
+    },
     "DeleteLayerVersion":{
       "name":"DeleteLayerVersion",
       "http":{
@@ -424,6 +458,23 @@
       ],
       "documentation":"<p>Retrieves the configuration for asynchronous invocation for a function, version, or alias.</p> <p>To configure options for asynchronous invocation, use <a>PutFunctionEventInvokeConfig</a>.</p>"
     },
+    "GetFunctionUrlConfig":{
+      "name":"GetFunctionUrlConfig",
+      "http":{
+        "method":"GET",
+        "requestUri":"/2021-10-31/functions/{FunctionName}/url",
+        "responseCode":200
+      },
+      "input":{"shape":"GetFunctionUrlConfigRequest"},
+      "output":{"shape":"GetFunctionUrlConfigResponse"},
+      "errors":[
+        {"shape":"InvalidParameterValueException"},
+        {"shape":"ServiceException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"TooManyRequestsException"}
+      ],
+      "documentation":"<p>Returns details about a Lambda function URL.</p>"
+    },
     "GetLayerVersion":{
       "name":"GetLayerVersion",
       "http":{
@@ -633,6 +684,23 @@
       ],
       "documentation":"<p>Retrieves a list of configurations for asynchronous invocation for a function.</p> <p>To configure options for asynchronous invocation, use <a>PutFunctionEventInvokeConfig</a>.</p>"
     },
+    "ListFunctionUrlConfigs":{
+      "name":"ListFunctionUrlConfigs",
+      "http":{
+        "method":"GET",
+        "requestUri":"/2021-10-31/functions/{FunctionName}/urls",
+        "responseCode":200
+      },
+      "input":{"shape":"ListFunctionUrlConfigsRequest"},
+      "output":{"shape":"ListFunctionUrlConfigsResponse"},
+      "errors":[
+        {"shape":"InvalidParameterValueException"},
+        {"shape":"ServiceException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"TooManyRequestsException"}
+      ],
+      "documentation":"<p>Returns a list of Lambda function URLs for the specified function.</p>"
+    },
     "ListFunctions":{
       "name":"ListFunctions",
       "http":{
@@ -1043,6 +1111,24 @@
         {"shape":"ResourceConflictException"}
       ],
       "documentation":"<p>Updates the configuration for asynchronous invocation for a function, version, or alias.</p> <p>To configure options for asynchronous invocation, use <a>PutFunctionEventInvokeConfig</a>.</p>"
+    },
+    "UpdateFunctionUrlConfig":{
+      "name":"UpdateFunctionUrlConfig",
+      "http":{
+        "method":"PUT",
+        "requestUri":"/2021-10-31/functions/{FunctionName}/url",
+        "responseCode":200
+      },
+      "input":{"shape":"UpdateFunctionUrlConfigRequest"},
+      "output":{"shape":"UpdateFunctionUrlConfigResponse"},
+      "errors":[
+        {"shape":"ResourceConflictException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"InvalidParameterValueException"},
+        {"shape":"ServiceException"},
+        {"shape":"TooManyRequestsException"}
+      ],
+      "documentation":"<p>Updates the configuration for a Lambda function URL.</p>"
     }
   },
   "shapes":{
@@ -1201,6 +1287,10 @@
         "PrincipalOrgID":{
           "shape":"PrincipalOrgID",
           "documentation":"<p>The identifier for your organization in Organizations. Use this to grant permissions to all the Amazon Web Services accounts under this organization.</p>"
+        },
+        "FunctionUrlAuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
         }
       }
     },
@@ -1274,6 +1364,17 @@
       },
       "documentation":"<p>The <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/lambda-traffic-shifting-using-aliases.html\">traffic-shifting</a> configuration of a Lambda function alias.</p>"
     },
+    "AllowCredentials":{"type":"boolean"},
+    "AllowMethodsList":{
+      "type":"list",
+      "member":{"shape":"Method"},
+      "max":6
+    },
+    "AllowOriginsList":{
+      "type":"list",
+      "member":{"shape":"Origin"},
+      "max":100
+    },
     "AllowedPublishers":{
       "type":"structure",
       "required":["SigningProfileVersionArns"],
@@ -1436,6 +1537,36 @@
         }
       }
     },
+    "Cors":{
+      "type":"structure",
+      "members":{
+        "AllowCredentials":{
+          "shape":"AllowCredentials",
+          "documentation":"<p>Whether to allow cookies or other credentials in requests to your function URL. The default is <code>false</code>.</p>"
+        },
+        "AllowHeaders":{
+          "shape":"HeadersList",
+          "documentation":"<p>The HTTP headers that origins can include in requests to your function URL. For example: <code>Date</code>, <code>Keep-Alive</code>, <code>X-Custom-Header</code>.</p>"
+        },
+        "AllowMethods":{
+          "shape":"AllowMethodsList",
+          "documentation":"<p>The HTTP methods that are allowed when calling your function URL. For example: <code>GET</code>, <code>POST</code>, <code>DELETE</code>, or the wildcard character (<code>*</code>).</p>"
+        },
+        "AllowOrigins":{
+          "shape":"AllowOriginsList",
+          "documentation":"<p>The origins that can access your function URL. You can list any number of specific origins, separated by a comma. For example: <code>https://www.example.com</code>, <code>http://localhost:60905</code>.</p> <p>Alternatively, you can grant access to all origins using the wildcard character (<code>*</code>).</p>"
+        },
+        "ExposeHeaders":{
+          "shape":"HeadersList",
+          "documentation":"<p>The HTTP headers in your function response that you want to expose to origins that call your function URL. For example: <code>Date</code>, <code>Keep-Alive</code>, <code>X-Custom-Header</code>.</p>"
+        },
+        "MaxAge":{
+          "shape":"MaxAge",
+          "documentation":"<p>The maximum amount of time, in seconds, that web browsers can cache results of a preflight request. By default, this is set to <code>0</code>, which means that the browser doesn't cache results.</p>"
+        }
+      },
+      "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your Lambda function URL. Use CORS to grant access to your function URL from any origin. You can also use CORS to control access for specific HTTP headers and methods in requests to your function URL.</p>"
+    },
     "CreateAliasRequest":{
       "type":"structure",
       "required":[
@@ -1676,6 +1807,66 @@
         }
       }
     },
+    "CreateFunctionUrlConfigRequest":{
+      "type":"structure",
+      "required":[
+        "FunctionName",
+        "AuthType"
+      ],
+      "members":{
+        "FunctionName":{
+          "shape":"FunctionName",
+          "documentation":"<p>The name of the Lambda function.</p> <p class=\"title\"> <b>Name formats</b> </p> <ul> <li> <p> <b>Function name</b> - <code>my-function</code>.</p> </li> <li> <p> <b>Function ARN</b> - <code>arn:aws:lambda:us-west-2:123456789012:function:my-function</code>.</p> </li> <li> <p> <b>Partial ARN</b> - <code>123456789012:function:my-function</code>.</p> </li> </ul> <p>The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.</p>",
+          "location":"uri",
+          "locationName":"FunctionName"
+        },
+        "Qualifier":{
+          "shape":"FunctionUrlQualifier",
+          "documentation":"<p>The alias name.</p>",
+          "location":"querystring",
+          "locationName":"Qualifier"
+        },
+        "AuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
+        },
+        "Cors":{
+          "shape":"Cors",
+          "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your function URL.</p>"
+        }
+      }
+    },
+    "CreateFunctionUrlConfigResponse":{
+      "type":"structure",
+      "required":[
+        "FunctionUrl",
+        "FunctionArn",
+        "AuthType",
+        "CreationTime"
+      ],
+      "members":{
+        "FunctionUrl":{
+          "shape":"FunctionUrl",
+          "documentation":"<p>The HTTP URL endpoint for your function.</p>"
+        },
+        "FunctionArn":{
+          "shape":"FunctionArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of your function.</p>"
+        },
+        "AuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
+        },
+        "Cors":{
+          "shape":"Cors",
+          "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your function URL.</p>"
+        },
+        "CreationTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL was created, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        }
+      }
+    },
     "Date":{"type":"timestamp"},
     "DeadLetterConfig":{
       "type":"structure",
@@ -1797,6 +1988,24 @@
         }
       }
     },
+    "DeleteFunctionUrlConfigRequest":{
+      "type":"structure",
+      "required":["FunctionName"],
+      "members":{
+        "FunctionName":{
+          "shape":"FunctionName",
+          "documentation":"<p>The name of the Lambda function.</p> <p class=\"title\"> <b>Name formats</b> </p> <ul> <li> <p> <b>Function name</b> - <code>my-function</code>.</p> </li> <li> <p> <b>Function ARN</b> - <code>arn:aws:lambda:us-west-2:123456789012:function:my-function</code>.</p> </li> <li> <p> <b>Partial ARN</b> - <code>123456789012:function:my-function</code>.</p> </li> </ul> <p>The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.</p>",
+          "location":"uri",
+          "locationName":"FunctionName"
+        },
+        "Qualifier":{
+          "shape":"FunctionUrlQualifier",
+          "documentation":"<p>The alias name.</p>",
+          "location":"querystring",
+          "locationName":"Qualifier"
+        }
+      }
+    },
     "DeleteLayerVersionRequest":{
       "type":"structure",
       "required":[
@@ -2449,6 +2658,65 @@
       "max":1,
       "min":0
     },
+    "FunctionUrl":{
+      "type":"string",
+      "max":100,
+      "min":40
+    },
+    "FunctionUrlAuthType":{
+      "type":"string",
+      "enum":[
+        "NONE",
+        "AWS_IAM"
+      ]
+    },
+    "FunctionUrlConfig":{
+      "type":"structure",
+      "required":[
+        "FunctionUrl",
+        "FunctionArn",
+        "CreationTime",
+        "LastModifiedTime",
+        "AuthType"
+      ],
+      "members":{
+        "FunctionUrl":{
+          "shape":"FunctionUrl",
+          "documentation":"<p>The HTTP URL endpoint for your function.</p>"
+        },
+        "FunctionArn":{
+          "shape":"FunctionArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of your function.</p>"
+        },
+        "CreationTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL was created, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        },
+        "LastModifiedTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL configuration was last updated, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        },
+        "Cors":{
+          "shape":"Cors",
+          "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your function URL.</p>"
+        },
+        "AuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
+        }
+      },
+      "documentation":"<p>Details about a Lambda function URL.</p>"
+    },
+    "FunctionUrlConfigList":{
+      "type":"list",
+      "member":{"shape":"FunctionUrlConfig"}
+    },
+    "FunctionUrlQualifier":{
+      "type":"string",
+      "max":128,
+      "min":1,
+      "pattern":"(^\\$LATEST$)|((?!^[0-9]+$)([a-zA-Z0-9-_]+))"
+    },
     "FunctionVersion":{
       "type":"string",
       "enum":["ALL"]
@@ -2651,6 +2919,60 @@
         }
       }
     },
+    "GetFunctionUrlConfigRequest":{
+      "type":"structure",
+      "required":["FunctionName"],
+      "members":{
+        "FunctionName":{
+          "shape":"FunctionName",
+          "documentation":"<p>The name of the Lambda function.</p> <p class=\"title\"> <b>Name formats</b> </p> <ul> <li> <p> <b>Function name</b> - <code>my-function</code>.</p> </li> <li> <p> <b>Function ARN</b> - <code>arn:aws:lambda:us-west-2:123456789012:function:my-function</code>.</p> </li> <li> <p> <b>Partial ARN</b> - <code>123456789012:function:my-function</code>.</p> </li> </ul> <p>The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.</p>",
+          "location":"uri",
+          "locationName":"FunctionName"
+        },
+        "Qualifier":{
+          "shape":"FunctionUrlQualifier",
+          "documentation":"<p>The alias name.</p>",
+          "location":"querystring",
+          "locationName":"Qualifier"
+        }
+      }
+    },
+    "GetFunctionUrlConfigResponse":{
+      "type":"structure",
+      "required":[
+        "FunctionUrl",
+        "FunctionArn",
+        "AuthType",
+        "CreationTime",
+        "LastModifiedTime"
+      ],
+      "members":{
+        "FunctionUrl":{
+          "shape":"FunctionUrl",
+          "documentation":"<p>The HTTP URL endpoint for your function.</p>"
+        },
+        "FunctionArn":{
+          "shape":"FunctionArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of your function.</p>"
+        },
+        "AuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
+        },
+        "Cors":{
+          "shape":"Cors",
+          "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your function URL.</p>"
+        },
+        "CreationTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL was created, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        },
+        "LastModifiedTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL configuration was last updated, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        }
+      }
+    },
     "GetLayerVersionByArnRequest":{
       "type":"structure",
       "required":["Arn"],
@@ -2845,6 +3167,16 @@
       "max":128,
       "pattern":"[^\\s]+"
     },
+    "Header":{
+      "type":"string",
+      "max":1024,
+      "pattern":".*"
+    },
+    "HeadersList":{
+      "type":"list",
+      "member":{"shape":"Header"},
+      "max":100
+    },
     "HttpStatus":{"type":"integer"},
     "ImageConfig":{
       "type":"structure",
@@ -3480,6 +3812,44 @@
         }
       }
     },
+    "ListFunctionUrlConfigsRequest":{
+      "type":"structure",
+      "required":["FunctionName"],
+      "members":{
+        "FunctionName":{
+          "shape":"FunctionName",
+          "documentation":"<p>The name of the Lambda function.</p> <p class=\"title\"> <b>Name formats</b> </p> <ul> <li> <p> <b>Function name</b> - <code>my-function</code>.</p> </li> <li> <p> <b>Function ARN</b> - <code>arn:aws:lambda:us-west-2:123456789012:function:my-function</code>.</p> </li> <li> <p> <b>Partial ARN</b> - <code>123456789012:function:my-function</code>.</p> </li> </ul> <p>The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.</p>",
+          "location":"uri",
+          "locationName":"FunctionName"
+        },
+        "Marker":{
+          "shape":"String",
+          "documentation":"<p>Specify the pagination token that's returned by a previous request to retrieve the next page of results.</p>",
+          "location":"querystring",
+          "locationName":"Marker"
+        },
+        "MaxItems":{
+          "shape":"MaxItems",
+          "documentation":"<p>The maximum number of function URLs to return in the response. Note that <code>ListFunctionUrlConfigs</code> returns a maximum of 50 items in each response, even if you set the number higher.</p>",
+          "location":"querystring",
+          "locationName":"MaxItems"
+        }
+      }
+    },
+    "ListFunctionUrlConfigsResponse":{
+      "type":"structure",
+      "required":["FunctionUrlConfigs"],
+      "members":{
+        "FunctionUrlConfigs":{
+          "shape":"FunctionUrlConfigList",
+          "documentation":"<p>A list of function URL configurations.</p>"
+        },
+        "NextMarker":{
+          "shape":"String",
+          "documentation":"<p>The pagination token that's included if more results are available.</p>"
+        }
+      }
+    },
     "ListFunctionsByCodeSigningConfigRequest":{
       "type":"structure",
       "required":["CodeSigningConfigArn"],
@@ -3763,11 +4133,21 @@
       "type":"string",
       "pattern":"ALL|[a-z]{2}(-gov)?-[a-z]+-\\d{1}"
     },
+    "MaxAge":{
+      "type":"integer",
+      "max":86400,
+      "min":0
+    },
     "MaxFunctionEventInvokeConfigListItems":{
       "type":"integer",
       "max":50,
       "min":1
     },
+    "MaxItems":{
+      "type":"integer",
+      "max":50,
+      "min":1
+    },
     "MaxLayerListItems":{
       "type":"integer",
       "max":50,
@@ -3813,6 +4193,11 @@
       "max":10240,
       "min":128
     },
+    "Method":{
+      "type":"string",
+      "max":6,
+      "pattern":".*"
+    },
     "NameSpacedFunctionArn":{
       "type":"string",
       "pattern":"arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}(-gov)?-[a-z]+-\\d{1}:\\d{12}:function:[a-zA-Z0-9-_\\.]+(:(\\$LATEST|[a-zA-Z0-9-_]+))?"
@@ -3858,6 +4243,12 @@
       "max":34,
       "pattern":"o-[a-z0-9]{10,32}"
     },
+    "Origin":{
+      "type":"string",
+      "max":253,
+      "min":1,
+      "pattern":".*"
+    },
     "PackageType":{
       "type":"string",
       "enum":[
@@ -4984,6 +5375,68 @@
         }
       }
     },
+    "UpdateFunctionUrlConfigRequest":{
+      "type":"structure",
+      "required":["FunctionName"],
+      "members":{
+        "FunctionName":{
+          "shape":"FunctionName",
+          "documentation":"<p>The name of the Lambda function.</p> <p class=\"title\"> <b>Name formats</b> </p> <ul> <li> <p> <b>Function name</b> - <code>my-function</code>.</p> </li> <li> <p> <b>Function ARN</b> - <code>arn:aws:lambda:us-west-2:123456789012:function:my-function</code>.</p> </li> <li> <p> <b>Partial ARN</b> - <code>123456789012:function:my-function</code>.</p> </li> </ul> <p>The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.</p>",
+          "location":"uri",
+          "locationName":"FunctionName"
+        },
+        "Qualifier":{
+          "shape":"FunctionUrlQualifier",
+          "documentation":"<p>The alias name.</p>",
+          "location":"querystring",
+          "locationName":"Qualifier"
+        },
+        "AuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
+        },
+        "Cors":{
+          "shape":"Cors",
+          "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your function URL.</p>"
+        }
+      }
+    },
+    "UpdateFunctionUrlConfigResponse":{
+      "type":"structure",
+      "required":[
+        "FunctionUrl",
+        "FunctionArn",
+        "AuthType",
+        "CreationTime",
+        "LastModifiedTime"
+      ],
+      "members":{
+        "FunctionUrl":{
+          "shape":"FunctionUrl",
+          "documentation":"<p>The HTTP URL endpoint for your function.</p>"
+        },
+        "FunctionArn":{
+          "shape":"FunctionArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of your function.</p>"
+        },
+        "AuthType":{
+          "shape":"FunctionUrlAuthType",
+          "documentation":"<p>The type of authentication that your function URL uses. Set to <code>AWS_IAM</code> if you want to restrict access to authenticated <code>IAM</code> users only. Set to <code>NONE</code> if you want to bypass IAM authentication to create a public endpoint. For more information, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html\"> Security and auth model for Lambda function URLs</a>.</p>"
+        },
+        "Cors":{
+          "shape":"Cors",
+          "documentation":"<p>The <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS\">cross-origin resource sharing (CORS)</a> settings for your function URL.</p>"
+        },
+        "CreationTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL was created, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        },
+        "LastModifiedTime":{
+          "shape":"Timestamp",
+          "documentation":"<p>When the function URL configuration was last updated, in <a href=\"https://www.w3.org/TR/NOTE-datetime\">ISO-8601 format</a> (YYYY-MM-DDThh:mm:ss.sTZD).</p>"
+        }
+      }
+    },
     "Version":{
       "type":"string",
       "max":1024,
diff --git a/contrib/python/botocore/py3/botocore/data/panorama/2019-07-24/service-2.json b/contrib/python/botocore/py3/botocore/data/panorama/2019-07-24/service-2.json
index dcc79c536a..75a6a39f39 100644
--- a/contrib/python/botocore/py3/botocore/data/panorama/2019-07-24/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/panorama/2019-07-24/service-2.json
@@ -492,7 +492,7 @@
         {"shape":"ServiceQuotaExceededException"},
         {"shape":"InternalServerException"}
       ],
-      "documentation":"<p>Creates a device and returns a configuration archive. The configuration archive is a ZIP file that contains a provisioning certificate that is valid for 5 minutes. Transfer the configuration archive to the device with the included USB storage device within 5 minutes.</p>"
+      "documentation":"<p>Creates a device and returns a configuration archive. The configuration archive is a ZIP file that contains a provisioning certificate that is valid for 5 minutes. Name the configuration archive <code>certificates-omni_<i>device-name</i>.zip</code> and transfer it to the device within 5 minutes. Use the included USB storage device and connect it to the USB 3.0 port next to the HDMI output.</p>"
     },
     "RegisterPackageVersion":{
       "name":"RegisterPackageVersion",
@@ -695,7 +695,8 @@
         "REMOVAL_REQUESTED",
         "REMOVAL_IN_PROGRESS",
         "REMOVAL_FAILED",
-        "REMOVAL_SUCCEEDED"
+        "REMOVAL_SUCCEEDED",
+        "DEPLOYMENT_FAILED"
       ]
     },
     "ApplicationInstanceStatusDescription":{
@@ -1291,6 +1292,10 @@
           "shape":"DeviceArn",
           "documentation":"<p>The device's ARN.</p>"
         },
+        "Brand":{
+          "shape":"DeviceBrand",
+          "documentation":"<p>The device's maker.</p>"
+        },
         "CreatedTime":{
           "shape":"CreatedTime",
           "documentation":"<p>When the device was created.</p>"
@@ -1747,6 +1752,10 @@
     "Device":{
       "type":"structure",
       "members":{
+        "Brand":{
+          "shape":"DeviceBrand",
+          "documentation":"<p>The device's maker.</p>"
+        },
         "CreatedTime":{
           "shape":"CreatedTime",
           "documentation":"<p>When the device was created.</p>"
@@ -1779,6 +1788,13 @@
       "max":255,
       "min":1
     },
+    "DeviceBrand":{
+      "type":"string",
+      "enum":[
+        "AWS_PANORAMA",
+        "LENOVO"
+      ]
+    },
     "DeviceConnectionStatus":{
       "type":"string",
       "enum":[
@@ -3328,7 +3344,8 @@
         "REMOVAL_SUCCEEDED",
         "REMOVAL_FAILED",
         "PROCESSING_DEPLOYMENT",
-        "PROCESSING_REMOVAL"
+        "PROCESSING_REMOVAL",
+        "DEPLOYMENT_FAILED"
       ]
     },
     "StorageLocation":{
diff --git a/contrib/python/botocore/py3/botocore/httpsession.py b/contrib/python/botocore/py3/botocore/httpsession.py
index caa327ed96..20e59632bd 100644
--- a/contrib/python/botocore/py3/botocore/httpsession.py
+++ b/contrib/python/botocore/py3/botocore/httpsession.py
@@ -9,7 +9,12 @@ from urllib3 import PoolManager, Timeout, proxy_from_url
 from urllib3.exceptions import (
     ConnectTimeoutError as URLLib3ConnectTimeoutError,
 )
-from urllib3.exceptions import NewConnectionError, ProtocolError, ProxyError
+from urllib3.exceptions import (
+    LocationParseError,
+    NewConnectionError,
+    ProtocolError,
+    ProxyError,
+)
 from urllib3.exceptions import ReadTimeoutError as URLLib3ReadTimeoutError
 from urllib3.exceptions import SSLError as URLLib3SSLError
 from urllib3.util.retry import Retry
@@ -19,8 +24,10 @@ from urllib3.util.ssl_ import (
     PROTOCOL_TLS,
     OP_NO_SSLv2,
     OP_NO_SSLv3,
+    is_ipaddress,
     ssl,
 )
+from urllib3.util.url import parse_url
 
 try:
     from urllib3.util.ssl_ import OP_NO_TICKET, PROTOCOL_TLS_CLIENT
@@ -36,7 +43,12 @@ except ImportError:
     from urllib3.util.ssl_ import SSLContext
 
 import botocore.awsrequest
-from botocore.compat import ensure_bytes, filter_ssl_warnings, urlparse
+from botocore.compat import (
+    IPV6_ADDRZ_RE,
+    ensure_bytes,
+    filter_ssl_warnings,
+    urlparse,
+)
 from botocore.exceptions import (
     ConnectionClosedError,
     ConnectTimeoutError,
@@ -177,6 +189,11 @@ def mask_proxy_url(proxy_url):
     return proxy_url
 
 
+def _is_ipaddress(host):
+    """Wrap urllib3's is_ipaddress to support bracketed IPv6 addresses."""
+    return is_ipaddress(host) or bool(IPV6_ADDRZ_RE.match(host))
+
+
 class ProxyConfiguration(object):
     """Represents a proxy configuration dictionary and additional settings.
 
@@ -285,14 +302,13 @@ class URLLib3Session(object):
         self._manager = PoolManager(**self._get_pool_manager_kwargs())
         self._manager.pool_classes_by_scheme = self._pool_classes_by_scheme
 
-    @property
-    def _proxies_kwargs(self):
+    def _proxies_kwargs(self, **kwargs):
         proxies_settings = self._proxy_config.settings
-        proxy_ssl_context = self._setup_proxy_ssl_context(proxies_settings)
         proxies_kwargs = {
-            'proxy_ssl_context': proxy_ssl_context,
             'use_forwarding_for_https': proxies_settings.get(
-                'proxy_use_forwarding_for_https'),
+                'proxy_use_forwarding_for_https'
+            ),
+            **kwargs
         }
         return {k: v for k, v in proxies_kwargs.items() if v is not None}
 
@@ -315,9 +331,13 @@ class URLLib3Session(object):
     def _get_proxy_manager(self, proxy_url):
         if proxy_url not in self._proxy_managers:
             proxy_headers = self._proxy_config.proxy_headers_for(proxy_url)
+            proxy_ssl_context = self._setup_proxy_ssl_context(proxy_url)
             proxy_manager_kwargs = self._get_pool_manager_kwargs(
-                proxy_headers=proxy_headers)
-            proxy_manager_kwargs.update(**self._proxies_kwargs)
+                proxy_headers=proxy_headers
+            )
+            proxy_manager_kwargs.update(
+                self._proxies_kwargs(proxy_ssl_context=proxy_ssl_context)
+            )
             proxy_manager = proxy_from_url(proxy_url, **proxy_manager_kwargs)
             proxy_manager.pool_classes_by_scheme = self._pool_classes_by_scheme
             self._proxy_managers[proxy_url] = proxy_manager
@@ -341,7 +361,8 @@ class URLLib3Session(object):
             conn.cert_reqs = 'CERT_NONE'
             conn.ca_certs = None
 
-    def _setup_proxy_ssl_context(self, proxies_settings):
+    def _setup_proxy_ssl_context(self, proxy_url):
+        proxies_settings = self._proxy_config.settings
         proxy_ca_bundle = proxies_settings.get('proxy_ca_bundle')
         proxy_cert = proxies_settings.get('proxy_client_cert')
         if proxy_ca_bundle is None and proxy_cert is None:
@@ -349,9 +370,11 @@ class URLLib3Session(object):
 
         context = self._get_ssl_context()
         try:
-            # urllib3 disables this by default but we need
-            # it for proper proxy tls negotiation.
-            context.check_hostname = True
+            url = parse_url(proxy_url)
+            # urllib3 disables this by default but we need it for proper
+            # proxy tls negotiation when proxy_url is not an IP Address
+            if not _is_ipaddress(url.host):
+                context.check_hostname = True
             if proxy_ca_bundle is not None:
                 context.load_verify_locations(cafile=proxy_ca_bundle)
 
@@ -361,7 +384,7 @@ class URLLib3Session(object):
                 context.load_cert_chain(proxy_cert)
 
             return context
-        except (IOError, URLLib3SSLError) as e:
+        except (IOError, URLLib3SSLError, LocationParseError) as e:
             raise InvalidProxiesConfigError(error=e)
 
     def _get_connection_manager(self, url, proxy_url=None):
@@ -383,7 +406,7 @@ class URLLib3Session(object):
         proxy_scheme = urlparse(proxy_url).scheme
         using_https_forwarding_proxy = (
             proxy_scheme == 'https' and
-            self._proxies_kwargs.get('use_forwarding_for_https', False)
+            self._proxies_kwargs().get('use_forwarding_for_https', False)
         )
 
         if using_https_forwarding_proxy or url.startswith('http:'):