intermediate changes

ref:66d0ed6dd246b7d95b65e69f61fd260cad49965f

8 files changed, 154 insertions, 11 deletions

diff --git a/contrib/python/botocore/py3/.dist-info/METADATA b/contrib/python/botocore/py3/.dist-info/METADATA
index e0561cf3d1a..bbf174aa60b 100644
--- a/contrib/python/botocore/py3/.dist-info/METADATA
+++ b/contrib/python/botocore/py3/.dist-info/METADATA
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: botocore
-Version: 1.25.2
+Version: 1.25.3
 Summary: Low-level, data-driven core of boto 3.
 Home-page: https://github.com/boto/botocore
 Author: Amazon Web Services
diff --git a/contrib/python/botocore/py3/botocore/__init__.py b/contrib/python/botocore/py3/botocore/__init__.py
index 33b9786ef69..d6ca598a7b8 100644
--- a/contrib/python/botocore/py3/botocore/__init__.py
+++ b/contrib/python/botocore/py3/botocore/__init__.py
@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.25.2'
+__version__ = '1.25.3'
 
 
 class NullHandler(logging.Handler):
diff --git a/contrib/python/botocore/py3/botocore/data/auditmanager/2017-07-25/service-2.json b/contrib/python/botocore/py3/botocore/data/auditmanager/2017-07-25/service-2.json
index 9e74cdc7baa..d313753709f 100644
--- a/contrib/python/botocore/py3/botocore/data/auditmanager/2017-07-25/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/auditmanager/2017-07-25/service-2.json
@@ -234,7 +234,7 @@
         {"shape":"InternalServerException"},
         {"shape":"ResourceNotFoundException"}
       ],
-      "documentation":"<p> Deletes an assessment report from an assessment in Audit Manager. </p>"
+      "documentation":"<p>Deletes an assessment report in Audit Manager. </p> <p>When you run the <code>DeleteAssessmentReport</code> operation, Audit Manager attempts to delete the following data:</p> <ol> <li> <p>The specified assessment report that’s stored in your S3 bucket</p> </li> <li> <p>The associated metadata that’s stored in Audit Manager</p> </li> </ol> <p>If Audit Manager can’t access the assessment report in your S3 bucket, the report isn’t deleted. In this event, the <code>DeleteAssessmentReport</code> operation doesn’t fail. Instead, it proceeds to delete the associated metadata only. You must then delete the assessment report from the S3 bucket yourself. </p> <p>This scenario happens when Audit Manager receives a <code>403 (Forbidden)</code> or <code>404 (Not Found)</code> error from Amazon S3. To avoid this, make sure that your S3 bucket is available, and that you configured the correct permissions for Audit Manager to delete resources in your S3 bucket. For an example permissions policy that you can use, see <a href=\"https://docs.aws.amazon.com/audit-manager/latest/userguide/security_iam_id-based-policy-examples.html#full-administrator-access-assessment-report-destination\">Assessment report destination permissions</a> in the <i>Audit Manager User Guide</i>. For information about the issues that could cause a <code>403 (Forbidden)</code> or <code>404 (Not Found</code>) error from Amazon S3, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList\">List of Error Codes</a> in the <i>Amazon Simple Storage Service API Reference</i>. </p>"
     },
     "DeleteControl":{
       "name":"DeleteControl",
@@ -4468,11 +4468,11 @@
       "members":{
         "keywordInputType":{
           "shape":"KeywordInputType",
-          "documentation":"<p> The method of input for the keyword. </p>"
+          "documentation":"<p> The input method for the keyword. </p>"
         },
         "keywordValue":{
           "shape":"KeywordValue",
-          "documentation":"<p> The value of the keyword that's used to search CloudTrail logs, Config rules, Security Hub checks, and Amazon Web Services API names when mapping a control data source. </p>"
+          "documentation":"<p> The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call. </p> <p>If you’re mapping a data source to a rule in Config, the <code>keywordValue</code> that you specify depends on the type of rule:</p> <ul> <li> <p>For <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html\">managed rules</a>, you can use the rule identifier as the <code>keywordValue</code>. You can find the rule identifier from the <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html\">list of Config managed rules</a>.</p> <ul> <li> <p>Managed rule name: <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-acl-prohibited.html\">s3-bucket-acl-prohibited</a> </p> <p> <code>keywordValue</code>: <code>S3_BUCKET_ACL_PROHIBITED</code> </p> </li> </ul> </li> <li> <p>For <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html\">custom rules</a>, you form the <code>keywordValue</code> by adding the <code>Custom_</code> prefix to the rule name. This prefix distinguishes the rule from a managed rule.</p> <ul> <li> <p>Custom rule name: my-custom-config-rule</p> <p> <code>keywordValue</code>: <code>Custom_my-custom-config-rule</code> </p> </li> </ul> </li> <li> <p>For <a href=\"https://docs.aws.amazon.com/config/latest/developerguide/service-linked-awsconfig-rules.html\">service-linked rules</a>, you form the <code>keywordValue</code> by adding the <code>Custom_</code> prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.</p> <ul> <li> <p>Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w</p> <p> <code>keywordValue</code>: <code>Custom_CustomRuleForAccount-conformance-pack</code> </p> </li> <li> <p>Service-linked rule name: securityhub-api-gw-cache-encrypted-101104e1</p> <p> <code>keywordValue</code>: <code>Custom_securityhub-api-gw-cache-encrypted</code> </p> </li> <li> <p>Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba</p> <p> <code>keywordValue</code>: <code>Custom_OrgConfigRule-s3-bucket-versioning-enabled</code> </p> </li> </ul> </li> </ul>"
         }
       },
       "documentation":"<p> The keyword to search for in CloudTrail logs, Config rules, Security Hub checks, and Amazon Web Services API names. </p>"
diff --git a/contrib/python/botocore/py3/botocore/data/braket/2019-09-01/service-2.json b/contrib/python/botocore/py3/botocore/data/braket/2019-09-01/service-2.json
index 5573da0f3ba..22c6e3054a5 100644
--- a/contrib/python/botocore/py3/botocore/data/braket/2019-09-01/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/braket/2019-09-01/service-2.json
@@ -108,7 +108,7 @@
         {"shape":"InternalServiceException"},
         {"shape":"ValidationException"}
       ],
-      "documentation":"<p>Retrieves the devices available in Amazon Braket.</p>"
+      "documentation":"<p>Retrieves the devices available in Amazon Braket.</p> <note> <p>For backwards compatibility with older versions of BraketSchemas, OpenQASM information is omitted from GetDevice API calls. To get this information the user-agent needs to present a recent version of the BraketSchemas (1.8.0 or later). The Braket SDK automatically reports this for you. If you do not see OpenQASM results in the GetDevice response when using a Braket SDK, you may need to set AWS_EXECUTION_ENV environment variable to configure user-agent. See the code examples provided below for how to do this for the AWS CLI, Boto3, and the Go, Java, and JavaScript/TypeScript SDKs.</p> </note>"
     },
     "GetJob":{
       "name":"GetJob",
@@ -933,6 +933,10 @@
         "volumeSizeInGb"
       ],
       "members":{
+        "instanceCount":{
+          "shape":"InstanceConfigInstanceCountInteger",
+          "documentation":"<p>Configures the number of resource instances to use while running an Amazon Braket job on Amazon Braket. The default value is 1.</p>"
+        },
         "instanceType":{
           "shape":"InstanceType",
           "documentation":"<p>Configures the type resource instances to use while running an Amazon Braket hybrid job.</p>"
@@ -944,6 +948,11 @@
       },
       "documentation":"<p>Configures the resource instances to use while running the Amazon Braket hybrid job on Amazon Braket.</p>"
     },
+    "InstanceConfigInstanceCountInteger":{
+      "type":"integer",
+      "box":true,
+      "min":1
+    },
     "InstanceConfigVolumeSizeInGbInteger":{
       "type":"integer",
       "box":true,
@@ -1694,5 +1703,5 @@
       "exception":true
     }
   },
-  "documentation":"<p>The Amazon Braket API Reference provides information about the operations and structures supported in Amazon Braket.</p>"
+  "documentation":"<p>The Amazon Braket API Reference provides information about the operations and structures supported in Amazon Braket.</p> <p>Additional Resources:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/braket/latest/developerguide/what-is-braket.html\">Amazon Braket Developer Guide</a> </p> </li> </ul>"
 }
diff --git a/contrib/python/botocore/py3/botocore/data/connect/2017-08-08/service-2.json b/contrib/python/botocore/py3/botocore/data/connect/2017-08-08/service-2.json
index a95bc2aeccd..c85d2bdcbcb 100644
--- a/contrib/python/botocore/py3/botocore/data/connect/2017-08-08/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/connect/2017-08-08/service-2.json
@@ -1636,6 +1636,24 @@
       ],
       "documentation":"<p>Provides summary information about the users for the specified Amazon Connect instance.</p>"
     },
+    "PutUserStatus":{
+      "name":"PutUserStatus",
+      "http":{
+        "method":"PUT",
+        "requestUri":"/users/{InstanceId}/{UserId}/status"
+      },
+      "input":{"shape":"PutUserStatusRequest"},
+      "output":{"shape":"PutUserStatusResponse"},
+      "errors":[
+        {"shape":"InvalidRequestException"},
+        {"shape":"InvalidParameterException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"InternalServiceException"}
+      ],
+      "documentation":"<p>Changes the current status of a user or agent in Amazon Connect. If the agent is currently handling a contact, this sets the agent's next status.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/connect/latest/adminguide/metrics-agent-status.html\">Agent status</a> and <a href=\"https://docs.aws.amazon.com/connect/latest/adminguide/set-next-status.html\">Set your next status</a> in the <i>Amazon Connect Administrator Guide</i>.</p>"
+    },
     "ReleasePhoneNumber":{
       "name":"ReleasePhoneNumber",
       "http":{
@@ -8144,6 +8162,37 @@
       "type":"list",
       "member":{"shape":"PromptSummary"}
     },
+    "PutUserStatusRequest":{
+      "type":"structure",
+      "required":[
+        "UserId",
+        "InstanceId",
+        "AgentStatusId"
+      ],
+      "members":{
+        "UserId":{
+          "shape":"UserId",
+          "documentation":"<p>The identifier of the user.</p>",
+          "location":"uri",
+          "locationName":"UserId"
+        },
+        "InstanceId":{
+          "shape":"InstanceId",
+          "documentation":"<p>The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.</p>",
+          "location":"uri",
+          "locationName":"InstanceId"
+        },
+        "AgentStatusId":{
+          "shape":"AgentStatusId",
+          "documentation":"<p>The identifier of the agent status.</p>"
+        }
+      }
+    },
+    "PutUserStatusResponse":{
+      "type":"structure",
+      "members":{
+      }
+    },
     "Queue":{
       "type":"structure",
       "members":{
diff --git a/contrib/python/botocore/py3/botocore/data/ec2/2016-11-15/service-2.json b/contrib/python/botocore/py3/botocore/data/ec2/2016-11-15/service-2.json
index 9488ec2c91c..c3d3f91a17b 100644
--- a/contrib/python/botocore/py3/botocore/data/ec2/2016-11-15/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/ec2/2016-11-15/service-2.json
@@ -686,7 +686,7 @@
       },
       "input":{"shape":"CreateKeyPairRequest"},
       "output":{"shape":"KeyPair"},
-      "documentation":"<p>Creates an ED25519 or 2048-bit RSA key pair with the specified name. Amazon EC2 stores the public key and displays the private key for you to save to a file. The private key is returned as an unencrypted PEM encoded PKCS#1 private key. If a key with the specified name already exists, Amazon EC2 returns an error.</p> <p>The key pair returned to you is available only in the Amazon Web Services Region in which you create it. If you prefer, you can create your own key pair using a third-party tool and upload it to any Region using <a>ImportKeyPair</a>.</p> <p>You can have up to 5,000 key pairs per Amazon Web Services Region.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html\">Amazon EC2 key pairs</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>.</p>"
+      "documentation":"<p>Creates an ED25519 or 2048-bit RSA key pair with the specified name and in the specified PEM or PPK format. Amazon EC2 stores the public key and displays the private key for you to save to a file. The private key is returned as an unencrypted PEM encoded PKCS#1 private key or an unencrypted PPK formatted private key for use with PuTTY. If a key with the specified name already exists, Amazon EC2 returns an error.</p> <p>The key pair returned to you is available only in the Amazon Web Services Region in which you create it. If you prefer, you can create your own key pair using a third-party tool and upload it to any Region using <a>ImportKeyPair</a>.</p> <p>You can have up to 5,000 key pairs per Amazon Web Services Region.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html\">Amazon EC2 key pairs</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>.</p>"
     },
     "CreateLaunchTemplate":{
       "name":"CreateLaunchTemplate",
@@ -11325,6 +11325,10 @@
           "shape":"TagSpecificationList",
           "documentation":"<p>The tags to apply to the new key pair.</p>",
           "locationName":"TagSpecification"
+        },
+        "KeyFormat":{
+          "shape":"KeyFormat",
+          "documentation":"<p>The format of the key pair.</p> <p>Default: <code>pem</code> </p>"
         }
       }
     },
@@ -18081,6 +18085,10 @@
           "shape":"Boolean",
           "documentation":"<p>Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is <code>DryRunOperation</code>. Otherwise, it is <code>UnauthorizedOperation</code>.</p>",
           "locationName":"dryRun"
+        },
+        "IncludePublicKey":{
+          "shape":"Boolean",
+          "documentation":"<p>If <code>true</code>, the public key material is included in the response.</p> <p>Default: <code>false</code> </p>"
         }
       }
     },
@@ -32408,6 +32416,13 @@
       ]
     },
     "KernelId":{"type":"string"},
+    "KeyFormat":{
+      "type":"string",
+      "enum":[
+        "pem",
+        "ppk"
+      ]
+    },
     "KeyNameStringList":{
       "type":"list",
       "member":{
@@ -32481,6 +32496,16 @@
           "shape":"TagList",
           "documentation":"<p>Any tags applied to the key pair.</p>",
           "locationName":"tagSet"
+        },
+        "PublicKey":{
+          "shape":"String",
+          "documentation":"<p>The public key material.</p>",
+          "locationName":"publicKey"
+        },
+        "CreateTime":{
+          "shape":"MillisecondDateTime",
+          "documentation":"<p>If you used Amazon EC2 to create the key pair, this is the date and time when the key was created, in <a href=\"https://www.iso.org/iso-8601-date-and-time-format.html\">ISO 8601 date-time format</a>, in the UTC time zone.</p> <p>If you imported an existing key pair to Amazon EC2, this is the date and time the key was imported, in <a href=\"https://www.iso.org/iso-8601-date-and-time-format.html\">ISO 8601 date-time format</a>, in the UTC time zone.</p>",
+          "locationName":"createTime"
         }
       },
       "documentation":"<p>Describes a key pair.</p>"
diff --git a/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json b/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json
index a484d85b36d..2b1d3336391 100644
--- a/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/guardduty/2017-11-28/service-2.json
@@ -340,7 +340,7 @@
         {"shape":"BadRequestException"},
         {"shape":"InternalServerErrorException"}
       ],
-      "documentation":"<p>Disassociates GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.</p>"
+      "documentation":"<p>Disassociates GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. Member accounts added through <a href=\"https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_invitations.html\">Invitation</a> get deleted from the current GuardDuty administrator account after 30 days of disassociation.</p>"
     },
     "EnableOrganizationAdminAccount":{
       "name":"EnableOrganizationAdminAccount",
@@ -1122,6 +1122,7 @@
         },
         "UserAgent":{
           "shape":"String",
+          "documentation":"<p>The agent through which the API request was made.</p>",
           "locationName":"userAgent"
         },
         "RemoteIpDetails":{
@@ -1468,7 +1469,7 @@
         },
         "FindingCriteria":{
           "shape":"FindingCriteria",
-          "documentation":"<p>Represents the criteria to be used in the filter for querying findings.</p> <p>You can only use the following attributes to query findings:</p> <ul> <li> <p>accountId</p> </li> <li> <p>region</p> </li> <li> <p>confidence</p> </li> <li> <p>id</p> </li> <li> <p>resource.accessKeyDetails.accessKeyId</p> </li> <li> <p>resource.accessKeyDetails.principalId</p> </li> <li> <p>resource.accessKeyDetails.userName</p> </li> <li> <p>resource.accessKeyDetails.userType</p> </li> <li> <p>resource.instanceDetails.iamInstanceProfile.id</p> </li> <li> <p>resource.instanceDetails.imageId</p> </li> <li> <p>resource.instanceDetails.instanceId</p> </li> <li> <p>resource.instanceDetails.outpostArn</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.ipv6Addresses</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.publicDnsName</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.publicIp</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.securityGroups.groupId</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.securityGroups.groupName</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.subnetId</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.vpcId</p> </li> <li> <p>resource.instanceDetails.tags.key</p> </li> <li> <p>resource.instanceDetails.tags.value</p> </li> <li> <p>resource.resourceType</p> </li> <li> <p>service.action.actionType</p> </li> <li> <p>service.action.awsApiCallAction.api</p> </li> <li> <p>service.action.awsApiCallAction.callerType</p> </li> <li> <p>service.action.awsApiCallAction.errorCode</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.city.cityName</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.country.countryName</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.ipAddressV4</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.organization.asn</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg</p> </li> <li> <p>service.action.awsApiCallAction.serviceName</p> </li> <li> <p>service.action.dnsRequestAction.domain</p> </li> <li> <p>service.action.networkConnectionAction.blocked</p> </li> <li> <p>service.action.networkConnectionAction.connectionDirection</p> </li> <li> <p>service.action.networkConnectionAction.localPortDetails.port</p> </li> <li> <p>service.action.networkConnectionAction.protocol</p> </li> <li> <p>service.action.networkConnectionAction.localIpDetails.ipAddressV4</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.city.cityName</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.country.countryName</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.ipAddressV4</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.organization.asn</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg</p> </li> <li> <p>service.action.networkConnectionAction.remotePortDetails.port</p> </li> <li> <p>service.additionalInfo.threatListName</p> </li> <li> <p>resource.s3BucketDetails.publicAccess.effectivePermissions</p> </li> <li> <p>resource.s3BucketDetails.name</p> </li> <li> <p>resource.s3BucketDetails.tags.key</p> </li> <li> <p>resource.s3BucketDetails.tags.value</p> </li> <li> <p>resource.s3BucketDetails.type</p> </li> <li> <p>service.archived</p> <p>When this attribute is set to TRUE, only archived findings are listed. When it's set to FALSE, only unarchived findings are listed. When this attribute is not set, all existing findings are listed.</p> </li> <li> <p>service.resourceRole</p> </li> <li> <p>severity</p> </li> <li> <p>type</p> </li> <li> <p>updatedAt</p> <p>Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.</p> </li> </ul>",
+          "documentation":"<p>Represents the criteria to be used in the filter for querying findings.</p> <p>You can only use the following attributes to query findings:</p> <ul> <li> <p>accountId</p> </li> <li> <p>region</p> </li> <li> <p>confidence</p> </li> <li> <p>id</p> </li> <li> <p>resource.accessKeyDetails.accessKeyId</p> </li> <li> <p>resource.accessKeyDetails.principalId</p> </li> <li> <p>resource.accessKeyDetails.userName</p> </li> <li> <p>resource.accessKeyDetails.userType</p> </li> <li> <p>resource.instanceDetails.iamInstanceProfile.id</p> </li> <li> <p>resource.instanceDetails.imageId</p> </li> <li> <p>resource.instanceDetails.instanceId</p> </li> <li> <p>resource.instanceDetails.outpostArn</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.ipv6Addresses</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.publicDnsName</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.publicIp</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.securityGroups.groupId</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.securityGroups.groupName</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.subnetId</p> </li> <li> <p>resource.instanceDetails.networkInterfaces.vpcId</p> </li> <li> <p>resource.instanceDetails.tags.key</p> </li> <li> <p>resource.instanceDetails.tags.value</p> </li> <li> <p>resource.resourceType</p> </li> <li> <p>service.action.actionType</p> </li> <li> <p>service.action.awsApiCallAction.api</p> </li> <li> <p>service.action.awsApiCallAction.callerType</p> </li> <li> <p>service.action.awsApiCallAction.errorCode</p> </li> <li> <p>service.action.awsApiCallAction.userAgent</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.city.cityName</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.country.countryName</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.ipAddressV4</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.organization.asn</p> </li> <li> <p>service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg</p> </li> <li> <p>service.action.awsApiCallAction.serviceName</p> </li> <li> <p>service.action.dnsRequestAction.domain</p> </li> <li> <p>service.action.networkConnectionAction.blocked</p> </li> <li> <p>service.action.networkConnectionAction.connectionDirection</p> </li> <li> <p>service.action.networkConnectionAction.localPortDetails.port</p> </li> <li> <p>service.action.networkConnectionAction.protocol</p> </li> <li> <p>service.action.networkConnectionAction.localIpDetails.ipAddressV4</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.city.cityName</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.country.countryName</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.ipAddressV4</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.organization.asn</p> </li> <li> <p>service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg</p> </li> <li> <p>service.action.networkConnectionAction.remotePortDetails.port</p> </li> <li> <p>service.additionalInfo.threatListName</p> </li> <li> <p>resource.s3BucketDetails.publicAccess.effectivePermissions</p> </li> <li> <p>resource.s3BucketDetails.name</p> </li> <li> <p>resource.s3BucketDetails.tags.key</p> </li> <li> <p>resource.s3BucketDetails.tags.value</p> </li> <li> <p>resource.s3BucketDetails.type</p> </li> <li> <p>service.archived</p> <p>When this attribute is set to TRUE, only archived findings are listed. When it's set to FALSE, only unarchived findings are listed. When this attribute is not set, all existing findings are listed.</p> </li> <li> <p>service.resourceRole</p> </li> <li> <p>severity</p> </li> <li> <p>type</p> </li> <li> <p>updatedAt</p> <p>Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.</p> </li> </ul>",
           "locationName":"findingCriteria"
         },
         "ClientToken":{
diff --git a/contrib/python/botocore/py3/botocore/data/network-firewall/2020-11-12/service-2.json b/contrib/python/botocore/py3/botocore/data/network-firewall/2020-11-12/service-2.json
index 97491e0f006..c5d47550571 100644
--- a/contrib/python/botocore/py3/botocore/data/network-firewall/2020-11-12/service-2.json
+++ b/contrib/python/botocore/py3/botocore/data/network-firewall/2020-11-12/service-2.json
@@ -868,6 +868,10 @@
         "EncryptionConfiguration":{
           "shape":"EncryptionConfiguration",
           "documentation":"<p>A complex type that contains settings for encryption of your rule group resources.</p>"
+        },
+        "SourceMetadata":{
+          "shape":"SourceMetadata",
+          "documentation":"<p>A complex type that contains metadata about the rule group that your own rule group is copied from. You can use the metadata to keep track of updates made to the originating rule group.</p>"
         }
       }
     },
@@ -1145,7 +1149,11 @@
           "shape":"RuleCapacity",
           "documentation":"<p>The maximum operating resources that this rule group can use. Rule group capacity is fixed at creation. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group. </p> <p>You can retrieve the capacity that would be required for a rule group before you create the rule group by calling <a>CreateRuleGroup</a> with <code>DryRun</code> set to <code>TRUE</code>. </p>"
         },
-        "StatefulRuleOptions":{"shape":"StatefulRuleOptions"}
+        "StatefulRuleOptions":{"shape":"StatefulRuleOptions"},
+        "LastModifiedTime":{
+          "shape":"LastUpdateTime",
+          "documentation":"<p>The last time that the rule group was changed.</p>"
+        }
       }
     },
     "DescribeRuleGroupRequest":{
@@ -1265,6 +1273,7 @@
     },
     "EncryptionConfiguration":{
       "type":"structure",
+      "required":["Type"],
       "members":{
         "KeyId":{
           "shape":"KeyId",
@@ -1463,6 +1472,10 @@
         "EncryptionConfiguration":{
           "shape":"EncryptionConfiguration",
           "documentation":"<p>A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy.</p>"
+        },
+        "LastModifiedTime":{
+          "shape":"LastUpdateTime",
+          "documentation":"<p>The last time that the firewall policy was changed.</p>"
         }
       },
       "documentation":"<p>The high-level properties of a firewall policy. This, along with the <a>FirewallPolicy</a>, define the policy. You can retrieve all objects for a firewall policy by calling <a>DescribeFirewallPolicy</a>. </p>"
@@ -1640,6 +1653,7 @@
       "min":1,
       "pattern":".*"
     },
+    "LastUpdateTime":{"type":"timestamp"},
     "LimitExceededException":{
       "type":"structure",
       "members":{
@@ -1718,6 +1732,14 @@
         "Scope":{
           "shape":"ResourceManagedStatus",
           "documentation":"<p>The scope of the request. The default setting of <code>ACCOUNT</code> or a setting of <code>NULL</code> returns all of the rule groups in your account. A setting of <code>MANAGED</code> returns all available managed rule groups.</p>"
+        },
+        "ManagedType":{
+          "shape":"ResourceManagedType",
+          "documentation":"<p>Indicates the general category of the Amazon Web Services managed rule group.</p>"
+        },
+        "Type":{
+          "shape":"RuleGroupType",
+          "documentation":"<p>Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.</p>"
         }
       }
     },
@@ -2021,6 +2043,13 @@
         "ACCOUNT"
       ]
     },
+    "ResourceManagedType":{
+      "type":"string",
+      "enum":[
+        "AWS_MANAGED_THREAT_SIGNATURES",
+        "AWS_MANAGED_DOMAIN_LISTS"
+      ]
+    },
     "ResourceName":{
       "type":"string",
       "max":128,
@@ -2153,6 +2182,18 @@
         "EncryptionConfiguration":{
           "shape":"EncryptionConfiguration",
           "documentation":"<p>A complex type that contains the Amazon Web Services KMS encryption configuration settings for your rule group.</p>"
+        },
+        "SourceMetadata":{
+          "shape":"SourceMetadata",
+          "documentation":"<p>A complex type that contains metadata about the rule group that your own rule group is copied from. You can use the metadata to track the version updates made to the originating rule group.</p>"
+        },
+        "SnsTopic":{
+          "shape":"ResourceArn",
+          "documentation":"<p>The Amazon resource name (ARN) of the Amazon Simple Notification Service SNS topic that's used to record changes to the managed rule group. You can subscribe to the SNS topic to receive notifications when the managed rule group is modified, such as for new versions and for version expiration. For more information, see the <a href=\"https://docs.aws.amazon.com/sns/latest/dg/welcome.html\">Amazon Simple Notification Service Developer Guide.</a>.</p>"
+        },
+        "LastModifiedTime":{
+          "shape":"LastUpdateTime",
+          "documentation":"<p>The last time that the rule group was changed.</p>"
         }
       },
       "documentation":"<p>The high-level properties of a rule group. This, along with the <a>RuleGroup</a>, define the rule group. You can retrieve all objects for a rule group by calling <a>DescribeRuleGroup</a>. </p>"
@@ -2284,6 +2325,20 @@
       "min":1,
       "pattern":"^.*$"
     },
+    "SourceMetadata":{
+      "type":"structure",
+      "members":{
+        "SourceArn":{
+          "shape":"ResourceArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the rule group that your own rule group is copied from.</p>"
+        },
+        "SourceUpdateToken":{
+          "shape":"UpdateToken",
+          "documentation":"<p>The update token of the Amazon Web Services managed rule group that your own rule group is copied from. To determine the update token for the managed rule group, call <a href=\"https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeRuleGroup.html#networkfirewall-DescribeRuleGroup-response-UpdateToken\">DescribeRuleGroup</a>.</p>"
+        }
+      },
+      "documentation":"<p>High-level information about the managed rule group that your own rule group is copied from. You can use the the metadata to track version updates made to the originating rule group. You can retrieve all objects for a rule group by calling <a href=\"https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeRuleGroup.html\">DescribeRuleGroup</a>.</p>"
+    },
     "StatefulAction":{
       "type":"string",
       "enum":[
@@ -2948,6 +3003,10 @@
         "EncryptionConfiguration":{
           "shape":"EncryptionConfiguration",
           "documentation":"<p>A complex type that contains settings for encryption of your rule group resources.</p>"
+        },
+        "SourceMetadata":{
+          "shape":"SourceMetadata",
+          "documentation":"<p>A complex type that contains metadata about the rule group that your own rule group is copied from. You can use the metadata to keep track of updates made to the originating rule group.</p>"
         }
       }
     },