diff --git a/docs/bash_completion.sh b/docs/bash_completion.sh
index fb34d7c2..5027aa55 100644
--- a/docs/bash_completion.sh
+++ b/docs/bash_completion.sh
@@ -1136,6 +1136,12 @@ _rain_forecast()
     two_word_flags+=("--params")
     local_nonpersistent_flags+=("--params")
     local_nonpersistent_flags+=("--params=")
+    flags+=("--plugin=")
+    two_word_flags+=("--plugin")
+    local_nonpersistent_flags+=("--plugin")
+    local_nonpersistent_flags+=("--plugin=")
+    flags+=("--plugin-only")
+    local_nonpersistent_flags+=("--plugin-only")
     flags+=("--profile=")
     two_word_flags+=("--profile")
     two_word_flags+=("-p")
@@ -1363,6 +1369,10 @@ _rain_merge()
     flags+=("-h")
     local_nonpersistent_flags+=("--help")
     local_nonpersistent_flags+=("-h")
+    flags+=("--node-style=")
+    two_word_flags+=("--node-style")
+    local_nonpersistent_flags+=("--node-style")
+    local_nonpersistent_flags+=("--node-style=")
     flags+=("--output=")
     two_word_flags+=("--output")
     two_word_flags+=("-o")
diff --git a/docs/index.md b/docs/index.md
index 8fa40431..ed82966d 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -36,4 +36,4 @@ Rain is a command line tool for working with AWS CloudFormation templates and st
 * [rain tree](rain_tree.md)	 - Find dependencies of Resources and Outputs in a local template
 * [rain watch](rain_watch.md)	 - Display an updating view of a CloudFormation stack
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_bootstrap.md b/docs/rain_bootstrap.md
index 2c7a1755..dee4cb97 100644
--- a/docs/rain_bootstrap.md
+++ b/docs/rain_bootstrap.md
@@ -30,4 +30,4 @@ rain bootstrap
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_build.md b/docs/rain_build.md
index 5fd94a7f..50929baa 100644
--- a/docs/rain_build.md
+++ b/docs/rain_build.md
@@ -41,4 +41,4 @@ rain build [<resource type>] or <prompt>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_cat.md b/docs/rain_cat.md
index 82dad16c..08c437aa 100644
--- a/docs/rain_cat.md
+++ b/docs/rain_cat.md
@@ -35,4 +35,4 @@ rain cat <stack>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_cc.md b/docs/rain_cc.md
index 19201c66..3d1ff904 100644
--- a/docs/rain_cc.md
+++ b/docs/rain_cc.md
@@ -32,4 +32,4 @@ You must pass the --experimental (-x) flag to use this command, to acknowledge t
 * [rain cc rm](rain_cc_rm.md)	 - Delete a deployment created by cc deploy (Experimental!)
 * [rain cc state](rain_cc_state.md)	 - Download the state file for a template deployed with cc deploy
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_cc_deploy.md b/docs/rain_cc_deploy.md
index db9afab7..a4b5bdc4 100644
--- a/docs/rain_cc_deploy.md
+++ b/docs/rain_cc_deploy.md
@@ -40,4 +40,4 @@ rain cc deploy <template> <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_cc_drift.md b/docs/rain_cc_drift.md
index 956c2a06..903ba27e 100644
--- a/docs/rain_cc_drift.md
+++ b/docs/rain_cc_drift.md
@@ -33,4 +33,4 @@ rain cc drift <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_cc_rm.md b/docs/rain_cc_rm.md
index 9d6445f6..eef7043e 100644
--- a/docs/rain_cc_rm.md
+++ b/docs/rain_cc_rm.md
@@ -33,4 +33,4 @@ rain cc rm <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_cc_state.md b/docs/rain_cc_state.md
index 63828777..f253fafa 100644
--- a/docs/rain_cc_state.md
+++ b/docs/rain_cc_state.md
@@ -33,4 +33,4 @@ rain cc state <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_console.md b/docs/rain_console.md
index 1fc1113c..2f828418 100644
--- a/docs/rain_console.md
+++ b/docs/rain_console.md
@@ -39,4 +39,4 @@ rain console [stack]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_deploy.md b/docs/rain_deploy.md
index 497e85df..69490144 100644
--- a/docs/rain_deploy.md
+++ b/docs/rain_deploy.md
@@ -85,4 +85,4 @@ rain deploy <template> [stack]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_diff.md b/docs/rain_diff.md
index c5ea4435..b06c7d82 100644
--- a/docs/rain_diff.md
+++ b/docs/rain_diff.md
@@ -28,4 +28,4 @@ rain diff <from> <to>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_fmt.md b/docs/rain_fmt.md
index e11915e0..f0ba7b02 100644
--- a/docs/rain_fmt.md
+++ b/docs/rain_fmt.md
@@ -37,4 +37,4 @@ rain fmt <filename>...
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_forecast.md b/docs/rain_forecast.md
index 789fb7d3..33e2da4c 100644
--- a/docs/rain_forecast.md
+++ b/docs/rain_forecast.md
@@ -36,6 +36,8 @@ rain forecast --experimental <template> [stackName]
       --ignore strings    Resource types and specific codes to ignore, separated by commas, for example, AWS::S3::Bucket,F0002
       --include-iam       Include permissions checks, which can take a long time
       --params strings    set parameter values; use the format key1=value1,key2=value2
+      --plugin string     Path to a forecast plugin .so
+      --plugin-only       If set, none of the built in prediction functions will be run
   -p, --profile string    AWS profile name; read from the AWS CLI configuration file
   -r, --region string     AWS region to use
       --role-arn string   An optional execution role arn to use for predicting IAM failures
@@ -53,4 +55,4 @@ rain forecast --experimental <template> [stackName]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_info.md b/docs/rain_info.md
index 4aa1fbb3..00ab420a 100644
--- a/docs/rain_info.md
+++ b/docs/rain_info.md
@@ -30,4 +30,4 @@ rain info
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_logs.md b/docs/rain_logs.md
index 30f76a99..e9a72f72 100644
--- a/docs/rain_logs.md
+++ b/docs/rain_logs.md
@@ -37,4 +37,4 @@ rain logs <stack> (<resource>)
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_ls.md b/docs/rain_ls.md
index d8a52051..1b506fe3 100644
--- a/docs/rain_ls.md
+++ b/docs/rain_ls.md
@@ -31,4 +31,4 @@ rain ls <stack> [changeset]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_merge.md b/docs/rain_merge.md
index 4ff79af6..3e380e46 100644
--- a/docs/rain_merge.md
+++ b/docs/rain_merge.md
@@ -13,9 +13,10 @@ rain merge <template> <template> ...
 ### Options
 
 ```
-  -f, --force           Don't warn on clashing attributes; rename them instead. Note: this will not rename Refs, GetAtts, etc.
-  -h, --help            help for merge
-  -o, --output string   Output merged template to a file
+  -f, --force               Don't warn on clashing attributes; rename them instead. Note: this will not rename Refs, GetAtts, etc.
+  -h, --help                help for merge
+      --node-style string   Set the node output style to tagged, doublequoted, singlequoted, literal, folded, quotescalars, original, or flow
+  -o, --output string       Output merged template to a file
 ```
 
 ### Options inherited from parent commands
@@ -29,4 +30,4 @@ rain merge <template> <template> ...
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_module.md b/docs/rain_module.md
index 80cdb5f7..59792b90 100644
--- a/docs/rain_module.md
+++ b/docs/rain_module.md
@@ -31,4 +31,4 @@ The rain module command can be used to publish modules to CodeArtifact, and to i
 * [rain module install](rain_module_install.md)	 - Install a package of Rain modules from CodeArtifact
 * [rain module publish](rain_module_publish.md)	 - Publish a directory of Rain modules to CodeArtifact
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_module_bootstrap.md b/docs/rain_module_bootstrap.md
index a52e1a42..9b0806d2 100644
--- a/docs/rain_module_bootstrap.md
+++ b/docs/rain_module_bootstrap.md
@@ -29,4 +29,4 @@ rain module bootstrap [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_module_install.md b/docs/rain_module_install.md
index 4b5a0c25..6dbd84f0 100644
--- a/docs/rain_module_install.md
+++ b/docs/rain_module_install.md
@@ -30,4 +30,4 @@ rain module install <name> [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_module_publish.md b/docs/rain_module_publish.md
index ee6fbd95..42162cab 100644
--- a/docs/rain_module_publish.md
+++ b/docs/rain_module_publish.md
@@ -30,4 +30,4 @@ rain module publish <name> [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_pkg.md b/docs/rain_pkg.md
index 2631f45c..c8140e27 100644
--- a/docs/rain_pkg.md
+++ b/docs/rain_pkg.md
@@ -68,4 +68,4 @@ rain pkg <template>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_rm.md b/docs/rain_rm.md
index b990a7ae..2020fc06 100644
--- a/docs/rain_rm.md
+++ b/docs/rain_rm.md
@@ -33,4 +33,4 @@ rain rm <stack> [changeset]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_stackset.md b/docs/rain_stackset.md
index 02a4d30d..39c45e8a 100644
--- a/docs/rain_stackset.md
+++ b/docs/rain_stackset.md
@@ -28,4 +28,4 @@ This command manipulates stack sets. It has no action if specific stack set comm
 * [rain stackset ls](rain_stackset_ls.md)	 - List a CloudFormation stack sets in a given region
 * [rain stackset rm](rain_stackset_rm.md)	 - Delete a CloudFormation stack set and/or its instances.
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_stackset_deploy.md b/docs/rain_stackset_deploy.md
index bfc2dbac..a7b8d9ac 100644
--- a/docs/rain_stackset_deploy.md
+++ b/docs/rain_stackset_deploy.md
@@ -65,4 +65,4 @@ rain stackset deploy <template> [stackset] [flags]
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_stackset_ls.md b/docs/rain_stackset_ls.md
index 1c92ec00..a1c16df8 100644
--- a/docs/rain_stackset_ls.md
+++ b/docs/rain_stackset_ls.md
@@ -31,4 +31,4 @@ rain stackset ls <stack set>
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_stackset_rm.md b/docs/rain_stackset_rm.md
index 367e6fbf..b0be6d9d 100644
--- a/docs/rain_stackset_rm.md
+++ b/docs/rain_stackset_rm.md
@@ -31,4 +31,4 @@ rain stackset rm <stackset>
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_tree.md b/docs/rain_tree.md
index f5207806..6a0fc722 100644
--- a/docs/rain_tree.md
+++ b/docs/rain_tree.md
@@ -30,4 +30,4 @@ rain tree [template]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/docs/rain_watch.md b/docs/rain_watch.md
index b5c95ece..be1abb52 100644
--- a/docs/rain_watch.md
+++ b/docs/rain_watch.md
@@ -30,4 +30,4 @@ rain watch <stack>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 7-Aug-2024
+###### Auto generated by spf13/cobra on 21-Aug-2024
diff --git a/go.mod b/go.mod
index 59af7318..6ade4123 100644
--- a/go.mod
+++ b/go.mod
@@ -7,15 +7,15 @@ toolchain go1.22.4
 require (
 	//github.com/ake-persson/mapslice-json v0.0.0-20210720081907-22c8edf57807
 	github.com/appscode/jsonpatch v1.0.1
-	github.com/aws/aws-sdk-go-v2 v1.30.3
-	github.com/aws/aws-sdk-go-v2/config v1.27.27
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.27
-	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.0
-	github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.3
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.58.3
-	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3
-	github.com/aws/smithy-go v1.20.3
+	github.com/aws/aws-sdk-go-v2 v1.30.4
+	github.com/aws/aws-sdk-go-v2/config v1.27.28
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.28
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.1
+	github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.4
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.175.1
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.60.0
+	github.com/aws/aws-sdk-go-v2/service/sts v1.30.4
+	github.com/aws/smithy-go v1.20.4
 	github.com/chzyer/readline v1.5.1
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
@@ -23,21 +23,21 @@ require (
 	github.com/nathan-fiscaletti/consolesize-go v0.0.0-20220204101620-317176b6684d
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
-	golang.org/x/sys v0.23.0
+	golang.org/x/sys v0.24.0
 	golang.org/x/term v0.23.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	github.com/apple/pkl-go v0.8.0
-	github.com/aws/aws-sdk-go-v2/service/acm v1.28.4
-	github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.3
-	github.com/aws/aws-sdk-go-v2/service/kms v1.35.3
-	github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.3
-	github.com/aws/aws-sdk-go-v2/service/rds v1.82.0
-	github.com/aws/aws-sdk-go-v2/service/sagemaker v1.152.0
-	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.3
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.52.3
+	github.com/aws/aws-sdk-go-v2/service/acm v1.28.5
+	github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.4
+	github.com/aws/aws-sdk-go-v2/service/kms v1.35.4
+	github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.4
+	github.com/aws/aws-sdk-go-v2/service/rds v1.82.1
+	github.com/aws/aws-sdk-go-v2/service/sagemaker v1.154.0
+	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.4
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.52.5
 	github.com/fatih/color v1.17.0
 	github.com/manifoldco/promptui v0.9.0
 	github.com/mattn/go-runewidth v0.0.15
@@ -45,8 +45,8 @@ require (
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -57,23 +57,23 @@ require (
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.3 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.20.3
-	github.com/aws/aws-sdk-go-v2/service/iam v1.34.3
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.16 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.20.4
+	github.com/aws/aws-sdk-go-v2/service/iam v1.35.0
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.22.5 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
+	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa
 	gopkg.in/yaml.v2 v2.4.0
 )
diff --git a/go.sum b/go.sum
index 04022a92..8a4679e0 100644
--- a/go.sum
+++ b/go.sum
@@ -12,10 +12,14 @@ github.com/aws/aws-sdk-go-v2 v1.30.0 h1:6qAwtzlfcTtcL8NHtbDQAqgM5s6NDipQTkPxyH/6
 github.com/aws/aws-sdk-go-v2 v1.30.0/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
 github.com/aws/aws-sdk-go-v2 v1.30.3 h1:jUeBtG0Ih+ZIFH0F4UkmL9w3cSpaMv9tYYDbzILP8dY=
 github.com/aws/aws-sdk-go-v2 v1.30.3/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
+github.com/aws/aws-sdk-go-v2 v1.30.4 h1:frhcagrVNrzmT95RJImMHgabt99vkXGslubDaDagTk8=
+github.com/aws/aws-sdk-go-v2 v1.30.4/go.mod h1:CT+ZPWXbYrci8chcARI3OmI/qgd+f6WtuLOoaIA8PR0=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 h1:x6xsQXGSmW6frevwDA+vi/wqhp1ct18mVXYN08/93to=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2/go.mod h1:lPprDr1e6cJdyYeGXnRaJoP4Md+cDBvi2eOj00BlGmg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.3 h1:tW1/Rkad38LA15X4UQtjXZXNKsCgkshC3EbmcUmghTg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.3/go.mod h1:UbnqO+zjqk3uIt9yCACHJ9IVNhyhOCnYk8yA19SAWrM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.4 h1:70PVAiL15/aBMh5LThwgXdSQorVr91L127ttckI9QQU=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.4/go.mod h1:/MQxMqci8tlqDH+pjmoLu1i0tbWCUP1hhyMRuFxpQCw=
 github.com/aws/aws-sdk-go-v2/config v1.27.17 h1:L0JZN7Gh7pT6u5CJReKsLhGKparqNKui+mcpxMXjDZc=
 github.com/aws/aws-sdk-go-v2/config v1.27.17/go.mod h1:MzM3balLZeaafYcPz8IihAmam/aCz6niPQI0FdprxW0=
 github.com/aws/aws-sdk-go-v2/config v1.27.21 h1:yPX3pjGCe2hJsetlmGNB4Mngu7UPmvWPzzWCv1+boeM=
@@ -24,6 +28,8 @@ github.com/aws/aws-sdk-go-v2/config v1.27.26 h1:T1kAefbKuNum/AbShMsZEro6eRkeOT8Y
 github.com/aws/aws-sdk-go-v2/config v1.27.26/go.mod h1:ivWHkAWFrw/nxty5Fku7soTIVdqZaZ7dw+tc5iGW3GA=
 github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
 github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
+github.com/aws/aws-sdk-go-v2/config v1.27.28 h1:OTxWGW/91C61QlneCtnD62NLb4W616/NM1jA8LhJqbg=
+github.com/aws/aws-sdk-go-v2/config v1.27.28/go.mod h1:uzVRVtJSU5EFv6Fu82AoVFKozJi2ZCY6WRCXj06rbvs=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.17 h1:b3Dk9uxQByS9sc6r0sc2jmxsJKO75eOcb9nNEiaUBLM=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.17/go.mod h1:e4khg9iY08LnFK/HXQDWMf9GDaiMari7jWPnXvKAuBU=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.21 h1:pjAqgzfgFhTv5grc7xPHtXCAaMapzmwA7aU+c/SZQGw=
@@ -32,38 +38,52 @@ github.com/aws/aws-sdk-go-v2/credentials v1.17.26 h1:tsm8g/nJxi8+/7XyJJcP2dLrnK/
 github.com/aws/aws-sdk-go-v2/credentials v1.17.26/go.mod h1:3vAM49zkIa3q8WT6o9Ve5Z0vdByDMwmdScO0zvThTgI=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.28 h1:m8+AHY/ND8CMHJnPoH7PJIRakWGa4gbfbxuY9TGTUXM=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.28/go.mod h1:6TF7dSc78ehD1SL6KpRIPKMA1GyyWflIkjqg+qmf4+c=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4 h1:0cSfTYYL9qiRcdi4Dvz+8s3JUgNR2qvbgZkXcwPEEEk=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4/go.mod h1:Wjn5O9eS7uSi7vlPKt/v0MLTncANn9EMmoDvnzJli6o=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 h1:FR+oWPFb/8qMVYMWN98bUZAGqPvLHiyqg1wqQGfUAXY=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8/go.mod h1:EgSKcHiuuakEIxJcKGzVNWh5srVAQ3jKaSrBGRYvM48=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 h1:KreluoV8FZDEtI6Co2xuNk/UqI9iwMrOx/87PBNIKqw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11/go.mod h1:SeSUYBLsMYFoRvHE0Tjvn7kbxaUhl75CJi1sbfhMxkU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12 h1:yjwoSyDZF8Jth+mUk5lSPJCkMC0lMy6FaCD51jm6ayE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12/go.mod h1:fuR57fAgMk7ot3WcNQfb6rSEn+SUffl7ri+aa8uKysI=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8 h1:RnLB7p6aaFMRfyQkD6ckxR7myCC9SABIqSz4czYUUbU=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8/go.mod h1:XH7dQJd+56wEbP1I4e4Duo+QhSMxNArE8VP7NuUOTeM=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12 h1:SJ04WXGTwnHlWIODtC5kJzKbeuHt+OUNOgKg7nfnUGw=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12/go.mod h1:FkpvXhA92gb3GE9LD6Og0pHHycTxW7xGpnEh5E7Opwo=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 h1:SoNJ4RlFEQEbtDcCEt+QG56MY4fm4W8rYirAmq+/DdU=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15/go.mod h1:U9ke74k1n2bf+RIgoX1SXFed1HLs51OgUSs+Ph0KJP8=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16 h1:TNyt/+X43KJ9IJJMjKfa3bNTiZbUP7DeCxfbTROESwY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16/go.mod h1:2DwJF39FlNAUiX5pAc0UNeiz16lK2t7IaFcm0LFHEgc=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8 h1:jzApk2f58L9yW9q1GEab3BMMFWUkkiZhyrRUtbwUbKU=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8/go.mod h1:WqO+FftfO3tGePUtQxPXM6iODVfqMwsVMgTbG/ZXIdQ=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12 h1:hb5KgeYfObi5MHkSSZMEudnIvX30iB+E21evI4r6BnQ=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12/go.mod h1:CroKe/eWJdyfy9Vx4rljP5wTUjNJfb+fPz1uMYUhEGM=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 h1:C6WHdGnTDIYETAm5iErQUiVNsclNx9qbJVPIt03B6bI=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15/go.mod h1:ZQLZqhcu+JhSrA9/NXRm8SkDvsycE+JkV3WGY41e+IM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.16 h1:jYfy8UPmd+6kJW5YhY0L1/KftReOGxI/4NtVSTh9O/I=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.16/go.mod h1:7ZfEPZxkW42Afq4uQB8H2E2e6ebh6mXTueEpYzjCzcs=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.8 h1:jH33S0y5Bo5ZVML62JgZhjd/LrtU+vbR8W7XnIE3Srk=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.8/go.mod h1:hD5YwHLOy6k7d6kqcn3me1bFWHOtzhaXstMd6BpdB68=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.12 h1:DXFWyt7ymx/l1ygdyTTS0X923e+Q2wXIxConJzrgwc0=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.12/go.mod h1:mVOr/LbvaNySK1/BTy4cBOCjhCNY2raWBwK4v+WR5J4=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.15 h1:Z5r7SycxmSllHYmaAZPpmN8GviDrSGhMS6bldqtXZPw=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.15/go.mod h1:CetW7bDE00QoGEmPUoZuRog07SGVAUVW6LFpNP0YfIg=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.16 h1:mimdLQkIX1zr8GIPY1ZtALdBQGxcASiBd2MOp8m/dMc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.16/go.mod h1:YHk6owoSwrIsok+cAH9PENCOGoH5PU2EllX4vLtSrsY=
 github.com/aws/aws-sdk-go-v2/service/acm v1.26.1 h1:W4o6dIMmPWjl55ZE2ycdBvE1Q/KOLFqCzVNHeLTyrlM=
 github.com/aws/aws-sdk-go-v2/service/acm v1.26.1/go.mod h1:89Ze+u79IkUA44zjubmbg1HDPSGp1SI1JuuUUiJOzAU=
 github.com/aws/aws-sdk-go-v2/service/acm v1.27.1 h1:EMnuoQ/WR4/VNE8QmFrXq4u0BZH2Xhc9Yr41xZlths0=
 github.com/aws/aws-sdk-go-v2/service/acm v1.27.1/go.mod h1:wHw2SsqkXuys0SArqz+Rb7LGvujWSnlPByxCm6q7kus=
 github.com/aws/aws-sdk-go-v2/service/acm v1.28.4 h1:wiW1Y6/1lysA0eJZRq0I53YYKuV9MNAzL15z2eZRlEE=
 github.com/aws/aws-sdk-go-v2/service/acm v1.28.4/go.mod h1:bzjymHHRhexkSMIvUHMpKydo9U82bmqQ5ru0IzYM8m8=
+github.com/aws/aws-sdk-go-v2/service/acm v1.28.5 h1:yJriRQs3d0ZI59mAyCdCyM/l/oJ9wnWbDhADZlbfoYs=
+github.com/aws/aws-sdk-go-v2/service/acm v1.28.5/go.mod h1:AI/FWryd1egUbYqCtEexDQqp9KTU9wr6uMYMhI5k/C0=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.9.1 h1:8Ct21/s9kXoryJD2WwDgRc1G4sCELVYNl0/DK6QZnYM=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.9.1/go.mod h1:rvgvxI+uusKEiUNDcASdNpmfhKlYtReLKmYM0VjFIYM=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.10.1 h1:IvYkZ/7XXbEaTGCL3XA5YcZ97ts0iZMkyah0XaKj5Zo=
@@ -72,24 +92,32 @@ github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.14.0 h1:vmR922WiF3BuOG+4h
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.14.0/go.mod h1:G/STzijpkhEbwc7qAYGfTw4AxHJQWfX8PsV1RsCNQbM=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.0 h1:wQd0mjGuP3ihFXyxfSaQOl3S/F+aT85fvX1cYQpbInw=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.0/go.mod h1:G/STzijpkhEbwc7qAYGfTw4AxHJQWfX8PsV1RsCNQbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.1 h1:Xb5d44UWp+oHJMu6Aza2RG0iSDcOCc2L5fTh2wq80OE=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.1/go.mod h1:uI45a6i3xUAkx/xFegQ1SNnClz9OrfOixs96ZH4rca8=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9 h1:Wp1QFv8uyNpwPXSI/a6TRkIR0CiT+Fa60s5vVTsFdXM=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9/go.mod h1:pFrHzOZRN/EfWL7ygk9ELdQHqRGERgOgP03OLIOlQV4=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.19.1 h1:xje03QCAf/8b1Ntsx/QR4oTn0tMIshVT/OUAilcwcO0=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.19.1/go.mod h1:4hiczFeqZEQy8yX5/uY1rgXKnOXam6GAoWZrFEfoyMY=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.20.3 h1:QdoWu2A7sOU7g38Uj1dH9rCvJcINiAV7B/exER1AOKo=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.20.3/go.mod h1:AOsjRDzfgBXF2xsVqwoirlk69ZzSzZIiZdxMyqTih6k=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.20.4 h1:DXrXltI9XfD8ND/MZSfKJQ3et4f/4FBKn6Hv5frCeJ4=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.20.4/go.mod h1:r6W6g2+YsfTBfuvxRLvCf6xxlQRSoNTdRDGFX7noKu0=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.51.2 h1:FBc+xcfqpBzYl6WWIBk3AB9d/oc6r2sn/mYPnuORCFI=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.51.2/go.mod h1:qadtdULA3L3WyTz7ybmu46Motr8ckS+zGZS+4oXLxH0=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.52.1 h1:Ts+mCjOtt8o2k2vnWnX/0sE0eSmEVWBvfJkNrNMQlAo=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.52.1/go.mod h1:IrWhabzdTEc651GAq7rgst/SYcEqqcD7Avr82m28AAU=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.3 h1:mIpL+FXa+2U6oc85b/15JwJhNUU+c/LHwxM3hpQIxXQ=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.3/go.mod h1:lcQ7+K0Q9x0ozhjBwDfBkuY8qexSP/QXLgp0jj+/NZg=
+github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.4 h1:QbMAN9s6cmAxQMTAbLmHj0a5mhwoZTL0eo91UaYLG4E=
+github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.4/go.mod h1:y45SdA9v+dLlweaqwAQMoFeXqdRvgwevafa2X8iTqZQ=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.27.5 h1:vrPOyJJ4Ph445jYq+1jFEpgmZhwHe9WX2V4OylzOV9M=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.27.5/go.mod h1:Jk7hUaInLPjpZc1NzwB0gNYghUJLm9AvwfKuAsGq4A0=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.28.1 h1:1OfXVziIGFVm5FHvDkWogdHUkXlZZwqe/0LCbxnmfYA=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.28.1/go.mod h1:XKoFW8gDY8bULuq8+sKHrMqsbnVi9MTkeJmf69ZxoLk=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.3 h1:9eAjfGKFWduKyCR94Qi/JfORoJLndGydph2dcLtM7gI=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.3/go.mod h1:AdirH4VV5v1ik2pOOU0WdEdojBBgzTdECBrOQl0ojOc=
+github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.4 h1:zqbJalPHJqn9NBns+i9eHUpt5OERttgDrzAoAsQqE04=
+github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.4/go.mod h1:oYja70TBh+q04+TN5OB8yj7Y9/k65xa3VxliP4ag3e4=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.163.0 h1:gwthjSMr5tW2fYBJNt3LQGgtkREvv5IcuaWRjeo1fh0=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.163.0/go.mod h1:eu3DWRK5GBq4hjCr7nAbnQiHSan5RJ6ue3qQVp5PJs0=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.165.1 h1:LkSnU1c9JKJyXYcwpWgQGuwctwv3pDenMUgH2CmLd1A=
@@ -98,46 +126,62 @@ github.com/aws/aws-sdk-go-v2/service/ec2 v1.170.0 h1:zPwhEYn3Y83mnnr9QG+i6NTiAbV
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.170.0/go.mod h1:9KdiRVKTZyPRTlbX3i41FxTV+5OatZ7xOJCN4lleX7g=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0 h1:ta62lid9JkIpKZtZZXSj6rP2AqY5x1qYGq53ffxqD9Q=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0/go.mod h1:o6QDjdVKpP5EF0dp/VlvqckzuSDATr1rLdHt3A5m0YY=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.175.1 h1:7B5ppg4i5N2B6t+aH77WLbAu8sD98MLlzruWzq5scyY=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.175.1/go.mod h1:ISODge3zgdwOEa4Ou6WM9PKbxJWJ15DYKnr2bfmCAIA=
 github.com/aws/aws-sdk-go-v2/service/iam v1.32.5 h1:G2judWqHbm2bDrmJPj9W0nD3Pv8+WzhY+fAAEQMpLf4=
 github.com/aws/aws-sdk-go-v2/service/iam v1.32.5/go.mod h1:RorjhuicJ7tEwun17BEeD//1JiPdvxPv15KOa9BKxS8=
 github.com/aws/aws-sdk-go-v2/service/iam v1.33.1 h1:0dcMo3330L9LIckl+4iujMoq0AdR8LMK0TtgrjHUi6M=
 github.com/aws/aws-sdk-go-v2/service/iam v1.33.1/go.mod h1:sX/naR5tYtlGFN0Bjg9VPNgYNg/rqiDUuKTW9peFnZk=
 github.com/aws/aws-sdk-go-v2/service/iam v1.34.3 h1:p4L/tixJ3JUIxCteMGT6oMlqCbEv/EzSZoVwdiib8sU=
 github.com/aws/aws-sdk-go-v2/service/iam v1.34.3/go.mod h1:rfOWxxwdecWvSC9C2/8K/foW3Blf+aKnIIPP9kQ2DPE=
+github.com/aws/aws-sdk-go-v2/service/iam v1.35.0 h1:xIjTizH74aMNQBjp9D5cvjRZmOYtnrpjOGU3xkVqrjk=
+github.com/aws/aws-sdk-go-v2/service/iam v1.35.0/go.mod h1:IdHqqRLKgxYR4IY7Omd7SuV4SJzJ8seF+U5PW+mvtP4=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 h1:dT3MqvGhSoaIhRseqw2I0yH81l7wiR2vjs57O51EAm8=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4 h1:KypMCbLPPHEmf9DgMGw51jMj77VfGPAN2Kv4cfhlfgI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4/go.mod h1:Vz1JQXliGcQktFTN/LN6uGppAIRoLBR2bMvIMP0gOjc=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.10 h1:pkYC5zTOSPXEYJj56b2SOik9AL432i5MT1YVTQbKOK0=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.10/go.mod h1:/WNsBOlKWZCG3PMh2aSp8vkyyT/clpMZqOtrnIKqGfk=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.14 h1:oWccitSnByVU74rQRHac4gLfDqjB6Z1YQGOY/dXKedI=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.14/go.mod h1:8SaZBlQdCLrc/2U3CEO48rYj9uR8qRsPRkmzwNM52pM=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.17 h1:YPYe6ZmvUfDDDELqEKtAd6bo8zxhkm+XEFEzQisqUIE=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.17/go.mod h1:oBtcnYua/CgzCWYN7NZ5j7PotFDaFSUjCYVTtfyn7vw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.18 h1:GckUnpm4EJOAio1c8o25a+b3lVfwVzC9gnSBqiiNmZM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.18/go.mod h1:Br6+bxfG33Dk3ynmkhsW2Z/t9D4+lRqdLDNCKi85w0U=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10 h1:7kZqP7akv0enu6ykJhb9OYlw16oOrSy+Epus8o/VqMY=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10/go.mod h1:gYVF3nM1ApfTRDj9pvdhootBb8WbiIejuqn4w8ruMes=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14 h1:zSDPny/pVnkqABXYRicYuPf9z2bTqfH13HT3v6UheIk=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14/go.mod h1:3TTcI5JSzda1nw/pkVC9dhgLre0SNBFj2lYS4GctXKI=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 h1:HGErhhrxZlQ044RiM+WdoZxp0p+EGM62y3L6pwA4olE=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17/go.mod h1:RkZEx4l0EHYDJpWppMJ3nD9wZJAa8/0lq9aVC+r2UII=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.18 h1:tJ5RnkHCiSH0jyd6gROjlJtNwov0eGYNz8s8nFcR0jQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.18/go.mod h1:++NHzT+nAF7ZPrHPsA+ENvsXkOO8wEu+C6RXltAG4/c=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.8 h1:iQNXVs1vtaq+y9M90M4ZIVNORje0qXTscqHLqoOnFS0=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.8/go.mod h1:yUQPRlWqGG0lfNsmjbRWKVwgilfBtZTOFSLEYALlAig=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.12 h1:tzha+v1SCEBpXWEuw6B/+jm4h5z8hZbTpXz0zRZqTnw=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.12/go.mod h1:n+nt2qjHGoseWeLHt1vEr6ZRCCxIN2KcNpJxBcYQSwI=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.15 h1:246A4lSTXWJw/rmlQI+TT2OcqeDMKBdyjEQrafMaQdA=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.15/go.mod h1:haVfg3761/WF7YPuJOER2MP0k4UAXyHaLclKXB6usDg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.16 h1:jg16PhLPUiHIj8zYIW6bqzeQSuHVEiWnGA0Brz5Xv2I=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.16/go.mod h1:Uyk1zE1VVdsHSU7096h/rwnXDzOzYQVl+FNPhPw7ShY=
 github.com/aws/aws-sdk-go-v2/service/kms v1.32.2 h1:WuwRxTSPc+E4dwDRmxh4TILJsnYoqm41KTb11pRkzBA=
 github.com/aws/aws-sdk-go-v2/service/kms v1.32.2/go.mod h1:qEy625xFxrw6hA+eOAD030wmLERPa7LNCArh+gAC+8o=
 github.com/aws/aws-sdk-go-v2/service/kms v1.34.1 h1:VsKBn6WADI3Nn3WjBMzeRww9WHXeVLi7zyuSrqjRCBQ=
 github.com/aws/aws-sdk-go-v2/service/kms v1.34.1/go.mod h1:5F6kXrPBxv0l1t8EO44GuG4W82jGJwaRE0B+suEGnNY=
 github.com/aws/aws-sdk-go-v2/service/kms v1.35.3 h1:UPTdlTOwWUX49fVi7cymEN6hDqCwe3LNv1vi7TXUutk=
 github.com/aws/aws-sdk-go-v2/service/kms v1.35.3/go.mod h1:gjDP16zn+WWalyaUqwCCioQ8gU8lzttCCc9jYsiQI/8=
+github.com/aws/aws-sdk-go-v2/service/kms v1.35.4 h1:mG1MH6yPwT5gNEeBrhig3FHc4mK0QaZOXsmQUbphP6Y=
+github.com/aws/aws-sdk-go-v2/service/kms v1.35.4/go.mod h1:A5CS0VRmxxj2YKYLCY08l/Zzbd01m6JZn0WzxgT1OCA=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.38.2 h1:4w4lsdD8PTa5JuAmOodlcJUh79Fexq/ISWAFjRePSKU=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.38.2/go.mod h1:UdEU45WZi2j7BCKUT++AUSUgl/gSuyoVzCowpbdRbwI=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.39.1 h1:OIdINTNLFOqm7t91ew7+CgcIkvDCCTuK4rBuREBAC2Q=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.39.1/go.mod h1:nP29+6YQpLvD/o/8SXaaSVFdRdPCpLLZv6MVAFiPqIQ=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.3 h1:dy4sbyGy7BS4c0KaPZwg1P5ZP+lW+auTVcPiwrmbn8M=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.3/go.mod h1:EMgqMhof+RuaYvQavxKC0ZWvP7yB4B4NJhP+dbm13u0=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.4 h1:nR4GnokNdp25C6Z6xvXz5VqmzIhp4+aWMcM4w5FhlJ4=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.4/go.mod h1:w/6Ddm5GNEn0uLR6Wc35MGTvUXKDz8uNEMRrrdDB2ps=
 github.com/aws/aws-sdk-go-v2/service/rds v1.79.5 h1:vCMSFBiXtrr6fhNnGs1d2pw+/wJek0l2kZrS0cjtybs=
 github.com/aws/aws-sdk-go-v2/service/rds v1.79.5/go.mod h1:esGFn2z+QNa/XcjHevnddtp3RiFQ9/pzHbjl0rgYqDE=
 github.com/aws/aws-sdk-go-v2/service/rds v1.80.1 h1:o0DyV3AWeuAwrBVeoW/kCZJi4oGCBHPS3E5Ppmc3fLE=
@@ -148,6 +192,8 @@ github.com/aws/aws-sdk-go-v2/service/rds v1.81.5 h1:0vEV6OFcCInf/G98MIwwNJM21cd0
 github.com/aws/aws-sdk-go-v2/service/rds v1.81.5/go.mod h1:j27FNXhbbHXC3ExFsJkoxq2Y+4dQypf8KFX1IkgwVvM=
 github.com/aws/aws-sdk-go-v2/service/rds v1.82.0 h1:+1qRsLNukmvIDNBjz5Osqy4dvIBLwpCeMhmrh9evOUw=
 github.com/aws/aws-sdk-go-v2/service/rds v1.82.0/go.mod h1:j27FNXhbbHXC3ExFsJkoxq2Y+4dQypf8KFX1IkgwVvM=
+github.com/aws/aws-sdk-go-v2/service/rds v1.82.1 h1:4s+9AtQQGB5n0xMm0xRbIQOFoi6rrggMlFt8WwHcDvs=
+github.com/aws/aws-sdk-go-v2/service/rds v1.82.1/go.mod h1:hfUZhydujCniydsJdzZ9bwzX6nUvbfnhhYQeFNREC2I=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4 h1:4p9SCdZBO0PdEXLTF2fcQuxOEkEiqPQpK824cP2VKRo=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4/go.mod h1:oSkRFuHVWmUY4Ssk16ErGzBqvYEbvORJFzFXzWhTB2s=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.56.1 h1:wsg9Z/vNnCmxWikfGIoOlnExtEU459cR+2d+iDJ8elo=
@@ -156,22 +202,30 @@ github.com/aws/aws-sdk-go-v2/service/s3 v1.58.2 h1:sZXIzO38GZOU+O0C+INqbH7C2yALw
 github.com/aws/aws-sdk-go-v2/service/s3 v1.58.2/go.mod h1:Lcxzg5rojyVPU/0eFwLtcyTaek/6Mtic5B1gJo7e/zE=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.58.3 h1:hT8ZAZRIfqBqHbzKTII+CIiY8G2oC9OpLedkZ51DWl8=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.58.3/go.mod h1:Lcxzg5rojyVPU/0eFwLtcyTaek/6Mtic5B1gJo7e/zE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.60.0 h1:2QXGJvG19QwqXUvgcdoCOZPyLuvZf8LiXPCN4P53TdI=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.60.0/go.mod h1:BSPI0EfnYUuNHPS0uqIo5VrRwzie+Fp+YhQOUs16sKI=
 github.com/aws/aws-sdk-go-v2/service/sagemaker v1.151.0 h1:zH7b/d8vOrOWdgluKEux2TAECYKhprH2eMztkpak/mI=
 github.com/aws/aws-sdk-go-v2/service/sagemaker v1.151.0/go.mod h1:lDmK3DHWV6Y6hpzeUAaXq4w+ks6fFYXdkjavIe8STCE=
 github.com/aws/aws-sdk-go-v2/service/sagemaker v1.152.0 h1:y3jRrFbGve0omxt5gDStki51bjYJ6gxhtXr7VFagVv4=
 github.com/aws/aws-sdk-go-v2/service/sagemaker v1.152.0/go.mod h1:lDmK3DHWV6Y6hpzeUAaXq4w+ks6fFYXdkjavIe8STCE=
+github.com/aws/aws-sdk-go-v2/service/sagemaker v1.154.0 h1:NDEbY45I7YFiSAW055YdE6fFoxmudl+jK/8qe//Bduk=
+github.com/aws/aws-sdk-go-v2/service/sagemaker v1.154.0/go.mod h1:tn9CZCzeX7NC+qhWtnsN7GUzXG64/QUqjxeZZetzjpo=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.21.9 h1:3o5zcwZYvte3CeaYpLaWafwCSkJpclPXI5KSH+lXB90=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.21.9/go.mod h1:QZpGkzlec0TPr8CA2Td5zRUJBC5+104ib0MusH5UVfI=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.22.1 h1:QsHvqtdy0mGzpg/A+1lZX1ilf05Vuh2rSBzNJ3f3T1I=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.22.1/go.mod h1:PyGv4oTed21K85Eu27j4u/8QyMlMHI0MivoNzziG6fg=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.3 h1:J6R7Mo3nDY9BmmG4V9EpQa70A0XOoCuWPYTpsmouM48=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.3/go.mod h1:be52Ycqv581QoIOZzHfZFWlJLcGAI2M/ItUSlx7lLp0=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.4 h1:d2hcQdhIWKhLfifd/FvgSs6gQvFke885SotzqvUf0Bw=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.4/go.mod h1:tMgth4UXYC4ExLwX/9STbRJCiP0vz3Ih3ei8iUHh76w=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.50.5 h1:k4IdBvCLRuKW2RyOMdeuNAIX2rRp682M0Y78TdwFY1Q=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.50.5/go.mod h1:zBEScRRmXJYBoXrmdPFUuU+KDrg3+M/91gqyG7Vf3JU=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.51.1 h1:MuFdaoXYgw4CPsiSa2G/T5CGOuSk90lb/eSTa+lRp9I=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.51.1/go.mod h1:pC8vyMIahlJIUKdXBto0R+JzoTK7+iEplKqq7DbWodY=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.52.3 h1:iu53lwRKbZOGCVUH09g3J0xU8A+bAGVo09VR9K4d0Yg=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.52.3/go.mod h1:v7NIzEFIHBiicOMaMTuEmbnzGnqW0d+6ulNALul6fYE=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.52.5 h1:eY1n+pyBbgqRBRnpVUg0QguAGMWVLQp2n+SfjjOJuQI=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.52.5/go.mod h1:Bw2YSeqq/I4VyVs9JSfdT9ArqyAbQkJEwj13AVm0heg=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.10 h1:ItKVmFwbyb/ZnCWf+nu3XBVmUirpO9eGEQd7urnBA0s=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.10/go.mod h1:5XKooCTi9VB/xZmJDvh7uZ+v3uQ7QdX6diOyhvPA+/w=
 github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 h1:sd0BsnAvLH8gsp2e3cbaIr+9D7T1xugueQ7V/zUAsS4=
@@ -180,22 +234,30 @@ github.com/aws/aws-sdk-go-v2/service/sso v1.22.3 h1:Fv1vD2L65Jnp5QRsdiM64JvUM4Xe
 github.com/aws/aws-sdk-go-v2/service/sso v1.22.3/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
 github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 h1:BXx0ZIxvrJdSgSvKTZ+yRBeSqqgPM89VPlulEcl37tM=
 github.com/aws/aws-sdk-go-v2/service/sso v1.22.4/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.5 h1:zCsFCKvbj25i7p1u94imVoO447I/sFv8qq+lGJhRN0c=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.5/go.mod h1:ZeDX1SnKsVlejeuz41GiajjZpRSWR7/42q/EyA/QEiM=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4 h1:QMSCYDg3Iyls0KZc/dk3JtS2c1lFfqbmYO10qBPPkJk=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4/go.mod h1:MZ/PVYU/mRbmSF6WK3ybCYHjA2mig8utVokDEVLDgE0=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 h1:1uEFNNskK/I1KoZ9Q8wJxMz5V9jyBlsiaNrM7vA3YUQ=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1/go.mod h1:z0P8K+cBIsFXUr5rzo/psUeJ20XjPN0+Nn8067Nd+E4=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 h1:yiwVzJW2ZxZTurVbYWA7QOrAaCYQR72t0wrSBfoesUE=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4/go.mod h1:0oxfLkpz3rQ/CHlx5hB7H69YUpFiI1tql6Q6Ne+1bCw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.5 h1:SKvPgvdvmiTWoi0GAJ7AsJfOz3ngVkD/ERbs5pUnHNI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.5/go.mod h1:20sz31hv/WsPa3HhU3hfrIet2kxM4Pe0r20eBZ20Tac=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.11 h1:HYS0csS7UJxdYRoG+bGgUYrSwVnV3/ece/wHm90TApM=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.11/go.mod h1:QXnthRM35zI92048MMwfFChjFmoufTdhtHmouwNfhhU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.29.1 h1:myX5CxqXE0QMZNja6FA1/FSE3Vu1rVmeUmpJMMzeZg0=
 github.com/aws/aws-sdk-go-v2/service/sts v1.29.1/go.mod h1:N2mQiucsO0VwK9CYuS4/c2n6Smeh1v47Rz3dWCPFLdE=
 github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 h1:ZsDKRLXGWHk8WdtyYMoGNO7bTudrvuKpDKgMVRlepGE=
 github.com/aws/aws-sdk-go-v2/service/sts v1.30.3/go.mod h1:zwySh8fpFyXp9yOr/KVzxOl8SRqgf/IDw5aUt9UKFcQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.30.4 h1:iAckBT2OeEK/kBDyN/jDtpEExhjeeA/Im2q4X0rJZT8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.30.4/go.mod h1:vmSqFK+BVIwVpDAGZB3CoCXHzurt4qBE8lf+I/kRTh0=
 github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/aws/smithy-go v1.20.3 h1:ryHwveWzPV5BIof6fyDvor6V3iUL7nTfiTKXHiW05nE=
 github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/aws/smithy-go v1.20.4 h1:2HK1zBdPgRbjFOHlfeQZfpC4r72MOb9bZkiFwggKO+4=
+github.com/aws/smithy-go v1.20.4/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/logex v1.2.1 h1:XHDu3E6q+gdHgsdTPH6ImJMIp436vR6MPtH8gP05QzM=
 github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
@@ -268,6 +330,8 @@ golang.org/x/exp v0.0.0-20240707233637-46b078467d37 h1:uLDX+AfeFCct3a2C7uIWBKMJI
 golang.org/x/exp v0.0.0-20240707233637-46b078467d37/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
+golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa h1:ELnwvuAXPNtPk1TJRuGkI9fDTwym6AYBu0qzT8AcHdI=
+golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -278,6 +342,8 @@ golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
 golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
 golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
+golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
 golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
diff --git a/internal/aws/cfn/schemas/aws/accessanalyzer/analyzer.json b/internal/aws/cfn/schemas/aws/accessanalyzer/analyzer.json
index 550f5a13..2e1a0a2b 100644
--- a/internal/aws/cfn/schemas/aws/accessanalyzer/analyzer.json
+++ b/internal/aws/cfn/schemas/aws/accessanalyzer/analyzer.json
@@ -210,6 +210,10 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "access-analyzer:UntagResource",
+      "access-analyzer:TagResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/acmpca/certificateauthority.json b/internal/aws/cfn/schemas/aws/acmpca/certificateauthority.json
index 186ef5b6..a705bce2 100644
--- a/internal/aws/cfn/schemas/aws/acmpca/certificateauthority.json
+++ b/internal/aws/cfn/schemas/aws/acmpca/certificateauthority.json
@@ -132,15 +132,6 @@
         },
         "CrlDistributionPointExtensionConfiguration": {
           "$ref": "#/definitions/CrlDistributionPointExtensionConfiguration"
-        },
-        "RetainExpiredCertificates": {
-          "type": "boolean"
-        },
-        "PartitioningEnabled": {
-          "type": "boolean"
-        },
-        "CustomPath": {
-          "type": "string"
         }
       },
       "required": [
diff --git a/internal/aws/cfn/schemas/aws/apigatewayv2/integration.json b/internal/aws/cfn/schemas/aws/apigatewayv2/integration.json
index db780526..3db6bb39 100644
--- a/internal/aws/cfn/schemas/aws/apigatewayv2/integration.json
+++ b/internal/aws/cfn/schemas/aws/apigatewayv2/integration.json
@@ -1,75 +1,157 @@
 {
   "typeName": "AWS::ApiGatewayV2::Integration",
-  "description": "Resource Type definition for AWS::ApiGatewayV2::Integration",
   "additionalProperties": false,
+  "description": "An example resource schema demonstrating some basic constructs and validation rules.",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "definitions": {
+    "ResponseParameter": {
+      "description": "response parameter",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Destination": {
+          "type": "string"
+        },
+        "Source": {
+          "type": "string"
+        }
+      }
+    },
+    "ResponseParameterList": {
+      "description": "Response parameter list for an Integration",
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/ResponseParameter"
+      }
+    },
+    "TlsConfig": {
+      "description": "The TlsConfig property specifies the TLS configuration for a private integration. Supported only for HTTP APIs.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "ServerNameToVerify": {
+          "type": "string"
+        }
+      }
+    },
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "minLength": 0,
+          "maxLength": 256
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ]
+    }
+  },
   "properties": {
-    "Description": {
+    "ApiId": {
+      "description": "The API identifier.",
       "type": "string"
     },
-    "TemplateSelectionExpression": {
+    "ConnectionId": {
+      "description": "The ID of the VPC link for a private integration. Supported only for HTTP APIs.",
       "type": "string"
     },
     "ConnectionType": {
+      "description": "The type of the network connection to the integration endpoint. Specify INTERNET for connections through the public routable internet or VPC_LINK for private connections between API Gateway and resources in a VPC. The default value is INTERNET.",
       "type": "string"
     },
-    "ResponseParameters": {
-      "type": "object"
-    },
-    "IntegrationMethod": {
+    "ContentHandlingStrategy": {
+      "description": "Supported only for WebSocket APIs. Specifies how to handle response payload content type conversions. Supported values are CONVERT_TO_BINARY and CONVERT_TO_TEXT.",
       "type": "string"
     },
-    "PassthroughBehavior": {
+    "CredentialsArn": {
+      "description": "Specifies the credentials required for the integration, if any. For AWS integrations, three options are available. To specify an IAM Role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To require that the caller's identity be passed through from the request, specify the string arn:aws:iam::*:user/*. To use resource-based permissions on supported AWS services, don't specify this parameter.",
       "type": "string"
     },
-    "RequestParameters": {
-      "type": "object"
-    },
-    "ConnectionId": {
+    "Description": {
+      "description": "The description of the integration.",
       "type": "string"
     },
-    "IntegrationUri": {
+    "IntegrationMethod": {
+      "description": "Specifies the integration's HTTP method type.",
       "type": "string"
     },
-    "PayloadFormatVersion": {
+    "IntegrationSubtype": {
+      "description": "Supported only for HTTP API AWS_PROXY integrations. Specifies the AWS service action to invoke.",
       "type": "string"
     },
-    "CredentialsArn": {
+    "IntegrationId": {
+      "description": "The integration ID.",
       "type": "string"
     },
-    "RequestTemplates": {
-      "type": "object"
-    },
-    "TimeoutInMillis": {
-      "type": "integer"
-    },
-    "TlsConfig": {
-      "$ref": "#/definitions/TlsConfig"
-    },
-    "ContentHandlingStrategy": {
+    "IntegrationType": {
+      "description": "The integration type of an integration.",
       "type": "string"
     },
-    "Id": {
+    "IntegrationUri": {
+      "description": "For a Lambda integration, specify the URI of a Lambda function. For an HTTP integration, specify a fully-qualified URL. For an HTTP API private integration, specify the ARN of an Application Load Balancer listener, Network Load Balancer listener, or AWS Cloud Map service.",
       "type": "string"
     },
-    "IntegrationSubtype": {
+    "PassthroughBehavior": {
+      "description": "Specifies the pass-through behavior for incoming requests based on the Content-Type header in the request, and the available mapping templates specified as the requestTemplates property on the Integration resource. There are three valid values: WHEN_NO_MATCH, WHEN_NO_TEMPLATES, and NEVER. Supported only for WebSocket APIs.",
       "type": "string"
     },
-    "ApiId": {
+    "PayloadFormatVersion": {
+      "description": "Specifies the format of the payload sent to an integration. Required for HTTP APIs. For HTTP APIs, supported values for Lambda proxy integrations are 1.0 and 2.0 For all other integrations, 1.0 is the only supported value.",
       "type": "string"
     },
-    "IntegrationType": {
-      "type": "string"
-    }
-  },
-  "definitions": {
-    "TlsConfig": {
+    "RequestParameters": {
+      "description": "A key-value map specifying parameters.",
       "type": "object",
       "additionalProperties": false,
-      "properties": {
-        "ServerNameToVerify": {
+      "patternProperties": {
+        "[a-zA-Z0-9]+": {
+          "type": "string"
+        }
+      }
+    },
+    "RequestTemplates": {
+      "description": "A map of Velocity templates that are applied on the request payload based on the value of the Content-Type header sent by the client.",
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "[a-zA-Z0-9]+": {
           "type": "string"
         }
       }
+    },
+    "ResponseParameters": {
+      "description": "Parameters that transform the HTTP response from a backend integration before returning the response to clients. Supported only for HTTP APIs.",
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "[a-zA-Z0-9]+": {
+          "$ref": "#/definitions/ResponseParameterList"
+        }
+      }
+    },
+    "TemplateSelectionExpression": {
+      "description": "The template selection expression for the integration. Supported only for WebSocket APIs.",
+      "type": "string"
+    },
+    "TimeoutInMillis": {
+      "description": "Custom timeout between 50 and 29000 milliseconds for WebSocket APIs and between 50 and 30000 milliseconds for HTTP APIs. The default timeout is 29 seconds for WebSocket APIs and 30 seconds for HTTP APIs.",
+      "type": "integer"
+    },
+    "TlsConfig": {
+      "description": "The TLS configuration for a private integration. If you specify a TLS configuration, private integration traffic uses the HTTPS protocol. Supported only for HTTP APIs.",
+      "$ref": "#/definitions/TlsConfig"
     }
   },
   "required": [
@@ -79,10 +161,44 @@
   "createOnlyProperties": [
     "/properties/ApiId"
   ],
+  "readOnlyProperties": [
+    "/properties/IntegrationId"
+  ],
   "primaryIdentifier": [
-    "/properties/Id"
+    "/properties/ApiId",
+    "/properties/IntegrationId"
   ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ]
+  "tagging": {
+    "taggable": false
+  },
+  "handlers": {
+    "create": {
+      "permissions": [
+        "apigateway:POST"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "apigateway:PATCH",
+        "apigateway:GET",
+        "apigateway:PUT"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "apigateway:GET"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "apigateway:GET",
+        "apigateway:DELETE"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "apigateway:GET"
+      ]
+    }
+  }
 }
diff --git a/internal/aws/cfn/schemas/aws/bedrock/datasource.json b/internal/aws/cfn/schemas/aws/bedrock/datasource.json
index 97493fed..1c5db564 100644
--- a/internal/aws/cfn/schemas/aws/bedrock/datasource.json
+++ b/internal/aws/cfn/schemas/aws/bedrock/datasource.json
@@ -3,6 +3,26 @@
   "description": "Definition of AWS::Bedrock::DataSource Resource Type",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-aps",
   "definitions": {
+    "BedrockFoundationModelConfiguration": {
+      "type": "object",
+      "description": "Settings for a foundation model used to parse documents for a data source.",
+      "properties": {
+        "ModelArn": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}::foundation-model/([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2})$",
+          "description": "The model's ARN."
+        },
+        "ParsingPrompt": {
+          "$ref": "#/definitions/ParsingPrompt"
+        }
+      },
+      "required": [
+        "ModelArn"
+      ],
+      "additionalProperties": false
+    },
     "ChunkingConfiguration": {
       "type": "object",
       "description": "Details about how to chunk the documents in the data source. A chunk refers to an excerpt from a data source that is returned when the knowledge base that it belongs to is queried.",
@@ -12,6 +32,12 @@
         },
         "FixedSizeChunkingConfiguration": {
           "$ref": "#/definitions/FixedSizeChunkingConfiguration"
+        },
+        "HierarchicalChunkingConfiguration": {
+          "$ref": "#/definitions/HierarchicalChunkingConfiguration"
+        },
+        "SemanticChunkingConfiguration": {
+          "$ref": "#/definitions/SemanticChunkingConfiguration"
         }
       },
       "required": [
@@ -24,9 +50,35 @@
       "description": "Knowledge base can split your source data into chunks. A chunk refers to an excerpt from a data source that is returned when the knowledge base that it belongs to is queried. You have the following options for chunking your data. If you opt for NONE, then you may want to pre-process your files by splitting them up such that each file corresponds to a chunk.",
       "enum": [
         "FIXED_SIZE",
-        "NONE"
+        "NONE",
+        "HIERARCHICAL",
+        "SEMANTIC"
       ]
     },
+    "CustomTransformationConfiguration": {
+      "type": "object",
+      "description": "Settings for customizing steps in the data source content ingestion pipeline.",
+      "properties": {
+        "IntermediateStorage": {
+          "$ref": "#/definitions/IntermediateStorage"
+        },
+        "Transformations": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Transformation"
+          },
+          "maxItems": 1,
+          "minItems": 1,
+          "description": "A list of Lambda functions that process documents.",
+          "insertionOrder": false
+        }
+      },
+      "required": [
+        "IntermediateStorage",
+        "Transformations"
+      ],
+      "additionalProperties": false
+    },
     "DataSourceConfiguration": {
       "type": "object",
       "description": "Specifies a raw data source location to ingest.",
@@ -36,11 +88,49 @@
         },
         "S3Configuration": {
           "$ref": "#/definitions/S3DataSourceConfiguration"
+        },
+        "ConfluenceConfiguration": {
+          "$ref": "#/definitions/ConfluenceDataSourceConfiguration"
+        },
+        "SalesforceConfiguration": {
+          "$ref": "#/definitions/SalesforceDataSourceConfiguration"
+        },
+        "SharePointConfiguration": {
+          "$ref": "#/definitions/SharePointDataSourceConfiguration"
+        },
+        "WebConfiguration": {
+          "$ref": "#/definitions/WebDataSourceConfiguration"
         }
       },
       "required": [
-        "Type",
-        "S3Configuration"
+        "Type"
+      ],
+      "oneOf": [
+        {
+          "required": [
+            "S3Configuration"
+          ]
+        },
+        {
+          "required": [
+            "ConfluenceConfiguration"
+          ]
+        },
+        {
+          "required": [
+            "SalesforceConfiguration"
+          ]
+        },
+        {
+          "required": [
+            "SharePointConfiguration"
+          ]
+        },
+        {
+          "required": [
+            "WebConfiguration"
+          ]
+        }
       ],
       "additionalProperties": false
     },
@@ -57,7 +147,11 @@
       "type": "string",
       "description": "The type of the data source location.",
       "enum": [
-        "S3"
+        "S3",
+        "CONFLUENCE",
+        "SALESFORCE",
+        "SHAREPOINT",
+        "WEB"
       ]
     },
     "DataDeletionPolicy": {
@@ -90,9 +184,103 @@
       ],
       "additionalProperties": false
     },
+    "HierarchicalChunkingConfiguration": {
+      "type": "object",
+      "description": "Configurations for when you choose hierarchical chunking. If you set the chunkingStrategy as NONE, exclude this field.",
+      "properties": {
+        "LevelConfigurations": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/HierarchicalChunkingLevelConfiguration"
+          },
+          "maxItems": 2,
+          "minItems": 2,
+          "description": "Token settings for each layer.",
+          "insertionOrder": false
+        },
+        "OverlapTokens": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The number of tokens to repeat across chunks in the same layer."
+        }
+      },
+      "required": [
+        "LevelConfigurations",
+        "OverlapTokens"
+      ],
+      "additionalProperties": false
+    },
+    "HierarchicalChunkingLevelConfiguration": {
+      "type": "object",
+      "description": "Token settings for a layer in a hierarchical chunking configuration.",
+      "properties": {
+        "MaxTokens": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8192,
+          "description": "The maximum number of tokens that a chunk can contain in this layer."
+        }
+      },
+      "required": [
+        "MaxTokens"
+      ],
+      "additionalProperties": false
+    },
+    "IntermediateStorage": {
+      "type": "object",
+      "description": "A location for storing content from data sources temporarily as it is processed by custom components in the ingestion pipeline.",
+      "properties": {
+        "S3Location": {
+          "$ref": "#/definitions/S3Location"
+        }
+      },
+      "required": [
+        "S3Location"
+      ],
+      "additionalProperties": false
+    },
+    "ParsingConfiguration": {
+      "type": "object",
+      "description": "Settings for parsing document contents",
+      "properties": {
+        "ParsingStrategy": {
+          "$ref": "#/definitions/ParsingStrategy"
+        },
+        "BedrockFoundationModelConfiguration": {
+          "$ref": "#/definitions/BedrockFoundationModelConfiguration"
+        }
+      },
+      "required": [
+        "ParsingStrategy"
+      ],
+      "additionalProperties": false
+    },
+    "ParsingPrompt": {
+      "type": "object",
+      "description": "Instructions for interpreting the contents of a document.",
+      "properties": {
+        "ParsingPromptText": {
+          "type": "string",
+          "maxLength": 10000,
+          "minLength": 1,
+          "description": "Instructions for interpreting the contents of a document."
+        }
+      },
+      "required": [
+        "ParsingPromptText"
+      ],
+      "additionalProperties": false
+    },
+    "ParsingStrategy": {
+      "type": "string",
+      "description": "The parsing strategy for the data source.",
+      "enum": [
+        "BEDROCK_FOUNDATION_MODEL"
+      ]
+    },
     "S3DataSourceConfiguration": {
       "type": "object",
-      "description": "Contains information about the S3 configuration of the data source.",
+      "description": "The configuration information to connect to Amazon S3 as your data source.",
       "properties": {
         "BucketArn": {
           "type": "string",
@@ -127,6 +315,116 @@
       ],
       "additionalProperties": false
     },
+    "ConfluenceDataSourceConfiguration": {
+      "type": "object",
+      "description": "The configuration information to connect to Confluence as your data source.",
+      "properties": {
+        "SourceConfiguration": {
+          "$ref": "#/definitions/ConfluenceSourceConfiguration"
+        },
+        "CrawlerConfiguration": {
+          "$ref": "#/definitions/ConfluenceCrawlerConfiguration"
+        }
+      },
+      "required": [
+        "SourceConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "SalesforceDataSourceConfiguration": {
+      "type": "object",
+      "description": "The configuration information to connect to Salesforce as your data source.",
+      "properties": {
+        "SourceConfiguration": {
+          "$ref": "#/definitions/SalesforceSourceConfiguration"
+        },
+        "CrawlerConfiguration": {
+          "$ref": "#/definitions/SalesforceCrawlerConfiguration"
+        }
+      },
+      "required": [
+        "SourceConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "SharePointDataSourceConfiguration": {
+      "type": "object",
+      "description": "The configuration information to connect to SharePoint as your data source.",
+      "properties": {
+        "SourceConfiguration": {
+          "$ref": "#/definitions/SharePointSourceConfiguration"
+        },
+        "CrawlerConfiguration": {
+          "$ref": "#/definitions/SharePointCrawlerConfiguration"
+        }
+      },
+      "required": [
+        "SourceConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "WebDataSourceConfiguration": {
+      "type": "object",
+      "description": "Configures a web data source location.",
+      "properties": {
+        "SourceConfiguration": {
+          "$ref": "#/definitions/WebSourceConfiguration"
+        },
+        "CrawlerConfiguration": {
+          "$ref": "#/definitions/WebCrawlerConfiguration"
+        }
+      },
+      "required": [
+        "SourceConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "S3Location": {
+      "type": "object",
+      "description": "An Amazon S3 location.",
+      "properties": {
+        "URI": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^s3://.{1,128}$",
+          "description": "The location's URI"
+        }
+      },
+      "required": [
+        "URI"
+      ],
+      "additionalProperties": false
+    },
+    "SemanticChunkingConfiguration": {
+      "type": "object",
+      "description": "Configurations for when you choose semantic chunking. If you set the chunkingStrategy as NONE, exclude this field.",
+      "properties": {
+        "BreakpointPercentileThreshold": {
+          "type": "integer",
+          "minimum": 50,
+          "maximum": 99,
+          "description": "The dissimilarity threshold for splitting chunks."
+        },
+        "BufferSize": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "The buffer size."
+        },
+        "MaxTokens": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The maximum number of tokens that a chunk can contain."
+        }
+      },
+      "required": [
+        "BreakpointPercentileThreshold",
+        "BufferSize",
+        "MaxTokens"
+      ],
+      "additionalProperties": false
+    },
     "ServerSideEncryptionConfiguration": {
       "type": "object",
       "description": "Contains details about the server-side encryption for the data source.",
@@ -141,15 +439,396 @@
       },
       "additionalProperties": false
     },
+    "Transformation": {
+      "type": "object",
+      "description": "A Lambda function that processes documents.",
+      "properties": {
+        "StepToApply": {
+          "type": "string",
+          "description": "When the service applies the transformation.",
+          "enum": [
+            "POST_CHUNKING"
+          ]
+        },
+        "TransformationFunction": {
+          "$ref": "#/definitions/TransformationFunction"
+        }
+      },
+      "required": [
+        "StepToApply",
+        "TransformationFunction"
+      ],
+      "additionalProperties": false
+    },
+    "TransformationFunction": {
+      "type": "object",
+      "description": "A Lambda function that processes documents.",
+      "properties": {
+        "TransformationLambdaConfiguration": {
+          "$ref": "#/definitions/TransformationLambdaConfiguration"
+        }
+      },
+      "required": [
+        "TransformationLambdaConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "TransformationLambdaConfiguration": {
+      "type": "object",
+      "description": "A Lambda function that processes documents.",
+      "properties": {
+        "LambdaArn": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 0,
+          "pattern": "^arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}(-gov)?-[a-z]+-\\d{1}:\\d{12}:function:[a-zA-Z0-9-_\\.]+(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+          "description": "The function's ARN identifier."
+        }
+      },
+      "required": [
+        "LambdaArn"
+      ],
+      "additionalProperties": false
+    },
     "VectorIngestionConfiguration": {
       "type": "object",
       "description": "Details about how to chunk the documents in the data source. A chunk refers to an excerpt from a data source that is returned when the knowledge base that it belongs to is queried.",
       "properties": {
         "ChunkingConfiguration": {
           "$ref": "#/definitions/ChunkingConfiguration"
+        },
+        "CustomTransformationConfiguration": {
+          "$ref": "#/definitions/CustomTransformationConfiguration"
+        },
+        "ParsingConfiguration": {
+          "$ref": "#/definitions/ParsingConfiguration"
         }
       },
       "additionalProperties": false
+    },
+    "ConfluenceSourceConfiguration": {
+      "type": "object",
+      "description": "The endpoint information to connect to your Confluence data source.",
+      "properties": {
+        "HostUrl": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^https://[A-Za-z0-9][^\\s]*$",
+          "description": "The Confluence host URL or instance URL."
+        },
+        "HostType": {
+          "type": "string",
+          "description": "The supported host type, whether online/cloud or server/on-premises.",
+          "enum": [
+            "SAAS"
+          ]
+        },
+        "AuthType": {
+          "type": "string",
+          "description": "The supported authentication type to authenticate and connect to your Confluence instance.",
+          "enum": [
+            "BASIC",
+            "OAUTH2_CLIENT_CREDENTIALS"
+          ]
+        },
+        "CredentialsSecretArn": {
+          "type": "string",
+          "description": "The Amazon Resource Name of an AWS Secrets Manager secret that stores your authentication credentials for your Confluence instance URL. For more information on the key-value pairs that must be included in your secret, depending on your authentication type, see Confluence connection configuration.",
+          "pattern": "^arn:aws(|-cn|-us-gov):secretsmanager:[a-z0-9-]{1,20}:([0-9]{12}|):secret:[a-zA-Z0-9!/_+=.@-]{1,512}$"
+        }
+      },
+      "required": [
+        "HostUrl",
+        "HostType",
+        "AuthType",
+        "CredentialsSecretArn"
+      ],
+      "additionalProperties": false
+    },
+    "ConfluenceCrawlerConfiguration": {
+      "type": "object",
+      "description": "The configuration of the Confluence content. For example, configuring specific types of Confluence content.",
+      "properties": {
+        "FilterConfiguration": {
+          "$ref": "#/definitions/CrawlFilterConfiguration"
+        }
+      },
+      "additionalProperties": false
+    },
+    "SalesforceSourceConfiguration": {
+      "type": "object",
+      "description": "The endpoint information to connect to your Salesforce data source.",
+      "properties": {
+        "HostUrl": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^https://[A-Za-z0-9][^\\s]*$",
+          "description": "The Salesforce host URL or instance URL."
+        },
+        "AuthType": {
+          "type": "string",
+          "description": "The supported authentication type to authenticate and connect to your Salesforce instance.",
+          "enum": [
+            "OAUTH2_CLIENT_CREDENTIALS"
+          ]
+        },
+        "CredentialsSecretArn": {
+          "type": "string",
+          "description": "The Amazon Resource Name of an AWS Secrets Manager secret that stores your authentication credentials for your Salesforce instance URL. For more information on the key-value pairs that must be included in your secret, depending on your authentication type, see Salesforce connection configuration.",
+          "pattern": "^arn:aws(|-cn|-us-gov):secretsmanager:[a-z0-9-]{1,20}:([0-9]{12}|):secret:[a-zA-Z0-9!/_+=.@-]{1,512}$"
+        }
+      },
+      "required": [
+        "HostUrl",
+        "AuthType",
+        "CredentialsSecretArn"
+      ],
+      "additionalProperties": false
+    },
+    "SalesforceCrawlerConfiguration": {
+      "type": "object",
+      "description": "The configuration of filtering the Salesforce content. For example, configuring regular expression patterns to include or exclude certain content.",
+      "properties": {
+        "FilterConfiguration": {
+          "$ref": "#/definitions/CrawlFilterConfiguration"
+        }
+      },
+      "additionalProperties": false
+    },
+    "SharePointSourceConfiguration": {
+      "type": "object",
+      "description": "The endpoint information to connect to your SharePoint data source.",
+      "properties": {
+        "SiteUrls": {
+          "type": "array",
+          "description": "A list of one or more SharePoint site URLs.",
+          "items": {
+            "type": "string",
+            "pattern": "^https://[A-Za-z0-9][^\\s]*$",
+            "description": "A forced-HTTPS web url."
+          },
+          "maxItems": 100,
+          "minItems": 1,
+          "insertionOrder": false
+        },
+        "HostType": {
+          "type": "string",
+          "description": "The supported host type, whether online/cloud or server/on-premises.",
+          "enum": [
+            "ONLINE"
+          ]
+        },
+        "AuthType": {
+          "type": "string",
+          "description": "The supported authentication type to authenticate and connect to your SharePoint site/sites.",
+          "enum": [
+            "OAUTH2_CLIENT_CREDENTIALS"
+          ]
+        },
+        "CredentialsSecretArn": {
+          "type": "string",
+          "description": "The Amazon Resource Name of an AWS Secrets Manager secret that stores your authentication credentials for your SharePoint site/sites. For more information on the key-value pairs that must be included in your secret, depending on your authentication type, see SharePoint connection configuration.",
+          "pattern": "^arn:aws(|-cn|-us-gov):secretsmanager:[a-z0-9-]{1,20}:([0-9]{12}|):secret:[a-zA-Z0-9!/_+=.@-]{1,512}$"
+        },
+        "TenantId": {
+          "type": "string",
+          "description": "The identifier of your Microsoft 365 tenant.",
+          "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+        },
+        "Domain": {
+          "type": "string",
+          "description": "The domain of your SharePoint instance or site URL/URLs.",
+          "maxLength": 50,
+          "minLength": 1
+        }
+      },
+      "required": [
+        "Domain",
+        "SiteUrls",
+        "HostType",
+        "AuthType",
+        "CredentialsSecretArn"
+      ],
+      "additionalProperties": false
+    },
+    "SharePointCrawlerConfiguration": {
+      "type": "object",
+      "description": "The configuration of the SharePoint content. For example, configuring specific types of SharePoint content.",
+      "properties": {
+        "FilterConfiguration": {
+          "$ref": "#/definitions/CrawlFilterConfiguration"
+        }
+      },
+      "additionalProperties": false
+    },
+    "WebSourceConfiguration": {
+      "type": "object",
+      "description": "A web source configuration.",
+      "properties": {
+        "UrlConfiguration": {
+          "$ref": "#/definitions/UrlConfiguration"
+        }
+      },
+      "required": [
+        "UrlConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "UrlConfiguration": {
+      "type": "object",
+      "description": "A url configuration.",
+      "properties": {
+        "SeedUrls": {
+          "$ref": "#/definitions/SeedUrls"
+        }
+      },
+      "required": [
+        "SeedUrls"
+      ],
+      "additionalProperties": false
+    },
+    "SeedUrl": {
+      "type": "object",
+      "description": "A seed url object.",
+      "properties": {
+        "Url": {
+          "type": "string",
+          "pattern": "^https?://[A-Za-z0-9][^\\s]*$",
+          "description": "A web url."
+        }
+      },
+      "required": [
+        "Url"
+      ],
+      "additionalProperties": false
+    },
+    "SeedUrls": {
+      "type": "array",
+      "description": "A list of web urls.",
+      "items": {
+        "$ref": "#/definitions/SeedUrl"
+      },
+      "maxItems": 100,
+      "minItems": 1,
+      "insertionOrder": false
+    },
+    "WebCrawlerConfiguration": {
+      "type": "object",
+      "description": "Configuration for the web crawler.",
+      "properties": {
+        "CrawlerLimits": {
+          "$ref": "#/definitions/WebCrawlerLimits"
+        },
+        "InclusionFilters": {
+          "$ref": "#/definitions/FilterList"
+        },
+        "ExclusionFilters": {
+          "$ref": "#/definitions/FilterList"
+        },
+        "Scope": {
+          "$ref": "#/definitions/WebScopeType"
+        }
+      },
+      "additionalProperties": false
+    },
+    "WebCrawlerLimits": {
+      "type": "object",
+      "description": "Limit settings for the web crawler.",
+      "properties": {
+        "RateLimit": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 300,
+          "description": "Rate of web URLs retrieved per minute."
+        }
+      },
+      "additionalProperties": false
+    },
+    "WebScopeType": {
+      "type": "string",
+      "description": "The scope that a web crawl job will be restricted to.",
+      "enum": [
+        "HOST_ONLY",
+        "SUBDOMAINS"
+      ]
+    },
+    "CrawlFilterConfiguration": {
+      "type": "object",
+      "description": "The type of filtering that you want to apply to certain objects or content of the data source. For example, the PATTERN type is regular expression patterns you can apply to filter your content.",
+      "properties": {
+        "Type": {
+          "type": "string",
+          "description": "The crawl filter type.",
+          "enum": [
+            "PATTERN"
+          ]
+        },
+        "PatternObjectFilter": {
+          "$ref": "#/definitions/PatternObjectFilterConfiguration"
+        }
+      },
+      "required": [
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "PatternObjectFilterConfiguration": {
+      "type": "object",
+      "description": "The configuration of specific filters applied to your data source content. You can filter out or include certain content.",
+      "properties": {
+        "Filters": {
+          "$ref": "#/definitions/PatternObjectFilterList"
+        }
+      },
+      "required": [
+        "Filters"
+      ],
+      "additionalProperties": false
+    },
+    "PatternObjectFilterList": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/PatternObjectFilter"
+      },
+      "maxItems": 25,
+      "minItems": 1,
+      "description": "Contains information"
+    },
+    "PatternObjectFilter": {
+      "type": "object",
+      "description": "The specific filters applied to your data source content. You can filter out or include certain content.",
+      "properties": {
+        "ObjectType": {
+          "type": "string",
+          "maxLength": 50,
+          "minLength": 1,
+          "description": "The supported object type or content type of the data source."
+        },
+        "InclusionFilters": {
+          "$ref": "#/definitions/FilterList"
+        },
+        "ExclusionFilters": {
+          "$ref": "#/definitions/FilterList"
+        }
+      },
+      "required": [
+        "ObjectType"
+      ],
+      "additionalProperties": false
+    },
+    "FilterList": {
+      "type": "array",
+      "description": "A set of regular expression filter patterns for a type of object.",
+      "items": {
+        "type": "string",
+        "maxLength": 1000,
+        "description": "A list of one or more inclusion/exclusion regular expression patterns to include certain object types that adhere to the pattern. If you specify an inclusion and exclusion filter/pattern and both match a document, the exclusion filter takes precedence and the document isn't crawled."
+      },
+      "maxItems": 25,
+      "minItems": 1,
+      "insertionOrder": false
     }
   },
   "properties": {
@@ -223,7 +902,9 @@
   ],
   "createOnlyProperties": [
     "/properties/KnowledgeBaseId",
-    "/properties/VectorIngestionConfiguration"
+    "/properties/VectorIngestionConfiguration/ChunkingConfiguration",
+    "/properties/VectorIngestionConfiguration/ParsingConfiguration",
+    "/properties/DataSourceConfiguration/Type"
   ],
   "primaryIdentifier": [
     "/properties/KnowledgeBaseId",
diff --git a/internal/aws/cfn/schemas/aws/codeartifact/domain.json b/internal/aws/cfn/schemas/aws/codeartifact/domain.json
index 305eb4ef..54aab585 100644
--- a/internal/aws/cfn/schemas/aws/codeartifact/domain.json
+++ b/internal/aws/cfn/schemas/aws/codeartifact/domain.json
@@ -95,7 +95,8 @@
         "codeartifact:DescribeDomain",
         "codeartifact:PutDomainPermissionsPolicy",
         "codeartifact:GetDomainPermissionsPolicy",
-        "codeartifact:TagResource"
+        "codeartifact:TagResource",
+        "codeartifact:ListTagsForResource"
       ]
     },
     "read": {
@@ -107,11 +108,13 @@
     },
     "update": {
       "permissions": [
+        "codeartifact:DescribeDomain",
         "codeartifact:PutDomainPermissionsPolicy",
         "codeartifact:DeleteDomainPermissionsPolicy",
         "codeartifact:GetDomainPermissionsPolicy",
         "codeartifact:TagResource",
-        "codeartifact:UntagResource"
+        "codeartifact:UntagResource",
+        "codeartifact:ListTagsForResource"
       ]
     },
     "delete": {
@@ -131,6 +134,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "codeartifact:ListTagsForResource",
+      "codeartifact:UntagResource",
+      "codeartifact:TagResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/codeartifact/repository.json b/internal/aws/cfn/schemas/aws/codeartifact/repository.json
index 7d2ab097..c960d4a2 100644
--- a/internal/aws/cfn/schemas/aws/codeartifact/repository.json
+++ b/internal/aws/cfn/schemas/aws/codeartifact/repository.json
@@ -117,9 +117,11 @@
         "codeartifact:CreateRepository",
         "codeartifact:DescribeRepository",
         "codeartifact:PutRepositoryPermissionsPolicy",
+        "codeartifact:GetRepositoryPermissionsPolicy",
         "codeartifact:AssociateExternalConnection",
         "codeartifact:AssociateWithDownstreamRepository",
-        "codeartifact:TagResource"
+        "codeartifact:TagResource",
+        "codeartifact:ListTagsForResource"
       ]
     },
     "read": {
@@ -132,6 +134,7 @@
     "update": {
       "permissions": [
         "codeartifact:PutRepositoryPermissionsPolicy",
+        "codeartifact:GetRepositoryPermissionsPolicy",
         "codeartifact:DeleteRepositoryPermissionsPolicy",
         "codeartifact:AssociateExternalConnection",
         "codeartifact:DisassociateExternalConnection",
@@ -139,7 +142,8 @@
         "codeartifact:DescribeRepository",
         "codeartifact:AssociateWithDownstreamRepository",
         "codeartifact:TagResource",
-        "codeartifact:UntagResource"
+        "codeartifact:UntagResource",
+        "codeartifact:ListTagsForResource"
       ]
     },
     "delete": {
@@ -159,6 +163,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "codeartifact:ListTagsForResource",
+      "codeartifact:UntagResource",
+      "codeartifact:TagResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/codebuild/fleet.json b/internal/aws/cfn/schemas/aws/codebuild/fleet.json
index 08dc6af4..4c1903ae 100644
--- a/internal/aws/cfn/schemas/aws/codebuild/fleet.json
+++ b/internal/aws/cfn/schemas/aws/codebuild/fleet.json
@@ -19,7 +19,8 @@
         "WINDOWS_SERVER_2022_CONTAINER",
         "LINUX_CONTAINER",
         "LINUX_GPU_CONTAINER",
-        "ARM_CONTAINER"
+        "ARM_CONTAINER",
+        "MAC_ARM"
       ]
     },
     "ComputeType": {
@@ -55,6 +56,10 @@
     "Arn": {
       "type": "string",
       "minLength": 1
+    },
+    "ImageId": {
+      "type": "string",
+      "pattern": "^((aws/codebuild/[A-Za-z-]+:[0-9]+(-[0-9._]+)?)|ami-[a-z0-9]{1,1020})$"
     }
   },
   "definitions": {
diff --git a/internal/aws/cfn/schemas/aws/cognito/identitypool.json b/internal/aws/cfn/schemas/aws/cognito/identitypool.json
index fc3bed1c..bc2a2746 100644
--- a/internal/aws/cfn/schemas/aws/cognito/identitypool.json
+++ b/internal/aws/cfn/schemas/aws/cognito/identitypool.json
@@ -4,12 +4,40 @@
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "additionalProperties": false,
   "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/IdentityPoolTags",
+    "permissions": [
+      "cognito-identity:TagResource",
+      "cognito-identity:UntagResource"
+    ]
   },
   "definitions": {
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "type": "object",
+      "properties": {
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "minLength": 0,
+          "maxLength": 256
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ],
+      "additionalProperties": false
+    },
     "PushSync": {
       "type": "object",
       "additionalProperties": false,
@@ -116,6 +144,15 @@
     },
     "AllowClassicFlow": {
       "type": "boolean"
+    },
+    "IdentityPoolTags": {
+      "description": "An array of key-value pairs to apply to this resource.",
+      "type": "array",
+      "uniqueItems": true,
+      "insertionOrder": false,
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
     }
   },
   "required": [
@@ -139,6 +176,7 @@
         "cognito-identity:CreateIdentityPool",
         "cognito-sync:SetIdentityPoolConfiguration",
         "cognito-sync:SetCognitoEvents",
+        "cognito-identity:TagResource",
         "iam:PassRole"
       ]
     },
@@ -153,6 +191,8 @@
         "cognito-identity:DescribeIdentityPool",
         "cognito-sync:SetIdentityPoolConfiguration",
         "cognito-sync:SetCognitoEvents",
+        "cognito-identity:TagResource",
+        "cognito-identity:UntagResource",
         "iam:PassRole"
       ]
     },
diff --git a/internal/aws/cfn/schemas/aws/cognito/logdeliveryconfiguration.json b/internal/aws/cfn/schemas/aws/cognito/logdeliveryconfiguration.json
index 7f448ec9..1b2cc6c7 100644
--- a/internal/aws/cfn/schemas/aws/cognito/logdeliveryconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/cognito/logdeliveryconfiguration.json
@@ -12,6 +12,24 @@
       },
       "additionalProperties": false
     },
+    "S3Configuration": {
+      "type": "object",
+      "properties": {
+        "BucketArn": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "FirehoseConfiguration": {
+      "type": "object",
+      "properties": {
+        "StreamArn": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
     "LogConfiguration": {
       "type": "object",
       "properties": {
@@ -23,6 +41,12 @@
         },
         "CloudWatchLogsConfiguration": {
           "$ref": "#/definitions/CloudWatchLogsConfiguration"
+        },
+        "S3Configuration": {
+          "$ref": "#/definitions/S3Configuration"
+        },
+        "FirehoseConfiguration": {
+          "$ref": "#/definitions/FirehoseConfiguration"
         }
       },
       "additionalProperties": false
@@ -76,7 +100,14 @@
         "logs:ListLogDeliveries",
         "logs:PutResourcePolicy",
         "logs:DescribeResourcePolicies",
-        "logs:DescribeLogGroups"
+        "logs:DescribeLogGroups",
+        "s3:GetBucketPolicy",
+        "s3:PutBucketPolicy",
+        "s3:ListBucket",
+        "s3:PutObject",
+        "s3:GetBucketAcl",
+        "firehose:TagDeliveryStream",
+        "iam:CreateServiceLinkedRole"
       ],
       "timeoutInMinutes": 2
     },
@@ -96,7 +127,14 @@
         "logs:ListLogDeliveries",
         "logs:PutResourcePolicy",
         "logs:DescribeResourcePolicies",
-        "logs:DescribeLogGroups"
+        "logs:DescribeLogGroups",
+        "s3:GetBucketPolicy",
+        "s3:PutBucketPolicy",
+        "s3:ListBucket",
+        "s3:PutObject",
+        "s3:GetBucketAcl",
+        "firehose:TagDeliveryStream",
+        "iam:CreateServiceLinkedRole"
       ],
       "timeoutInMinutes": 2
     },
@@ -111,7 +149,14 @@
         "logs:ListLogDeliveries",
         "logs:PutResourcePolicy",
         "logs:DescribeResourcePolicies",
-        "logs:DescribeLogGroups"
+        "logs:DescribeLogGroups",
+        "s3:GetBucketPolicy",
+        "s3:PutBucketPolicy",
+        "s3:ListBucket",
+        "s3:PutObject",
+        "s3:GetBucketAcl",
+        "firehose:TagDeliveryStream",
+        "iam:CreateServiceLinkedRole"
       ],
       "timeoutInMinutes": 2
     }
diff --git a/internal/aws/cfn/schemas/aws/cognito/userpool.json b/internal/aws/cfn/schemas/aws/cognito/userpool.json
index a6e326c8..10d33df1 100644
--- a/internal/aws/cfn/schemas/aws/cognito/userpool.json
+++ b/internal/aws/cfn/schemas/aws/cognito/userpool.json
@@ -1,13 +1,18 @@
 {
   "typeName": "AWS::Cognito::UserPool",
-  "description": "Resource Type definition for AWS::Cognito::UserPool",
+  "description": "Definition of AWS::Cognito::UserPool Resource Type",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "tagging": {
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/UserPoolTags"
+    "tagProperty": "/properties/UserPoolTags",
+    "permissions": [
+      "cognito-idp:ListTagsForResource",
+      "cognito-idp:UntagResource",
+      "cognito-idp:TagResource"
+    ]
   },
   "definitions": {
     "PasswordPolicy": {
@@ -30,6 +35,9 @@
         },
         "TemporaryPasswordValidityDays": {
           "type": "integer"
+        },
+        "PasswordHistorySize": {
+          "type": "integer"
         }
       },
       "additionalProperties": false
@@ -328,11 +336,23 @@
       },
       "additionalProperties": false
     },
+    "AdvancedSecurityAdditionalFlows": {
+      "type": "object",
+      "properties": {
+        "CustomAuthMode": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
     "UserPoolAddOns": {
       "type": "object",
       "properties": {
         "AdvancedSecurityMode": {
           "type": "string"
+        },
+        "AdvancedSecurityAdditionalFlows": {
+          "$ref": "#/definitions/AdvancedSecurityAdditionalFlows"
         }
       },
       "additionalProperties": false
@@ -485,7 +505,8 @@
     },
     "read": {
       "permissions": [
-        "cognito-idp:DescribeUserPool"
+        "cognito-idp:DescribeUserPool",
+        "cognito-idp:GetUserPoolMfaConfig"
       ]
     },
     "update": {
@@ -497,6 +518,7 @@
         "cognito-idp:SetUserPoolMfaConfig",
         "cognito-idp:AddCustomAttributes",
         "cognito-idp:DescribeUserPool",
+        "cognito-idp:GetUserPoolMfaConfig",
         "iam:PassRole"
       ],
       "timeoutInMinutes": 2
diff --git a/internal/aws/cfn/schemas/aws/controltower/landingzone.json b/internal/aws/cfn/schemas/aws/controltower/landingzone.json
index cae0fb4c..c379d093 100644
--- a/internal/aws/cfn/schemas/aws/controltower/landingzone.json
+++ b/internal/aws/cfn/schemas/aws/controltower/landingzone.json
@@ -1,97 +1,18 @@
 {
-  "typeName": "AWS::ControlTower::LandingZone",
-  "description": "Definition of AWS::ControlTower::LandingZone Resource Type",
-  "definitions": {
-    "LandingZoneDriftStatus": {
-      "type": "string",
-      "enum": [
-        "DRIFTED",
-        "IN_SYNC"
-      ]
-    },
-    "LandingZoneStatus": {
-      "type": "string",
-      "enum": [
-        "ACTIVE",
-        "PROCESSING",
-        "FAILED"
-      ]
-    },
-    "Tag": {
-      "type": "object",
-      "properties": {
-        "Key": {
-          "type": "string",
-          "maxLength": 256,
-          "minLength": 1
-        },
-        "Value": {
-          "type": "string",
-          "maxLength": 256,
-          "minLength": 0
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "properties": {
-    "LandingZoneIdentifier": {
-      "type": "string"
-    },
-    "Arn": {
-      "type": "string",
-      "maxLength": 2048,
-      "minLength": 20,
-      "pattern": "^arn:aws[0-9a-zA-Z_\\-:\\/]+$"
-    },
-    "Status": {
-      "$ref": "#/definitions/LandingZoneStatus"
-    },
-    "LatestAvailableVersion": {
-      "type": "string",
-      "maxLength": 10,
-      "minLength": 3,
-      "pattern": "\\d+.\\d+"
-    },
-    "DriftStatus": {
-      "$ref": "#/definitions/LandingZoneDriftStatus"
-    },
-    "Manifest": {},
-    "Version": {
-      "type": "string",
-      "maxLength": 10,
-      "minLength": 3,
-      "pattern": "\\d+.\\d+"
-    },
-    "Tags": {
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/Tag"
-      }
-    }
-  },
-  "required": [
-    "Manifest",
-    "Version"
-  ],
-  "readOnlyProperties": [
-    "/properties/LandingZoneIdentifier",
-    "/properties/Arn",
-    "/properties/Status",
-    "/properties/LatestAvailableVersion",
-    "/properties/DriftStatus"
-  ],
-  "primaryIdentifier": [
-    "/properties/LandingZoneIdentifier"
-  ],
   "tagging": {
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
   },
   "handlers": {
+    "read": {
+      "permissions": [
+        "controltower:GetLandingZone",
+        "controltower:ListTagsForResource"
+      ]
+    },
     "create": {
       "permissions": [
         "controltower:CreateLandingZone",
@@ -127,12 +48,6 @@
         "sso:RegisterRegion"
       ]
     },
-    "read": {
-      "permissions": [
-        "controltower:GetLandingZone",
-        "controltower:ListTagsForResource"
-      ]
-    },
     "update": {
       "permissions": [
         "controltower:UpdateLandingZone",
@@ -169,6 +84,11 @@
         "sso:RegisterRegion"
       ]
     },
+    "list": {
+      "permissions": [
+        "controltower:ListLandingZones"
+      ]
+    },
     "delete": {
       "permissions": [
         "controltower:DeleteLandingZone",
@@ -194,12 +114,92 @@
         "iam:DetachRolePolicy",
         "iam:DeleteRole"
       ]
+    }
+  },
+  "typeName": "AWS::ControlTower::LandingZone",
+  "readOnlyProperties": [
+    "/properties/LandingZoneIdentifier",
+    "/properties/Arn",
+    "/properties/Status",
+    "/properties/LatestAvailableVersion",
+    "/properties/DriftStatus"
+  ],
+  "description": "Definition of AWS::ControlTower::LandingZone Resource Type",
+  "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/LandingZoneIdentifier"
+  ],
+  "definitions": {
+    "Tag": {
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Value": {
+          "minLength": 0,
+          "type": "string",
+          "maxLength": 256
+        },
+        "Key": {
+          "minLength": 1,
+          "type": "string",
+          "maxLength": 256
+        }
+      }
     },
-    "list": {
-      "permissions": [
-        "controltower:ListLandingZones"
+    "LandingZoneStatus": {
+      "type": "string",
+      "enum": [
+        "ACTIVE",
+        "PROCESSING",
+        "FAILED"
+      ]
+    },
+    "LandingZoneDriftStatus": {
+      "type": "string",
+      "enum": [
+        "DRIFTED",
+        "IN_SYNC"
       ]
     }
   },
-  "additionalProperties": false
+  "properties": {
+    "Status": {
+      "$ref": "#/definitions/LandingZoneStatus"
+    },
+    "LatestAvailableVersion": {
+      "minLength": 3,
+      "pattern": "\\d+.\\d+",
+      "type": "string",
+      "maxLength": 10
+    },
+    "Version": {
+      "minLength": 3,
+      "pattern": "\\d+.\\d+",
+      "type": "string",
+      "maxLength": 10
+    },
+    "DriftStatus": {
+      "$ref": "#/definitions/LandingZoneDriftStatus"
+    },
+    "Arn": {
+      "minLength": 20,
+      "pattern": "^arn:aws[0-9a-zA-Z_\\-:\\/]+$",
+      "type": "string",
+      "maxLength": 2048
+    },
+    "Manifest": {},
+    "LandingZoneIdentifier": {
+      "type": "string"
+    },
+    "Tags": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
+    }
+  },
+  "required": [
+    "Manifest",
+    "Version"
+  ]
 }
diff --git a/internal/aws/cfn/schemas/aws/deadline/fleet.json b/internal/aws/cfn/schemas/aws/deadline/fleet.json
index f7c7881e..a655bced 100644
--- a/internal/aws/cfn/schemas/aws/deadline/fleet.json
+++ b/internal/aws/cfn/schemas/aws/deadline/fleet.json
@@ -392,7 +392,8 @@
     "ServiceManagedFleetOperatingSystemFamily": {
       "type": "string",
       "enum": [
-        "LINUX"
+        "LINUX",
+        "WINDOWS"
       ]
     },
     "Tag": {
diff --git a/internal/aws/cfn/schemas/aws/dms/dataprovider.json b/internal/aws/cfn/schemas/aws/dms/dataprovider.json
index 40723d1c..b3edaefb 100644
--- a/internal/aws/cfn/schemas/aws/dms/dataprovider.json
+++ b/internal/aws/cfn/schemas/aws/dms/dataprovider.json
@@ -3,7 +3,11 @@
   "description": "Resource schema for AWS::DMS::DataProvider",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-dms.git",
   "tagging": {
-    "taggable": true
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
   },
   "definitions": {
     "Tag": {
@@ -280,7 +284,9 @@
         "dms:ListDataProviders",
         "dms:DescribeDataProviders",
         "dms:AddTagsToResource",
-        "dms:ListTagsForResource"
+        "dms:ListTagsForResource",
+        "iam:GetRole",
+        "iam:PassRole"
       ]
     },
     "read": {
diff --git a/internal/aws/cfn/schemas/aws/dms/instanceprofile.json b/internal/aws/cfn/schemas/aws/dms/instanceprofile.json
index db620f57..2603ff16 100644
--- a/internal/aws/cfn/schemas/aws/dms/instanceprofile.json
+++ b/internal/aws/cfn/schemas/aws/dms/instanceprofile.json
@@ -3,7 +3,11 @@
   "description": "Resource schema for AWS::DMS::InstanceProfile.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-csf.git",
   "tagging": {
-    "taggable": true
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
   },
   "definitions": {
     "Tag": {
diff --git a/internal/aws/cfn/schemas/aws/dms/migrationproject.json b/internal/aws/cfn/schemas/aws/dms/migrationproject.json
index f2210162..a3a6339e 100644
--- a/internal/aws/cfn/schemas/aws/dms/migrationproject.json
+++ b/internal/aws/cfn/schemas/aws/dms/migrationproject.json
@@ -3,7 +3,11 @@
   "description": "Resource schema for AWS::DMS::MigrationProject",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-csf.git",
   "tagging": {
-    "taggable": true
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
   },
   "definitions": {
     "Tag": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/customergateway.json b/internal/aws/cfn/schemas/aws/ec2/customergateway.json
index 167af8fa..c59d9329 100644
--- a/internal/aws/cfn/schemas/aws/ec2/customergateway.json
+++ b/internal/aws/cfn/schemas/aws/ec2/customergateway.json
@@ -68,7 +68,7 @@
         "Value",
         "Key"
       ],
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
     }
   },
   "required": [
diff --git a/internal/aws/cfn/schemas/aws/ec2/internetgateway.json b/internal/aws/cfn/schemas/aws/ec2/internetgateway.json
index 48cf8fc2..f7d4b544 100644
--- a/internal/aws/cfn/schemas/aws/ec2/internetgateway.json
+++ b/internal/aws/cfn/schemas/aws/ec2/internetgateway.json
@@ -24,7 +24,7 @@
         "Value",
         "Key"
       ],
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
     }
   },
   "properties": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/ipam.json b/internal/aws/cfn/schemas/aws/ec2/ipam.json
index a5d13159..afbcc62c 100644
--- a/internal/aws/cfn/schemas/aws/ec2/ipam.json
+++ b/internal/aws/cfn/schemas/aws/ec2/ipam.json
@@ -95,6 +95,10 @@
         "advanced"
       ]
     },
+    "EnablePrivateGua": {
+      "description": "Enable provisioning of GUA space in private pools.",
+      "type": "boolean"
+    },
     "Tags": {
       "description": "An array of key-value pairs to apply to this resource.",
       "type": "array",
diff --git a/internal/aws/cfn/schemas/aws/ec2/keypair.json b/internal/aws/cfn/schemas/aws/ec2/keypair.json
index 499c71fc..84d5e320 100644
--- a/internal/aws/cfn/schemas/aws/ec2/keypair.json
+++ b/internal/aws/cfn/schemas/aws/ec2/keypair.json
@@ -4,7 +4,7 @@
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "definitions": {
     "Tag": {
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications).",
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html).",
       "type": "object",
       "properties": {
         "Key": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json b/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json
index 649cb54d..bd45f89e 100644
--- a/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json
+++ b/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json
@@ -137,7 +137,7 @@
           "$ref": "#/definitions/EnclaveOptions"
         },
         "ImageId": {
-          "description": "The ID of the AMI. Alternatively, you can specify a Systems Manager parameter, which will resolve to an AMI ID on launch.\n Valid formats:\n  +   ``ami-17characters00000`` \n  +   ``resolve:ssm:parameter-name`` \n  +   ``resolve:ssm:parameter-name:version-number`` \n  +   ``resolve:ssm:parameter-name:label`` \n  \n For more information, see [Use a Systems Manager parameter to find an AMI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/finding-an-ami.html#using-systems-manager-parameter-to-find-AMI) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "The ID of the AMI. Alternatively, you can specify a Systems Manager parameter, which will resolve to an AMI ID on launch.\n Valid formats:\n  +   ``ami-0ac394d6a3example`` \n  +   ``resolve:ssm:parameter-name`` \n  +   ``resolve:ssm:parameter-name:version-number`` \n  +   ``resolve:ssm:parameter-name:label`` \n  \n For more information, see [Use a Systems Manager parameter to find an AMI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/finding-an-ami.html#using-systems-manager-parameter-to-find-AMI) in the *Amazon Elastic Compute Cloud User Guide*.",
           "type": "string"
         },
         "InstanceType": {
@@ -999,7 +999,7 @@
       }
     },
     "Tag": {
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications).",
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html).",
       "additionalProperties": false,
       "type": "object",
       "properties": {
@@ -1126,7 +1126,7 @@
     },
     "TagSpecifications": {
       "uniqueItems": false,
-      "description": "The tags to apply to the launch template on creation. To tag the launch template, the resource type must be ``launch-template``.\n To specify the tags for the resources that are created when an instance is launched, you must use [TagSpecifications](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-launchtemplate.html#cfn-ec2-launchtemplate-tagspecifications).",
+      "description": "The tags to apply to the launch template on creation. To tag the launch template, the resource type must be ``launch-template``.\n To specify the tags for the resources that are created when an instance is launched, you must use [TagSpecifications](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-launchtemplatedata.html#cfn-ec2-launchtemplate-launchtemplatedata-tagspecifications).",
       "type": "array",
       "items": {
         "$ref": "#/definitions/LaunchTemplateTagSpecification"
diff --git a/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetable.json b/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetable.json
index 59798266..5c3301ab 100644
--- a/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetable.json
+++ b/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetable.json
@@ -85,7 +85,12 @@
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
-    "cloudFormationSystemTags": false
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ec2:DeleteTags",
+      "ec2:CreateTags"
+    ]
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetablevpcassociation.json b/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetablevpcassociation.json
index 76a80c98..c1814989 100644
--- a/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetablevpcassociation.json
+++ b/internal/aws/cfn/schemas/aws/ec2/localgatewayroutetablevpcassociation.json
@@ -76,7 +76,12 @@
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
-    "cloudFormationSystemTags": false
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ec2:DeleteTags",
+      "ec2:CreateTags"
+    ]
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/networkacl.json b/internal/aws/cfn/schemas/aws/ec2/networkacl.json
index 1003191e..aff7a777 100644
--- a/internal/aws/cfn/schemas/aws/ec2/networkacl.json
+++ b/internal/aws/cfn/schemas/aws/ec2/networkacl.json
@@ -21,7 +21,7 @@
         "Value",
         "Key"
       ],
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
     }
   },
   "properties": {
@@ -40,7 +40,11 @@
     },
     "VpcId": {
       "description": "The ID of the VPC for the network ACL.",
-      "type": "string"
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::EC2::VPC",
+        "propertyPath": "/properties/VpcId"
+      }
     }
   },
   "required": [
diff --git a/internal/aws/cfn/schemas/aws/ec2/routetable.json b/internal/aws/cfn/schemas/aws/ec2/routetable.json
index 614a8144..9d776c4f 100644
--- a/internal/aws/cfn/schemas/aws/ec2/routetable.json
+++ b/internal/aws/cfn/schemas/aws/ec2/routetable.json
@@ -20,7 +20,7 @@
         "Value",
         "Key"
       ],
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
     }
   },
   "properties": {
@@ -39,7 +39,11 @@
     },
     "VpcId": {
       "description": "The ID of the VPC.",
-      "type": "string"
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::EC2::VPC",
+        "propertyPath": "/properties/VpcId"
+      }
     }
   },
   "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/ec2/securitygroup.json b/internal/aws/cfn/schemas/aws/ec2/securitygroup.json
index e1c7ba4b..97b8680d 100644
--- a/internal/aws/cfn/schemas/aws/ec2/securitygroup.json
+++ b/internal/aws/cfn/schemas/aws/ec2/securitygroup.json
@@ -1,5 +1,9 @@
 {
   "tagging": {
+    "permissions": [
+      "ec2:CreateTags",
+      "ec2:DeleteTags"
+    ],
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
@@ -69,6 +73,7 @@
     },
     "delete": {
       "permissions": [
+        "ec2:DescribeSecurityGroups",
         "ec2:DeleteSecurityGroup",
         "ec2:DescribeInstances"
       ]
diff --git a/internal/aws/cfn/schemas/aws/ec2/subnet.json b/internal/aws/cfn/schemas/aws/ec2/subnet.json
index ac4735f6..2a939541 100644
--- a/internal/aws/cfn/schemas/aws/ec2/subnet.json
+++ b/internal/aws/cfn/schemas/aws/ec2/subnet.json
@@ -129,7 +129,7 @@
         "Value",
         "Key"
       ],
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
     }
   },
   "required": [
diff --git a/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json b/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json
index a94a13c1..3a3d75b2 100644
--- a/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json
+++ b/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json
@@ -1,41 +1,82 @@
 {
-  "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
-  },
-  "$schema": "https://schema.cloudformation.us-east-1.amazonaws.com/provider.definition.schema.v1.json",
   "typeName": "AWS::EC2::SubnetCidrBlock",
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
+  "$schema": "https://schema.cloudformation.us-east-1.amazonaws.com/provider.definition.schema.v1.json",
   "description": "The AWS::EC2::SubnetCidrBlock resource creates association between subnet and IPv6 CIDR",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-ec2/subnetcidrblock",
+  "additionalProperties": false,
+  "properties": {
+    "Id": {
+      "description": "Information about the IPv6 association.",
+      "type": "string"
+    },
+    "Ipv6CidrBlock": {
+      "description": "The IPv6 network range for the subnet, in CIDR notation. The subnet size must use a /64 prefix length",
+      "type": "string",
+      "maxLength": 42
+    },
+    "Ipv6IpamPoolId": {
+      "description": "The ID of an IPv6 Amazon VPC IP Address Manager (IPAM) pool from which to allocate, to get the subnet's CIDR",
+      "type": "string"
+    },
+    "Ipv6NetmaskLength": {
+      "description": "The netmask length of the IPv6 CIDR to allocate to the subnet from an IPAM pool",
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 128
+    },
+    "SubnetId": {
+      "description": "The ID of the subnet",
+      "type": "string"
+    },
+    "Ipv6AddressAttribute": {
+      "type": "string",
+      "description": "The value denoting whether an IPv6 Subnet CIDR Block is public or private."
+    },
+    "IpSource": {
+      "type": "string",
+      "description": "The IP Source of an IPv6 Subnet CIDR Block."
+    }
+  },
+  "required": [
+    "SubnetId"
+  ],
   "createOnlyProperties": [
     "/properties/Ipv6CidrBlock",
     "/properties/SubnetId",
     "/properties/Ipv6IpamPoolId",
     "/properties/Ipv6NetmaskLength"
   ],
+  "readOnlyProperties": [
+    "/properties/Id",
+    "/properties/Ipv6AddressAttribute",
+    "/properties/IpSource"
+  ],
+  "writeOnlyProperties": [
+    "/properties/Ipv6IpamPoolId",
+    "/properties/Ipv6NetmaskLength"
+  ],
   "primaryIdentifier": [
     "/properties/Id"
   ],
-  "required": [
-    "SubnetId"
-  ],
-  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-ec2/subnetcidrblock",
   "propertyTransform": {
     "/properties/Ipv6CidrBlock": "$join([$match($replace(Ipv6CidrBlock, /(^|:)(0{1,4})([0-9a-fA-F]{1,4})/, \"$1$3\"), /^([0-9a-fA-F]{1,4}:){4}/).match, \":/64\"])"
   },
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
   "handlers": {
-    "read": {
+    "create": {
       "permissions": [
+        "ec2:AssociateSubnetCidrBlock",
         "ec2:DescribeSubnets"
       ]
     },
-    "create": {
+    "delete": {
       "permissions": [
-        "ec2:AssociateSubnetCidrBlock",
+        "ec2:DisassociateSubnetCidrBlock",
         "ec2:DescribeSubnets"
       ]
     },
@@ -44,41 +85,10 @@
         "ec2:DescribeSubnets"
       ]
     },
-    "delete": {
+    "read": {
       "permissions": [
-        "ec2:DisassociateSubnetCidrBlock",
         "ec2:DescribeSubnets"
       ]
     }
-  },
-  "writeOnlyProperties": [
-    "/properties/Ipv6IpamPoolId",
-    "/properties/Ipv6NetmaskLength"
-  ],
-  "additionalProperties": false,
-  "properties": {
-    "Ipv6NetmaskLength": {
-      "description": "The netmask length of the IPv6 CIDR to allocate to the subnet from an IPAM pool",
-      "maximum": 128,
-      "type": "integer",
-      "minimum": 0
-    },
-    "Ipv6IpamPoolId": {
-      "description": "The ID of an IPv6 Amazon VPC IP Address Manager (IPAM) pool from which to allocate, to get the subnet's CIDR",
-      "type": "string"
-    },
-    "Id": {
-      "description": "Information about the IPv6 association.",
-      "type": "string"
-    },
-    "SubnetId": {
-      "description": "The ID of the subnet",
-      "type": "string"
-    },
-    "Ipv6CidrBlock": {
-      "description": "The IPv6 network range for the subnet, in CIDR notation. The subnet size must use a /64 prefix length",
-      "type": "string",
-      "maxLength": 42
-    }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/ec2/subnetroutetableassociation.json b/internal/aws/cfn/schemas/aws/ec2/subnetroutetableassociation.json
index 46a95b32..ebe14902 100644
--- a/internal/aws/cfn/schemas/aws/ec2/subnetroutetableassociation.json
+++ b/internal/aws/cfn/schemas/aws/ec2/subnetroutetableassociation.json
@@ -10,10 +10,18 @@
     },
     "RouteTableId": {
       "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::EC2::RouteTable",
+        "propertyPath": "/properties/RouteTableId"
+      },
       "description": "The ID of the route table.\n The physical ID changes when the route table ID is changed."
     },
     "SubnetId": {
       "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::EC2::Subnet",
+        "propertyPath": "/properties/SubnetId"
+      },
       "description": "The ID of the subnet."
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgateway.json b/internal/aws/cfn/schemas/aws/ec2/transitgateway.json
index a90d21b9..143f433b 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgateway.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgateway.json
@@ -1,7 +1,11 @@
 {
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-transitgateway",
   "tagging": {
-    "taggable": true
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
   },
   "handlers": {
     "read": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewayattachment.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewayattachment.json
index 6ef3cfe8..69a298e6 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewayattachment.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewayattachment.json
@@ -1,100 +1,14 @@
 {
-  "typeName": "AWS::EC2::TransitGatewayAttachment",
-  "description": "Resource Type definition for AWS::EC2::TransitGatewayAttachment",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-transitgateway",
-  "additionalProperties": false,
-  "properties": {
-    "Id": {
-      "type": "string"
-    },
-    "TransitGatewayId": {
-      "type": "string"
-    },
-    "VpcId": {
-      "type": "string"
-    },
-    "SubnetIds": {
-      "type": "array",
-      "insertionOrder": false,
-      "uniqueItems": false,
-      "items": {
-        "type": "string"
-      }
-    },
-    "Tags": {
-      "type": "array",
-      "insertionOrder": false,
-      "uniqueItems": false,
-      "items": {
-        "$ref": "#/definitions/Tag"
-      }
-    },
-    "Options": {
-      "description": "The options for the transit gateway vpc attachment.",
-      "type": "object",
-      "properties": {
-        "DnsSupport": {
-          "description": "Indicates whether to enable DNS Support for Vpc Attachment. Valid Values: enable | disable",
-          "type": "string"
-        },
-        "Ipv6Support": {
-          "description": "Indicates whether to enable Ipv6 Support for Vpc Attachment. Valid Values: enable | disable",
-          "type": "string"
-        },
-        "ApplianceModeSupport": {
-          "description": "Indicates whether to enable Ipv6 Support for Vpc Attachment. Valid Values: enable | disable",
-          "type": "string"
-        },
-        "SecurityGroupReferencingSupport": {
-          "description": "Indicates whether to enable Security Group referencing support for Vpc Attachment. Valid Values: enable | disable",
-          "type": "string"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "definitions": {
-    "Tag": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Key": {
-          "type": "string"
-        },
-        "Value": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "Value",
-        "Key"
-      ]
-    }
-  },
-  "required": [
-    "VpcId",
-    "SubnetIds",
-    "TransitGatewayId"
-  ],
   "tagging": {
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
-    "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": false
   },
-  "createOnlyProperties": [
-    "/properties/TransitGatewayId",
-    "/properties/VpcId"
-  ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "primaryIdentifier": [
-    "/properties/Id"
-  ],
   "handlers": {
-    "create": {
+    "read": {
       "permissions": [
         "ec2:DescribeTransitGatewayAttachments",
         "ec2:DescribeTransitGatewayVpcAttachments",
@@ -107,7 +21,7 @@
         "ec2:ModifyTransitGatewayVpcAttachment"
       ]
     },
-    "read": {
+    "create": {
       "permissions": [
         "ec2:DescribeTransitGatewayAttachments",
         "ec2:DescribeTransitGatewayVpcAttachments",
@@ -120,16 +34,15 @@
         "ec2:ModifyTransitGatewayVpcAttachment"
       ]
     },
-    "delete": {
+    "update": {
       "permissions": [
         "ec2:DescribeTransitGatewayAttachments",
         "ec2:DescribeTransitGatewayVpcAttachments",
+        "ec2:DescribeTags",
         "ec2:CreateTransitGatewayVpcAttachment",
-        "ec2:DeleteTransitGatewayVpcAttachment",
         "ec2:CreateTags",
+        "ec2:DeleteTransitGatewayVpcAttachment",
         "ec2:DeleteTags",
-        "ec2:DescribeTags",
-        "ec2:DescribeTransitGatewayAttachments",
         "ec2:ModifyTransitGatewayVpcAttachment"
       ]
     },
@@ -145,17 +58,112 @@
         "ec2:ModifyTransitGatewayVpcAttachment"
       ]
     },
-    "update": {
+    "delete": {
       "permissions": [
         "ec2:DescribeTransitGatewayAttachments",
         "ec2:DescribeTransitGatewayVpcAttachments",
-        "ec2:DescribeTags",
         "ec2:CreateTransitGatewayVpcAttachment",
-        "ec2:CreateTags",
         "ec2:DeleteTransitGatewayVpcAttachment",
+        "ec2:CreateTags",
         "ec2:DeleteTags",
+        "ec2:DescribeTags",
+        "ec2:DescribeTransitGatewayAttachments",
         "ec2:ModifyTransitGatewayVpcAttachment"
       ]
     }
+  },
+  "typeName": "AWS::EC2::TransitGatewayAttachment",
+  "readOnlyProperties": [
+    "/properties/Id"
+  ],
+  "description": "Resource Type definition for AWS::EC2::TransitGatewayAttachment",
+  "createOnlyProperties": [
+    "/properties/TransitGatewayId",
+    "/properties/VpcId"
+  ],
+  "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/Id"
+  ],
+  "definitions": {
+    "Tag": {
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Value": {
+          "type": "string"
+        },
+        "Key": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Value",
+        "Key"
+      ]
+    }
+  },
+  "required": [
+    "VpcId",
+    "SubnetIds",
+    "TransitGatewayId"
+  ],
+  "properties": {
+    "Options": {
+      "description": "The options for the transit gateway vpc attachment.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Ipv6Support": {
+          "description": "Indicates whether to enable Ipv6 Support for Vpc Attachment. Valid Values: enable | disable",
+          "type": "string"
+        },
+        "ApplianceModeSupport": {
+          "description": "Indicates whether to enable Ipv6 Support for Vpc Attachment. Valid Values: enable | disable",
+          "type": "string"
+        },
+        "DnsSupport": {
+          "description": "Indicates whether to enable DNS Support for Vpc Attachment. Valid Values: enable | disable",
+          "type": "string"
+        }
+      }
+    },
+    "TransitGatewayId": {
+      "relationshipRef": {
+        "typeName": "AWS::EC2::TransitGateway",
+        "propertyPath": "/properties/Id"
+      },
+      "type": "string"
+    },
+    "VpcId": {
+      "relationshipRef": {
+        "typeName": "AWS::EC2::VPC",
+        "propertyPath": "/properties/VpcId"
+      },
+      "type": "string"
+    },
+    "Id": {
+      "type": "string"
+    },
+    "SubnetIds": {
+      "uniqueItems": false,
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "relationshipRef": {
+          "typeName": "AWS::EC2::Subnet",
+          "propertyPath": "/properties/SubnetId"
+        },
+        "type": "string"
+      }
+    },
+    "Tags": {
+      "uniqueItems": false,
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
+    }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewayconnect.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewayconnect.json
index 7a8d4475..99584dc3 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewayconnect.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewayconnect.json
@@ -65,6 +65,13 @@
       "additionalProperties": false
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "additionalProperties": false,
   "readOnlyProperties": [
     "/properties/TransitGatewayAttachmentId",
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomain.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomain.json
index 9628fa2c..1b7a87a5 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomain.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomain.json
@@ -74,6 +74,13 @@
   "createOnlyProperties": [
     "/properties/TransitGatewayId"
   ],
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "readOnlyProperties": [
     "/properties/TransitGatewayMulticastDomainId",
     "/properties/State",
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomainassociation.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomainassociation.json
index fdba7c51..a211fe65 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomainassociation.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastdomainassociation.json
@@ -33,6 +33,12 @@
     "TransitGatewayAttachmentId",
     "SubnetId"
   ],
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
   "additionalProperties": false,
   "readOnlyProperties": [
     "/properties/ResourceId",
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupmember.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupmember.json
index 1d1c5fe9..f1ecf96a 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupmember.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupmember.json
@@ -42,10 +42,6 @@
     "MemberType": {
       "description": "The member type (for example, static).",
       "type": "string"
-    },
-    "SourceType": {
-      "description": "The source type.",
-      "type": "string"
     }
   },
   "required": [
@@ -53,6 +49,12 @@
     "NetworkInterfaceId",
     "TransitGatewayMulticastDomainId"
   ],
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
   "additionalProperties": false,
   "readOnlyProperties": [
     "/properties/SubnetId",
@@ -61,7 +63,6 @@
     "/properties/GroupSource",
     "/properties/GroupMember",
     "/properties/MemberType",
-    "/properties/SourceType",
     "/properties/TransitGatewayAttachmentId"
   ],
   "createOnlyProperties": [
@@ -93,6 +94,16 @@
       ]
     },
     "list": {
+      "handlerSchema": {
+        "properties": {
+          "TransitGatewayMulticastDomainId": {
+            "$ref": "resource-schema.json#/properties/TransitGatewayMulticastDomainId"
+          }
+        },
+        "required": [
+          "TransitGatewayMulticastDomainId"
+        ]
+      },
       "permissions": [
         "ec2:SearchTransitGatewayMulticastGroups"
       ]
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupsource.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupsource.json
index 70688696..5c930637 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupsource.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewaymulticastgroupsource.json
@@ -39,10 +39,6 @@
       "description": "Indicates that the resource is a transit gateway multicast group member.",
       "type": "boolean"
     },
-    "MemberType": {
-      "description": "The member type (for example, static).",
-      "type": "string"
-    },
     "SourceType": {
       "description": "The source type.",
       "type": "string"
@@ -53,6 +49,12 @@
     "NetworkInterfaceId",
     "GroupIpAddress"
   ],
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
   "additionalProperties": false,
   "readOnlyProperties": [
     "/properties/SubnetId",
@@ -60,7 +62,6 @@
     "/properties/ResourceType",
     "/properties/GroupSource",
     "/properties/GroupMember",
-    "/properties/MemberType",
     "/properties/SourceType",
     "/properties/TransitGatewayAttachmentId"
   ],
@@ -93,6 +94,16 @@
       ]
     },
     "list": {
+      "handlerSchema": {
+        "properties": {
+          "TransitGatewayMulticastDomainId": {
+            "$ref": "resource-schema.json#/properties/TransitGatewayMulticastDomainId"
+          }
+        },
+        "required": [
+          "TransitGatewayMulticastDomainId"
+        ]
+      },
       "permissions": [
         "ec2:SearchTransitGatewayMulticastGroups"
       ]
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewaypeeringattachment.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewaypeeringattachment.json
index 73088790..be19e94b 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewaypeeringattachment.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewaypeeringattachment.json
@@ -1,4 +1,34 @@
 {
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
+  "typeName": "AWS::EC2::TransitGatewayPeeringAttachment",
+  "readOnlyProperties": [
+    "/properties/TransitGatewayAttachmentId",
+    "/properties/Status",
+    "/properties/State",
+    "/properties/CreationTime"
+  ],
+  "description": "The AWS::EC2::TransitGatewayPeeringAttachment type",
+  "createOnlyProperties": [
+    "/properties/TransitGatewayId",
+    "/properties/PeerTransitGatewayId",
+    "/properties/PeerRegion",
+    "/properties/PeerAccountId"
+  ],
+  "primaryIdentifier": [
+    "/properties/TransitGatewayAttachmentId"
+  ],
+  "required": [
+    "TransitGatewayId",
+    "PeerTransitGatewayId",
+    "PeerAccountId",
+    "PeerRegion"
+  ],
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-myservice",
   "handlers": {
     "read": {
@@ -9,12 +39,15 @@
     "create": {
       "permissions": [
         "ec2:CreateTransitGatewayPeeringAttachment",
-        "ec2:DescribeTransitGatewayPeeringAttachments"
+        "ec2:DescribeTransitGatewayPeeringAttachments",
+        "ec2:CreateTags"
       ]
     },
     "update": {
       "permissions": [
-        "ec2:DescribeTransitGatewayPeeringAttachments"
+        "ec2:DescribeTransitGatewayPeeringAttachments",
+        "ec2:CreateTags",
+        "ec2:DeleteTags"
       ]
     },
     "list": {
@@ -25,28 +58,12 @@
     "delete": {
       "permissions": [
         "ec2:DeleteTransitGatewayPeeringAttachment",
-        "ec2:DescribeTransitGatewayPeeringAttachments"
+        "ec2:DescribeTransitGatewayPeeringAttachments",
+        "ec2:DeleteTags"
       ]
     }
   },
-  "typeName": "AWS::EC2::TransitGatewayPeeringAttachment",
-  "readOnlyProperties": [
-    "/properties/TransitGatewayAttachmentId",
-    "/properties/Status",
-    "/properties/State",
-    "/properties/CreationTime"
-  ],
-  "description": "The AWS::EC2::TransitGatewayPeeringAttachment type",
-  "createOnlyProperties": [
-    "/properties/TransitGatewayId",
-    "/properties/PeerTransitGatewayId",
-    "/properties/PeerRegion",
-    "/properties/PeerAccountId"
-  ],
   "additionalProperties": false,
-  "primaryIdentifier": [
-    "/properties/TransitGatewayAttachmentId"
-  ],
   "definitions": {
     "Tag": {
       "additionalProperties": false,
@@ -77,12 +94,6 @@
       }
     }
   },
-  "required": [
-    "TransitGatewayId",
-    "PeerTransitGatewayId",
-    "PeerAccountId",
-    "PeerRegion"
-  ],
   "properties": {
     "Status": {
       "description": "The status of the transit gateway peering attachment.",
diff --git a/internal/aws/cfn/schemas/aws/ec2/vpc.json b/internal/aws/cfn/schemas/aws/ec2/vpc.json
index e83b9ab6..572cfe0b 100644
--- a/internal/aws/cfn/schemas/aws/ec2/vpc.json
+++ b/internal/aws/cfn/schemas/aws/ec2/vpc.json
@@ -1,6 +1,6 @@
 {
   "typeName": "AWS::EC2::VPC",
-  "description": "Specifies a virtual private cloud (VPC).\n You can optionally request an IPv6 CIDR block for the VPC. You can request an Amazon-provided IPv6 CIDR block from Amazon's pool of IPv6 addresses, or an IPv6 CIDR block from an IPv6 address pool that you provisioned through bring your own IP addresses (BYOIP).\n For more information, see [Virtual private clouds (VPC)](https://docs.aws.amazon.com/vpc/latest/userguide/configure-your-vpc.html) in the *Amazon VPC User Guide*.",
+  "description": "Specifies a virtual private cloud (VPC).\n To add an IPv6 CIDR block to the VPC, see [AWS::EC2::VPCCidrBlock](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpccidrblock.html).\n For more information, see [Virtual private clouds (VPC)](https://docs.aws.amazon.com/vpc/latest/userguide/configure-your-vpc.html) in the *Amazon VPC User Guide*.",
   "additionalProperties": false,
   "properties": {
     "VpcId": {
@@ -53,7 +53,7 @@
     },
     "InstanceTenancy": {
       "type": "string",
-      "description": "The allowed tenancy of instances launched into the VPC.\n  +  ``default``: An instance launched into the VPC runs on shared hardware by default, unless you explicitly specify a different tenancy during instance launch.\n  +  ``dedicated``: An instance launched into the VPC runs on dedicated hardware by default, unless you explicitly specify a tenancy of ``host`` during instance launch. You cannot specify a tenancy of ``default`` during instance launch.\n  \n Updating ``InstanceTenancy`` requires no replacement only if you are updating its value from ``dedicated`` to ``default``. Updating ``InstanceTenancy`` from ``default`` to ``dedicated`` requires replacement."
+      "description": "The allowed tenancy of instances launched into the VPC.\n  +   ``default``: An instance launched into the VPC runs on shared hardware by default, unless you explicitly specify a different tenancy during instance launch.\n  +   ``dedicated``: An instance launched into the VPC runs on dedicated hardware by default, unless you explicitly specify a tenancy of ``host`` during instance launch. You cannot specify a tenancy of ``default`` during instance launch.\n  \n Updating ``InstanceTenancy`` requires no replacement only if you are updating its value from ``dedicated`` to ``default``. Updating ``InstanceTenancy`` from ``default`` to ``dedicated`` requires replacement."
     },
     "Ipv4IpamPoolId": {
       "type": "string",
diff --git a/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json b/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json
index 4d8ca8c2..cf275124 100644
--- a/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json
+++ b/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json
@@ -1,53 +1,62 @@
 {
-  "tagging": {
-    "taggable": false
-  },
-  "handlers": {
-    "read": {
-      "permissions": [
-        "ec2:DescribeVpcs"
-      ]
+  "typeName": "AWS::EC2::VPCCidrBlock",
+  "description": "Resource Type definition for AWS::EC2::VPCCidrBlock",
+  "additionalProperties": false,
+  "properties": {
+    "CidrBlock": {
+      "type": "string",
+      "description": "An IPv4 CIDR block to associate with the VPC."
     },
-    "create": {
-      "permissions": [
-        "ec2:AssociateVpcCidrBlock",
-        "ec2:DescribeVpcs",
-        "ec2:AllocateIpamPoolCidr"
-      ]
+    "Ipv6Pool": {
+      "type": "string",
+      "description": "The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block."
     },
-    "list": {
-      "permissions": [
-        "ec2:DescribeVpcs"
-      ],
-      "handlerSchema": {
-        "properties": {
-          "VpcId": {
-            "description": "The ID of the VPC.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "VpcId"
-        ]
-      }
+    "Id": {
+      "type": "string",
+      "description": "The Id of the VPC associated CIDR Block."
     },
-    "delete": {
-      "permissions": [
-        "ec2:DescribeVpcs",
-        "ec2:DisassociateVpcCidrBlock"
-      ]
+    "VpcId": {
+      "type": "string",
+      "description": "The ID of the VPC."
+    },
+    "Ipv6CidrBlock": {
+      "type": "string",
+      "description": "An IPv6 CIDR block from the IPv6 address pool."
+    },
+    "Ipv4IpamPoolId": {
+      "type": "string",
+      "description": "The ID of the IPv4 IPAM pool to Associate a CIDR from to a VPC."
+    },
+    "Ipv4NetmaskLength": {
+      "type": "integer",
+      "description": "The netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool."
+    },
+    "Ipv6IpamPoolId": {
+      "type": "string",
+      "description": "The ID of the IPv6 IPAM pool to Associate a CIDR from to a VPC."
+    },
+    "Ipv6NetmaskLength": {
+      "type": "integer",
+      "description": "The netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool."
+    },
+    "AmazonProvidedIpv6CidrBlock": {
+      "type": "boolean",
+      "description": "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IPv6 addresses, or the size of the CIDR block."
+    },
+    "Ipv6AddressAttribute": {
+      "type": "string",
+      "description": "The value denoting whether an IPv6 VPC CIDR Block is public or private."
+    },
+    "IpSource": {
+      "type": "string",
+      "description": "The IP Source of an IPv6 VPC CIDR Block."
     }
   },
-  "typeName": "AWS::EC2::VPCCidrBlock",
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "description": "Resource Type definition for AWS::EC2::VPCCidrBlock",
-  "writeOnlyProperties": [
-    "/properties/Ipv4IpamPoolId",
-    "/properties/Ipv4NetmaskLength",
-    "/properties/Ipv6IpamPoolId",
-    "/properties/Ipv6NetmaskLength"
+  "tagging": {
+    "taggable": false
+  },
+  "required": [
+    "VpcId"
   ],
   "createOnlyProperties": [
     "/properties/Ipv6Pool",
@@ -60,54 +69,55 @@
     "/properties/Ipv6IpamPoolId",
     "/properties/Ipv6NetmaskLength"
   ],
-  "additionalProperties": false,
   "primaryIdentifier": [
     "/properties/Id",
     "/properties/VpcId"
   ],
-  "properties": {
-    "Ipv6NetmaskLength": {
-      "description": "The netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.",
-      "type": "integer"
-    },
-    "Ipv6IpamPoolId": {
-      "description": "The ID of the IPv6 IPAM pool to Associate a CIDR from to a VPC.",
-      "type": "string"
-    },
-    "VpcId": {
-      "description": "The ID of the VPC.",
-      "type": "string"
-    },
-    "Ipv4NetmaskLength": {
-      "description": "The netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.",
-      "type": "integer"
-    },
-    "CidrBlock": {
-      "description": "An IPv4 CIDR block to associate with the VPC.",
-      "type": "string"
-    },
-    "Ipv6Pool": {
-      "description": "The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block.",
-      "type": "string"
-    },
-    "Ipv4IpamPoolId": {
-      "description": "The ID of the IPv4 IPAM pool to Associate a CIDR from to a VPC.",
-      "type": "string"
+  "readOnlyProperties": [
+    "/properties/Id",
+    "/properties/Ipv6AddressAttribute",
+    "/properties/IpSource"
+  ],
+  "writeOnlyProperties": [
+    "/properties/Ipv4IpamPoolId",
+    "/properties/Ipv4NetmaskLength",
+    "/properties/Ipv6IpamPoolId",
+    "/properties/Ipv6NetmaskLength"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "ec2:AssociateVpcCidrBlock",
+        "ec2:DescribeVpcs",
+        "ec2:AllocateIpamPoolCidr"
+      ]
     },
-    "Id": {
-      "description": "The Id of the VPC associated CIDR Block.",
-      "type": "string"
+    "read": {
+      "permissions": [
+        "ec2:DescribeVpcs"
+      ]
     },
-    "Ipv6CidrBlock": {
-      "description": "An IPv6 CIDR block from the IPv6 address pool.",
-      "type": "string"
+    "delete": {
+      "permissions": [
+        "ec2:DescribeVpcs",
+        "ec2:DisassociateVpcCidrBlock"
+      ]
     },
-    "AmazonProvidedIpv6CidrBlock": {
-      "description": "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IPv6 addresses, or the size of the CIDR block.",
-      "type": "boolean"
+    "list": {
+      "handlerSchema": {
+        "properties": {
+          "VpcId": {
+            "type": "string",
+            "description": "The ID of the VPC."
+          }
+        },
+        "required": [
+          "VpcId"
+        ]
+      },
+      "permissions": [
+        "ec2:DescribeVpcs"
+      ]
     }
-  },
-  "required": [
-    "VpcId"
-  ]
+  }
 }
diff --git a/internal/aws/cfn/schemas/aws/ec2/vpcpeeringconnection.json b/internal/aws/cfn/schemas/aws/ec2/vpcpeeringconnection.json
index d5055da4..af629d0f 100644
--- a/internal/aws/cfn/schemas/aws/ec2/vpcpeeringconnection.json
+++ b/internal/aws/cfn/schemas/aws/ec2/vpcpeeringconnection.json
@@ -21,11 +21,19 @@
     },
     "PeerVpcId": {
       "description": "The ID of the VPC with which you are creating the VPC peering connection. You must specify this parameter in the request.",
-      "type": "string"
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::EC2::VPC",
+        "propertyPath": "/properties/VpcId"
+      }
     },
     "VpcId": {
       "description": "The ID of the VPC.",
-      "type": "string"
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::EC2::VPC",
+        "propertyPath": "/properties/VpcId"
+      }
     },
     "Tags": {
       "type": "array",
diff --git a/internal/aws/cfn/schemas/aws/ec2/vpngateway.json b/internal/aws/cfn/schemas/aws/ec2/vpngateway.json
index 566d8f2d..05b2ee59 100644
--- a/internal/aws/cfn/schemas/aws/ec2/vpngateway.json
+++ b/internal/aws/cfn/schemas/aws/ec2/vpngateway.json
@@ -20,7 +20,7 @@
         "Value",
         "Key"
       ],
-      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
+      "description": "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
     }
   },
   "properties": {
diff --git a/internal/aws/cfn/schemas/aws/ecs/cluster.json b/internal/aws/cfn/schemas/aws/ecs/cluster.json
index 8225acd7..54f09f0d 100644
--- a/internal/aws/cfn/schemas/aws/ecs/cluster.json
+++ b/internal/aws/cfn/schemas/aws/ecs/cluster.json
@@ -2,6 +2,9 @@
   "tagging": {
     "taggable": true
   },
+  "propertyTransform": {
+    "/properties/Configuration/ManagedStorageConfiguration/FargateEphemeralStorageKmsKeyId": "$join([\"arn:aws[-a-z]*:kms:[a-z0-9-]+:[0-9]{12}:key/\", FargateEphemeralStorageKmsKeyId])"
+  },
   "handlers": {
     "read": {
       "permissions": [
@@ -132,14 +135,16 @@
       }
     },
     "ManagedStorageConfiguration": {
-      "description": "",
+      "description": "The managed storage configuration for the cluster.",
       "additionalProperties": false,
       "type": "object",
       "properties": {
         "FargateEphemeralStorageKmsKeyId": {
+          "description": "Specify the KMSlong key ID for the Fargate ephemeral storage.",
           "type": "string"
         },
         "KmsKeyId": {
+          "description": "Specify a KMSlong key ID to encrypt the managed storage.",
           "type": "string"
         }
       }
@@ -171,12 +176,12 @@
       }
     },
     "ClusterConfiguration": {
-      "description": "The execute command configuration for the cluster.",
+      "description": "The execute command and managed storage configuration for the cluster.",
       "additionalProperties": false,
       "type": "object",
       "properties": {
         "ManagedStorageConfiguration": {
-          "description": "",
+          "description": "The details of the managed storage configuration.",
           "$ref": "#/definitions/ManagedStorageConfiguration"
         },
         "ExecuteCommandConfiguration": {
@@ -225,7 +230,7 @@
       }
     },
     "Configuration": {
-      "description": "The execute command configuration for the cluster.",
+      "description": "The execute command and managed storage configuration for the cluster.",
       "$ref": "#/definitions/ClusterConfiguration"
     },
     "ServiceConnectDefaults": {
diff --git a/internal/aws/cfn/schemas/aws/ecs/clustercapacityproviderassociations.json b/internal/aws/cfn/schemas/aws/ecs/clustercapacityproviderassociations.json
index d701e212..00b29cee 100644
--- a/internal/aws/cfn/schemas/aws/ecs/clustercapacityproviderassociations.json
+++ b/internal/aws/cfn/schemas/aws/ecs/clustercapacityproviderassociations.json
@@ -1,19 +1,61 @@
 {
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "tagging": {
+    "tagOnCreate": false,
+    "taggable": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
+  "handlers": {
+    "read": {
+      "permissions": [
+        "ecs:DescribeClusters"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "ecs:DescribeClusters",
+        "ecs:PutClusterCapacityProviders"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "ecs:DescribeClusters",
+        "ecs:PutClusterCapacityProviders"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "ecs:DescribeClusters",
+        "ecs:ListClusters"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "ecs:PutClusterCapacityProviders",
+        "ecs:DescribeClusters"
+      ]
+    }
+  },
   "typeName": "AWS::ECS::ClusterCapacityProviderAssociations",
   "description": "Associate a set of ECS Capacity Providers with a specified ECS Cluster",
-  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "createOnlyProperties": [
+    "/properties/Cluster"
+  ],
+  "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/Cluster"
+  ],
   "definitions": {
-    "CapacityProviders": {
+    "DefaultCapacityProviderStrategy": {
       "description": "List of capacity providers to associate with the cluster",
       "type": "array",
       "items": {
-        "$ref": "#/definitions/CapacityProvider"
-      },
-      "uniqueItems": true
+        "$ref": "#/definitions/CapacityProviderStrategy"
+      }
     },
     "CapacityProvider": {
       "description": "If using ec2 auto-scaling, the name of the associated capacity provider. Otherwise FARGATE, FARGATE_SPOT.",
-      "type": "string",
       "anyOf": [
         {
           "type": "string",
@@ -23,106 +65,64 @@
           ]
         },
         {
-          "type": "string",
           "minLength": 1,
+          "type": "string",
           "maxLength": 2048
         }
-      ]
-    },
-    "Cluster": {
-      "description": "The name of the cluster",
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 2048
+      ],
+      "type": "string"
     },
-    "DefaultCapacityProviderStrategy": {
+    "CapacityProviders": {
+      "uniqueItems": true,
       "description": "List of capacity providers to associate with the cluster",
       "type": "array",
       "items": {
-        "$ref": "#/definitions/CapacityProviderStrategy"
+        "$ref": "#/definitions/CapacityProvider"
       }
     },
+    "Cluster": {
+      "minLength": 1,
+      "description": "The name of the cluster",
+      "type": "string",
+      "maxLength": 2048
+    },
     "CapacityProviderStrategy": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
+        "CapacityProvider": {
+          "$ref": "#/definitions/CapacityProvider"
+        },
         "Base": {
+          "maximum": 100000,
           "type": "integer",
-          "minimum": 0,
-          "maximum": 100000
+          "minimum": 0
         },
         "Weight": {
+          "maximum": 1000,
           "type": "integer",
-          "minimum": 0,
-          "maximum": 1000
-        },
-        "CapacityProvider": {
-          "$ref": "#/definitions/CapacityProvider"
+          "minimum": 0
         }
       },
       "required": [
         "CapacityProvider"
-      ],
-      "additionalProperties": false
+      ]
     }
   },
-  "additionalProperties": false,
   "properties": {
+    "DefaultCapacityProviderStrategy": {
+      "$ref": "#/definitions/DefaultCapacityProviderStrategy"
+    },
     "CapacityProviders": {
       "$ref": "#/definitions/CapacityProviders"
     },
     "Cluster": {
       "$ref": "#/definitions/Cluster"
-    },
-    "DefaultCapacityProviderStrategy": {
-      "$ref": "#/definitions/DefaultCapacityProviderStrategy"
     }
   },
   "required": [
     "CapacityProviders",
     "Cluster",
     "DefaultCapacityProviderStrategy"
-  ],
-  "createOnlyProperties": [
-    "/properties/Cluster"
-  ],
-  "primaryIdentifier": [
-    "/properties/Cluster"
-  ],
-  "tagging": {
-    "cloudFormationSystemTags": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "taggable": false
-  },
-  "handlers": {
-    "create": {
-      "permissions": [
-        "ecs:DescribeClusters",
-        "ecs:PutClusterCapacityProviders"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "ecs:DescribeClusters"
-      ]
-    },
-    "update": {
-      "permissions": [
-        "ecs:DescribeClusters",
-        "ecs:PutClusterCapacityProviders"
-      ]
-    },
-    "delete": {
-      "permissions": [
-        "ecs:PutClusterCapacityProviders",
-        "ecs:DescribeClusters"
-      ]
-    },
-    "list": {
-      "permissions": [
-        "ecs:DescribeClusters",
-        "ecs:ListClusters"
-      ]
-    }
-  }
+  ]
 }
diff --git a/internal/aws/cfn/schemas/aws/glue/database.json b/internal/aws/cfn/schemas/aws/glue/database.json
index ba8fad47..25972081 100644
--- a/internal/aws/cfn/schemas/aws/glue/database.json
+++ b/internal/aws/cfn/schemas/aws/glue/database.json
@@ -1,114 +1,194 @@
 {
   "typeName": "AWS::Glue::Database",
   "description": "Resource Type definition for AWS::Glue::Database",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-glue.git",
   "additionalProperties": false,
   "properties": {
     "CatalogId": {
-      "type": "string"
+      "type": "string",
+      "description": "The AWS account ID for the account in which to create the catalog object."
     },
     "DatabaseInput": {
-      "$ref": "#/definitions/DatabaseInput"
+      "$ref": "#/definitions/DatabaseInput",
+      "description": "The metadata for the database."
     },
-    "Id": {
-      "type": "string"
+    "DatabaseName": {
+      "type": "string",
+      "description": "The name of the database. For hive compatibility, this is folded to lowercase when it is store."
     }
   },
   "definitions": {
     "DatabaseIdentifier": {
       "type": "object",
+      "description": "A structure that describes a target database for resource linking.",
       "additionalProperties": false,
       "properties": {
         "DatabaseName": {
-          "type": "string"
+          "type": "string",
+          "description": "The name of the catalog database."
         },
         "Region": {
-          "type": "string"
+          "type": "string",
+          "description": "Region of the target database."
         },
         "CatalogId": {
-          "type": "string"
+          "type": "string",
+          "description": "The ID of the Data Catalog in which the database resides."
         }
       }
     },
     "PrincipalPrivileges": {
       "type": "object",
+      "description": "The permissions granted to a principal.",
       "additionalProperties": false,
       "properties": {
         "Permissions": {
           "type": "array",
+          "description": "The permissions that are granted to the principal.",
           "uniqueItems": false,
+          "insertionOrder": false,
           "items": {
             "type": "string"
           }
         },
         "Principal": {
-          "$ref": "#/definitions/DataLakePrincipal"
+          "$ref": "#/definitions/DataLakePrincipal",
+          "description": "The principal who is granted permissions."
         }
       }
     },
     "DataLakePrincipal": {
       "type": "object",
+      "description": "The AWS Lake Formation principal.",
       "additionalProperties": false,
       "properties": {
         "DataLakePrincipalIdentifier": {
-          "type": "string"
+          "type": "string",
+          "description": "An identifier for the AWS Lake Formation principal."
         }
       }
     },
     "FederatedDatabase": {
       "type": "object",
+      "description": "A FederatedDatabase structure that references an entity outside the AWS Glue Data Catalog.",
       "additionalProperties": false,
       "properties": {
         "ConnectionName": {
-          "type": "string"
+          "type": "string",
+          "description": "The name of the connection to the external metastore."
         },
         "Identifier": {
-          "type": "string"
+          "type": "string",
+          "description": "A unique identifier for the federated database."
         }
       }
     },
     "DatabaseInput": {
       "type": "object",
+      "description": "The structure used to create or update a database.",
       "additionalProperties": false,
       "properties": {
         "LocationUri": {
-          "type": "string"
+          "type": "string",
+          "description": "The location of the database (for example, an HDFS path)."
         },
         "CreateTableDefaultPermissions": {
           "type": "array",
+          "description": "Creates a set of default permissions on the table for principals. Used by AWS Lake Formation. Not used in the normal course of AWS Glue operations.",
           "uniqueItems": false,
+          "insertionOrder": false,
           "items": {
-            "$ref": "#/definitions/PrincipalPrivileges"
+            "$ref": "#/definitions/PrincipalPrivileges",
+            "description": "The permissions granted to a principal."
           }
         },
         "Description": {
-          "type": "string"
+          "type": "string",
+          "description": "A description of the database."
         },
         "Parameters": {
-          "type": "object"
+          "type": "object",
+          "description": "These key-value pairs define parameters and properties of the database."
         },
         "TargetDatabase": {
-          "$ref": "#/definitions/DatabaseIdentifier"
+          "$ref": "#/definitions/DatabaseIdentifier",
+          "description": "A DatabaseIdentifier structure that describes a target database for resource linking."
         },
         "FederatedDatabase": {
-          "$ref": "#/definitions/FederatedDatabase"
+          "$ref": "#/definitions/FederatedDatabase",
+          "description": "A FederatedDatabase structure that references an entity outside the AWS Glue Data Catalog."
         },
         "Name": {
-          "type": "string"
+          "type": "string",
+          "description": "The name of the database. For hive compatibility, this is folded to lowercase when it is stored."
         }
       }
     }
   },
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
   "required": [
     "DatabaseInput",
     "CatalogId"
   ],
   "createOnlyProperties": [
-    "/properties/CatalogId"
+    "/properties/DatabaseName"
   ],
   "primaryIdentifier": [
-    "/properties/Id"
+    "/properties/DatabaseName"
   ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ]
+  "handlers": {
+    "create": {
+      "permissions": [
+        "glue:CreateDatabase",
+        "glue:GetDatabase",
+        "glue:PassConnection",
+        "glue:CreateConnection",
+        "lakeformation:ListResources",
+        "lakeformation:DescribeResource",
+        "lakeformation:DescribeLakeFormationIdentityCenterConfiguration"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "glue:GetDatabase",
+        "glue:GetConnection",
+        "lakeformation:ListResources",
+        "lakeformation:DescribeResource",
+        "lakeformation:DescribeLakeFormationIdentityCenterConfiguration"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "glue:UpdateDatabase",
+        "glue:UpdateConnection",
+        "lakeformation:ListResources",
+        "lakeformation:DescribeResource",
+        "lakeformation:DescribeLakeFormationIdentityCenterConfiguration"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "glue:DeleteDatabase",
+        "glue:GetDatabase",
+        "glue:DeleteConnection",
+        "glue:GetConnection",
+        "lakeformation:ListResources",
+        "lakeformation:DescribeResource",
+        "lakeformation:DescribeLakeFormationIdentityCenterConfiguration"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "glue:GetDatabases",
+        "lakeformation:ListResources",
+        "lakeformation:DescribeResource",
+        "lakeformation:DescribeLakeFormationIdentityCenterConfiguration"
+      ]
+    }
+  }
 }
diff --git a/internal/aws/cfn/schemas/aws/iam/managedpolicy.json b/internal/aws/cfn/schemas/aws/iam/managedpolicy.json
index c03f9f62..95e19c69 100644
--- a/internal/aws/cfn/schemas/aws/iam/managedpolicy.json
+++ b/internal/aws/cfn/schemas/aws/iam/managedpolicy.json
@@ -3,6 +3,7 @@
   "description": "Creates a new managed policy for your AWS-account.\n This operation creates a policy version with a version identifier of ``v1`` and sets v1 as the policy's default version. For more information about policy versions, see [Versioning for managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-versions.html) in the *IAM User Guide*.\n As a best practice, you can validate your IAM policies. To learn more, see [Validating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html) in the *IAM User Guide*.\n For more information about managed policies in general, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide*.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-iam",
   "additionalProperties": false,
+  "replacementStrategy": "delete_then_create",
   "properties": {
     "Description": {
       "type": "string",
diff --git a/internal/aws/cfn/schemas/aws/iotfleetwise/decodermanifest.json b/internal/aws/cfn/schemas/aws/iotfleetwise/decodermanifest.json
index 2b2bd865..3bbf8587 100644
--- a/internal/aws/cfn/schemas/aws/iotfleetwise/decodermanifest.json
+++ b/internal/aws/cfn/schemas/aws/iotfleetwise/decodermanifest.json
@@ -486,6 +486,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "iotfleetwise:UntagResource",
+      "iotfleetwise:TagResource",
+      "iotfleetwise:ListTagsForResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/iotfleetwise/fleet.json b/internal/aws/cfn/schemas/aws/iotfleetwise/fleet.json
index 492af20c..49730606 100644
--- a/internal/aws/cfn/schemas/aws/iotfleetwise/fleet.json
+++ b/internal/aws/cfn/schemas/aws/iotfleetwise/fleet.json
@@ -70,7 +70,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "iotfleetwise:UntagResource",
+      "iotfleetwise:TagResource",
+      "iotfleetwise:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn",
diff --git a/internal/aws/cfn/schemas/aws/iotfleetwise/modelmanifest.json b/internal/aws/cfn/schemas/aws/iotfleetwise/modelmanifest.json
index 1a9fa612..a6020ade 100644
--- a/internal/aws/cfn/schemas/aws/iotfleetwise/modelmanifest.json
+++ b/internal/aws/cfn/schemas/aws/iotfleetwise/modelmanifest.json
@@ -142,6 +142,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "iotfleetwise:UntagResource",
+      "iotfleetwise:TagResource",
+      "iotfleetwise:ListTagsForResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/iotfleetwise/vehicle.json b/internal/aws/cfn/schemas/aws/iotfleetwise/vehicle.json
index 0297ce89..93ed074a 100644
--- a/internal/aws/cfn/schemas/aws/iotfleetwise/vehicle.json
+++ b/internal/aws/cfn/schemas/aws/iotfleetwise/vehicle.json
@@ -91,7 +91,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "iotfleetwise:UntagResource",
+      "iotfleetwise:TagResource",
+      "iotfleetwise:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn",
diff --git a/internal/aws/cfn/schemas/aws/ivs/channel.json b/internal/aws/cfn/schemas/aws/ivs/channel.json
index 57fd7b52..e39f481e 100644
--- a/internal/aws/cfn/schemas/aws/ivs/channel.json
+++ b/internal/aws/cfn/schemas/aws/ivs/channel.json
@@ -100,6 +100,7 @@
       "description": "Optional transcode preset for the channel. This is selectable only for ADVANCED_HD and ADVANCED_SD channel types. For those channel types, the default preset is HIGHER_BANDWIDTH_DELIVERY. For other channel types (BASIC and STANDARD), preset is the empty string (\"\").",
       "type": "string",
       "enum": [
+        "",
         "HIGHER_BANDWIDTH_DELIVERY",
         "CONSTRAINED_BANDWIDTH_DELIVERY"
       ]
@@ -112,7 +113,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn",
@@ -140,14 +146,14 @@
         "ivs:GetChannel",
         "ivs:UpdateChannel",
         "ivs:TagResource",
-        "ivs:UnTagResource",
+        "ivs:UntagResource",
         "ivs:ListTagsForResource"
       ]
     },
     "delete": {
       "permissions": [
         "ivs:DeleteChannel",
-        "ivs:UnTagResource"
+        "ivs:UntagResource"
       ]
     },
     "list": {
diff --git a/internal/aws/cfn/schemas/aws/ivs/encoderconfiguration.json b/internal/aws/cfn/schemas/aws/ivs/encoderconfiguration.json
index bd9158e8..f247e15f 100644
--- a/internal/aws/cfn/schemas/aws/ivs/encoderconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/ivs/encoderconfiguration.json
@@ -95,7 +95,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn"
diff --git a/internal/aws/cfn/schemas/aws/ivs/playbackkeypair.json b/internal/aws/cfn/schemas/aws/ivs/playbackkeypair.json
index 7845d9aa..2706ecd9 100644
--- a/internal/aws/cfn/schemas/aws/ivs/playbackkeypair.json
+++ b/internal/aws/cfn/schemas/aws/ivs/playbackkeypair.json
@@ -64,7 +64,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn",
diff --git a/internal/aws/cfn/schemas/aws/ivs/playbackrestrictionpolicy.json b/internal/aws/cfn/schemas/aws/ivs/playbackrestrictionpolicy.json
index ab558ffa..352b3137 100644
--- a/internal/aws/cfn/schemas/aws/ivs/playbackrestrictionpolicy.json
+++ b/internal/aws/cfn/schemas/aws/ivs/playbackrestrictionpolicy.json
@@ -87,7 +87,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn"
diff --git a/internal/aws/cfn/schemas/aws/ivs/publickey.json b/internal/aws/cfn/schemas/aws/ivs/publickey.json
new file mode 100644
index 00000000..beeb37ff
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/ivs/publickey.json
@@ -0,0 +1,119 @@
+{
+  "typeName": "AWS::IVS::PublicKey",
+  "description": "Resource Type definition for AWS::IVS::PublicKey",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "definitions": {
+    "Tag": {
+      "type": "object",
+      "properties": {
+        "Key": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "Value": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "properties": {
+    "Name": {
+      "description": "Name of the public key to be imported. The value does not need to be unique.",
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9-_]*$",
+      "minLength": 0,
+      "maxLength": 128
+    },
+    "PublicKeyMaterial": {
+      "description": "The public portion of a customer-generated key pair.",
+      "type": "string",
+      "pattern": "-----BEGIN PUBLIC KEY-----\\r?\\n([a-zA-Z0-9+/=\\r\\n]+)\\r?\\n-----END PUBLIC KEY-----(\\r?\\n)?"
+    },
+    "Fingerprint": {
+      "description": "Key-pair identifier.",
+      "type": "string"
+    },
+    "Arn": {
+      "description": "Key-pair identifier.",
+      "type": "string",
+      "pattern": "^arn:aws:ivs:[a-z0-9-]+:[0-9]+:public-key/[a-zA-Z0-9-]+$",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "Tags": {
+      "description": "A list of key-value pairs that contain metadata for the asset model.",
+      "type": "array",
+      "uniqueItems": true,
+      "insertionOrder": false,
+      "maxItems": 50,
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
+    }
+  },
+  "additionalProperties": false,
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
+  },
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/Fingerprint"
+  ],
+  "createOnlyProperties": [
+    "/properties/PublicKeyMaterial",
+    "/properties/Name"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "ivs:ImportPublicKey",
+        "ivs:TagResource"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "ivs:GetPublicKey"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "ivs:GetPublicKey",
+        "ivs:ListTagsForResource",
+        "ivs:UntagResource",
+        "ivs:TagResource"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "ivs:DeletePublicKey",
+        "ivs:UntagResource"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "ivs:ListPublicKeys",
+        "ivs:ListTagsForResource"
+      ]
+    }
+  }
+}
diff --git a/internal/aws/cfn/schemas/aws/ivs/recordingconfiguration.json b/internal/aws/cfn/schemas/aws/ivs/recordingconfiguration.json
index f76573ae..43697e19 100644
--- a/internal/aws/cfn/schemas/aws/ivs/recordingconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/ivs/recordingconfiguration.json
@@ -192,7 +192,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "required": [
     "DestinationConfiguration"
diff --git a/internal/aws/cfn/schemas/aws/ivs/stage.json b/internal/aws/cfn/schemas/aws/ivs/stage.json
index ecadb376..de6673b1 100644
--- a/internal/aws/cfn/schemas/aws/ivs/stage.json
+++ b/internal/aws/cfn/schemas/aws/ivs/stage.json
@@ -22,6 +22,41 @@
         "Value",
         "Key"
       ]
+    },
+    "AutoParticipantRecordingConfiguration": {
+      "description": "Configuration object for individual participant recording, to attach to the new stage.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "StorageConfigurationArn": {
+          "description": "ARN of the StorageConfiguration resource to use for individual participant recording.",
+          "type": "string",
+          "pattern": "^$|^arn:aws:ivs:[a-z0-9-]+:[0-9]+:storage-configuration/[a-zA-Z0-9-]+$",
+          "minLength": 0,
+          "maxLength": 128
+        },
+        "MediaTypes": {
+          "description": "Types of media to be recorded. Default: AUDIO_VIDEO.",
+          "type": "array",
+          "minItems": 0,
+          "maxItems": 1,
+          "uniqueItems": true,
+          "insertionOrder": false,
+          "items": {
+            "type": "string",
+            "enum": [
+              "AUDIO_VIDEO",
+              "AUDIO_ONLY"
+            ]
+          },
+          "default": [
+            "AUDIO_VIDEO"
+          ]
+        }
+      },
+      "required": [
+        "StorageConfigurationArn"
+      ]
     }
   },
   "properties": {
@@ -39,6 +74,9 @@
       "maxLength": 128,
       "pattern": "^[a-zA-Z0-9-_]*$"
     },
+    "AutoParticipantRecordingConfiguration": {
+      "$ref": "#/definitions/AutoParticipantRecordingConfiguration"
+    },
     "Tags": {
       "description": "An array of key-value pairs to apply to this resource.",
       "type": "array",
@@ -62,7 +100,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "readOnlyProperties": [
     "/properties/Arn",
@@ -91,14 +134,14 @@
         "ivs:GetStage",
         "ivs:UpdateStage",
         "ivs:TagResource",
-        "ivs:UnTagResource",
+        "ivs:UntagResource",
         "ivs:ListTagsForResource"
       ]
     },
     "delete": {
       "permissions": [
         "ivs:DeleteStage",
-        "ivs:UnTagResource"
+        "ivs:UntagResource"
       ]
     },
     "list": {
diff --git a/internal/aws/cfn/schemas/aws/ivs/storageconfiguration.json b/internal/aws/cfn/schemas/aws/ivs/storageconfiguration.json
index ed3fffe9..43305d6e 100644
--- a/internal/aws/cfn/schemas/aws/ivs/storageconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/ivs/storageconfiguration.json
@@ -76,7 +76,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "required": [
     "S3"
diff --git a/internal/aws/cfn/schemas/aws/ivs/streamkey.json b/internal/aws/cfn/schemas/aws/ivs/streamkey.json
index 7bb60fda..41a3efd5 100644
--- a/internal/aws/cfn/schemas/aws/ivs/streamkey.json
+++ b/internal/aws/cfn/schemas/aws/ivs/streamkey.json
@@ -62,7 +62,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ivs:TagResource",
+      "ivs:UntagResource",
+      "ivs:ListTagsForResource"
+    ]
   },
   "createOnlyProperties": [
     "/properties/ChannelArn"
diff --git a/internal/aws/cfn/schemas/aws/lambda/eventsourcemapping.json b/internal/aws/cfn/schemas/aws/lambda/eventsourcemapping.json
index 426a9f16..4c3d6e54 100644
--- a/internal/aws/cfn/schemas/aws/lambda/eventsourcemapping.json
+++ b/internal/aws/cfn/schemas/aws/lambda/eventsourcemapping.json
@@ -1,97 +1,233 @@
 {
-  "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
-  },
-  "propertyTransform": {
-    "/properties/StartingPositionTimestamp": "StartingPositionTimestamp * 1000"
-  },
-  "handlers": {
-    "read": {
-      "permissions": [
-        "lambda:GetEventSourceMapping"
-      ]
+  "typeName": "AWS::Lambda::EventSourceMapping",
+  "description": "The ``AWS::Lambda::EventSourceMapping`` resource creates a mapping between an event source and an LAMlong function. LAM reads items from the event source and triggers the function.\n For details about each event source type, see the following topics. In particular, each of the topics describes the required and optional parameters for the specific event source. \n  +   [Configuring a Dynamo DB stream as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html#services-dynamodb-eventsourcemapping) \n  +   [Configuring a Kinesis stream as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html#services-kinesis-eventsourcemapping) \n  +   [Configuring an SQS queue as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-eventsource) \n  +   [Configuring an MQ broker as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-mq.html#services-mq-eventsourcemapping) \n  +   [Configuring MSK as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html) \n  +   [Configuring Self-Managed Apache Kafka as an event source](https://docs.aws.amazon.com/lambda/latest/dg/kafka-smaa.html) \n  +   [Configuring Amazon DocumentDB as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-documentdb.html)",
+  "additionalProperties": false,
+  "properties": {
+    "Id": {
+      "description": "",
+      "type": "string",
+      "pattern": "[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}",
+      "minLength": 36,
+      "maxLength": 36
     },
-    "create": {
-      "permissions": [
-        "lambda:CreateEventSourceMapping",
-        "lambda:GetEventSourceMapping"
-      ]
+    "BatchSize": {
+      "description": "The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).\n  +   *Amazon Kinesis* ? Default 100. Max 10,000.\n  +   *Amazon DynamoDB Streams* ? Default 100. Max 10,000.\n  +   *Amazon Simple Queue Service* ? Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10.\n  +   *Amazon Managed Streaming for Apache Kafka* ? Default 100. Max 10,000.\n  +   *Self-managed Apache Kafka* ? Default 100. Max 10,000.\n  +   *Amazon MQ (ActiveMQ and RabbitMQ)* ? Default 100. Max 10,000.\n  +   *DocumentDB* ? Default 100. Max 10,000.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 10000
     },
-    "update": {
-      "permissions": [
-        "lambda:UpdateEventSourceMapping",
-        "lambda:GetEventSourceMapping"
-      ]
+    "BisectBatchOnFunctionError": {
+      "description": "(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false.",
+      "type": "boolean"
     },
-    "list": {
-      "permissions": [
-        "lambda:ListEventSourceMappings"
-      ]
+    "DestinationConfig": {
+      "description": "(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.",
+      "$ref": "#/definitions/DestinationConfig"
     },
-    "delete": {
-      "permissions": [
-        "lambda:DeleteEventSourceMapping",
-        "lambda:GetEventSourceMapping"
-      ]
+    "Enabled": {
+      "description": "When true, the event source mapping is active. When false, Lambda pauses polling and invocation.\n Default: True",
+      "type": "boolean"
+    },
+    "EventSourceArn": {
+      "description": "The Amazon Resource Name (ARN) of the event source.\n  +   *Amazon Kinesis* ? The ARN of the data stream or a stream consumer.\n  +   *Amazon DynamoDB Streams* ? The ARN of the stream.\n  +   *Amazon Simple Queue Service* ? The ARN of the queue.\n  +   *Amazon Managed Streaming for Apache Kafka* ? The ARN of the cluster or the ARN of the VPC connection (for [cross-account event source mappings](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc)).\n  +   *Amazon MQ* ? The ARN of the broker.\n  +   *Amazon DocumentDB* ? The ARN of the DocumentDB change stream.",
+      "type": "string",
+      "pattern": "arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?(-iso([a-z])?)?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)",
+      "minLength": 12,
+      "maxLength": 1024
+    },
+    "FilterCriteria": {
+      "description": "An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see [Lambda event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html).",
+      "$ref": "#/definitions/FilterCriteria"
+    },
+    "KmsKeyArn": {
+      "description": "",
+      "type": "string",
+      "pattern": "(arn:(aws[a-zA-Z-]*)?:[a-z0-9-.]+:.*)|()",
+      "minLength": 12,
+      "maxLength": 2048
+    },
+    "FunctionName": {
+      "description": "The name or ARN of the Lambda function.\n  **Name formats**\n +   *Function name* ? ``MyFunction``.\n  +   *Function ARN* ? ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction``.\n  +   *Version or Alias ARN* ? ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD``.\n  +   *Partial ARN* ? ``123456789012:function:MyFunction``.\n  \n The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.",
+      "type": "string",
+      "pattern": "(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}(-gov)?(-iso([a-z])?)?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?",
+      "minLength": 1,
+      "maxLength": 140
+    },
+    "MaximumBatchingWindowInSeconds": {
+      "description": "The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.\n  *Default (, , event sources)*: 0\n  *Default (, Kafka, , event sources)*: 500 ms\n  *Related setting:* For SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.",
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 300
+    },
+    "MaximumRecordAgeInSeconds": {
+      "description": "(Kinesis and DynamoDB Streams only) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records.\n  The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed",
+      "type": "integer",
+      "minimum": -1,
+      "maximum": 604800
+    },
+    "MaximumRetryAttempts": {
+      "description": "(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.",
+      "type": "integer",
+      "minimum": -1,
+      "maximum": 10000
+    },
+    "ParallelizationFactor": {
+      "description": "(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 10
+    },
+    "StartingPosition": {
+      "description": "The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB.\n  +   *LATEST* - Read only new records.\n  +   *TRIM_HORIZON* - Process all available records.\n  +   *AT_TIMESTAMP* - Specify a time from which to start reading records.",
+      "type": "string",
+      "pattern": "(LATEST|TRIM_HORIZON|AT_TIMESTAMP)+",
+      "minLength": 6,
+      "maxLength": 12
+    },
+    "StartingPositionTimestamp": {
+      "description": "With ``StartingPosition`` set to ``AT_TIMESTAMP``, the time from which to start reading, in Unix time seconds. ``StartingPositionTimestamp`` cannot be in the future.",
+      "type": "number"
+    },
+    "Topics": {
+      "description": "The name of the Kafka topic.",
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[^.]([a-zA-Z0-9\\-_.]+)",
+        "minLength": 1,
+        "maxLength": 249
+      },
+      "minItems": 1,
+      "maxItems": 1
+    },
+    "Queues": {
+      "description": "(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.",
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "[\\s\\S]*",
+        "minLength": 1,
+        "maxLength": 1000
+      },
+      "minItems": 1,
+      "maxItems": 1
+    },
+    "SourceAccessConfigurations": {
+      "description": "An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.",
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/definitions/SourceAccessConfiguration"
+      },
+      "minItems": 1,
+      "maxItems": 22
+    },
+    "TumblingWindowInSeconds": {
+      "description": "(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.",
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 900
+    },
+    "FunctionResponseTypes": {
+      "description": "(Streams and SQS) A list of current response type enums applied to the event source mapping.\n Valid Values: ``ReportBatchItemFailures``",
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": [
+          "ReportBatchItemFailures"
+        ]
+      },
+      "minLength": 0,
+      "maxLength": 1
+    },
+    "SelfManagedEventSource": {
+      "description": "The self-managed Apache Kafka cluster for your event source.",
+      "$ref": "#/definitions/SelfManagedEventSource"
+    },
+    "AmazonManagedKafkaEventSourceConfig": {
+      "description": "Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.",
+      "$ref": "#/definitions/AmazonManagedKafkaEventSourceConfig"
+    },
+    "SelfManagedKafkaEventSourceConfig": {
+      "description": "Specific configuration settings for a self-managed Apache Kafka event source.",
+      "$ref": "#/definitions/SelfManagedKafkaEventSourceConfig"
+    },
+    "ScalingConfig": {
+      "description": "(Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency).",
+      "$ref": "#/definitions/ScalingConfig"
+    },
+    "DocumentDBEventSourceConfig": {
+      "description": "Specific configuration settings for a DocumentDB event source.",
+      "$ref": "#/definitions/DocumentDBEventSourceConfig"
     }
   },
-  "typeName": "AWS::Lambda::EventSourceMapping",
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "description": "The ``AWS::Lambda::EventSourceMapping`` resource creates a mapping between an event source and an LAMlong function. LAM reads items from the event source and triggers the function.\n For details about each event source type, see the following topics. In particular, each of the topics describes the required and optional parameters for the specific event source. \n  +   [Configuring a Dynamo DB stream as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html#services-dynamodb-eventsourcemapping) \n  +   [Configuring a Kinesis stream as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html#services-kinesis-eventsourcemapping) \n  +   [Configuring an SQS queue as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-eventsource) \n  +   [Configuring an MQ broker as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-mq.html#services-mq-eventsourcemapping) \n  +   [Configuring MSK as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html) \n  +   [Configuring Self-Managed Apache Kafka as an event source](https://docs.aws.amazon.com/lambda/latest/dg/kafka-smaa.html) \n  +   [Configuring Amazon DocumentDB as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-documentdb.html)",
-  "createOnlyProperties": [
-    "/properties/EventSourceArn",
-    "/properties/StartingPosition",
-    "/properties/StartingPositionTimestamp",
-    "/properties/SelfManagedEventSource",
-    "/properties/AmazonManagedKafkaEventSourceConfig",
-    "/properties/SelfManagedKafkaEventSourceConfig"
-  ],
-  "additionalProperties": false,
-  "primaryIdentifier": [
-    "/properties/Id"
-  ],
   "definitions": {
-    "ScalingConfig": {
-      "description": "(Amazon SQS only) The scaling configuration for the event source. To remove the configuration, pass an empty value.",
-      "additionalProperties": false,
+    "DestinationConfig": {
       "type": "object",
+      "additionalProperties": false,
+      "description": "A configuration object that specifies the destination of an event after Lambda processes it.",
       "properties": {
-        "MaximumConcurrency": {
-          "description": "Limits the number of concurrent instances that the SQS event source can invoke.",
-          "$ref": "#/definitions/MaximumConcurrency"
+        "OnFailure": {
+          "description": "The destination configuration for failed invocations.",
+          "$ref": "#/definitions/OnFailure"
         }
       }
     },
-    "SelfManagedEventSource": {
-      "description": "The self-managed Apache Kafka cluster for your event source.",
+    "FilterCriteria": {
+      "type": "object",
+      "description": "An object that contains the filters for an event source.",
       "additionalProperties": false,
+      "properties": {
+        "Filters": {
+          "description": "A list of filters.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/Filter"
+          },
+          "minItems": 1,
+          "maxItems": 20
+        }
+      }
+    },
+    "Filter": {
       "type": "object",
+      "description": "A structure within a ``FilterCriteria`` object that defines an event filtering pattern.",
+      "additionalProperties": false,
       "properties": {
-        "Endpoints": {
-          "description": "The list of bootstrap servers for your Kafka brokers in the following format: ``\"KafkaBootstrapServers\": [\"abc.xyz.com:xxxx\",\"abc2.xyz.com:xxxx\"]``.",
-          "$ref": "#/definitions/Endpoints"
+        "Pattern": {
+          "type": "string",
+          "description": "A filter pattern. For more information on the syntax of a filter pattern, see [Filter rule syntax](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax).",
+          "pattern": ".*",
+          "minLength": 0,
+          "maxLength": 4096
         }
       }
     },
-    "MaximumConcurrency": {
-      "description": "The maximum number of concurrent functions that an event source can invoke.",
-      "maximum": 1000,
-      "type": "integer",
-      "minimum": 2
+    "OnFailure": {
+      "type": "object",
+      "description": "A destination for events that failed processing.",
+      "additionalProperties": false,
+      "properties": {
+        "Destination": {
+          "description": "The Amazon Resource Name (ARN) of the destination resource.\n To retain records of [asynchronous invocations](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations), you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination.\n To retain records of failed invocations from [Kinesis and DynamoDB event sources](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html#event-source-mapping-destinations), you can configure an Amazon SNS topic or Amazon SQS queue as the destination.\n To retain records of failed invocations from [self-managed Kafka](https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination) or [Amazon MSK](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination), you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.",
+          "type": "string",
+          "pattern": "arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?(-iso([a-z])?)?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)",
+          "minLength": 12,
+          "maxLength": 1024
+        }
+      }
     },
     "SourceAccessConfiguration": {
-      "description": "An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.",
-      "additionalProperties": false,
       "type": "object",
+      "additionalProperties": false,
+      "description": "An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.",
       "properties": {
         "Type": {
-          "description": "The type of authentication protocol, VPC components, or virtual host for your event source. For example: ``\"Type\":\"SASL_SCRAM_512_AUTH\"``.\n  +   ``BASIC_AUTH`` – (Amazon MQ) The ASMlong secret that stores your broker credentials.\n  +   ``BASIC_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL/PLAIN authentication of your Apache Kafka brokers.\n  +   ``VPC_SUBNET`` – (Self-managed Apache Kafka) The subnets associated with your VPC. Lambda connects to these subnets to fetch data from your self-managed Apache Kafka cluster.\n  +   ``VPC_SECURITY_GROUP`` – (Self-managed Apache Kafka) The VPC security group used to manage access to your self-managed Apache Kafka brokers.\n  +   ``SASL_SCRAM_256_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed Apache Kafka brokers.\n  +   ``SASL_SCRAM_512_AUTH`` – (Amazon MSK, Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed Apache Kafka brokers.\n  +   ``VIRTUAL_HOST`` –- (RabbitMQ) The name of the virtual host in your RabbitMQ broker. Lambda uses this RabbitMQ host as the event source. This property cannot be specified in an UpdateEventSourceMapping API call.\n  +   ``CLIENT_CERTIFICATE_TLS_AUTH`` – (Amazon MSK, self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your MSK/Apache Kafka brokers.\n  +   ``SERVER_ROOT_CA_CERTIFICATE`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your Apache Kafka brokers.",
-          "type": "string",
+          "description": "The type of authentication protocol, VPC components, or virtual host for your event source. For example: ``\"Type\":\"SASL_SCRAM_512_AUTH\"``.\n  +   ``BASIC_AUTH`` ? (Amazon MQ) The ASMlong secret that stores your broker credentials.\n  +   ``BASIC_AUTH`` ? (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL/PLAIN authentication of your Apache Kafka brokers.\n  +   ``VPC_SUBNET`` ? (Self-managed Apache Kafka) The subnets associated with your VPC. Lambda connects to these subnets to fetch data from your self-managed Apache Kafka cluster.\n  +   ``VPC_SECURITY_GROUP`` ? (Self-managed Apache Kafka) The VPC security group used to manage access to your self-managed Apache Kafka brokers.\n  +   ``SASL_SCRAM_256_AUTH`` ? (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed Apache Kafka brokers.\n  +   ``SASL_SCRAM_512_AUTH`` ? (Amazon MSK, Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed Apache Kafka brokers.\n  +   ``VIRTUAL_HOST`` ?- (RabbitMQ) The name of the virtual host in your RabbitMQ broker. Lambda uses this RabbitMQ host as the event source. This property cannot be specified in an UpdateEventSourceMapping API call.\n  +   ``CLIENT_CERTIFICATE_TLS_AUTH`` ? (Amazon MSK, self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your MSK/Apache Kafka brokers.\n  +   ``SERVER_ROOT_CA_CERTIFICATE`` ? (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your Apache Kafka brokers.",
           "enum": [
             "BASIC_AUTH",
             "VPC_SUBNET",
@@ -101,129 +237,72 @@
             "VIRTUAL_HOST",
             "CLIENT_CERTIFICATE_TLS_AUTH",
             "SERVER_ROOT_CA_CERTIFICATE"
-          ]
+          ],
+          "type": "string"
         },
         "URI": {
-          "minLength": 1,
-          "pattern": "[a-zA-Z0-9-\\/*:_+=.@-]*",
           "description": "The value for your chosen configuration in ``Type``. For example: ``\"URI\": \"arn:aws:secretsmanager:us-east-1:01234567890:secret:MyBrokerSecretName\"``.",
           "type": "string",
+          "pattern": "[a-zA-Z0-9-\\/*:_+=.@-]*",
+          "minLength": 1,
           "maxLength": 200
         }
       }
     },
-    "FilterCriteria": {
-      "description": "An object that contains the filters for an event source.",
-      "additionalProperties": false,
+    "SelfManagedEventSource": {
       "type": "object",
+      "additionalProperties": false,
+      "description": "The self-managed Apache Kafka cluster for your event source.",
       "properties": {
-        "Filters": {
-          "minItems": 1,
-          "maxItems": 20,
-          "uniqueItems": true,
-          "description": "A list of filters.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/Filter"
-          }
+        "Endpoints": {
+          "description": "The list of bootstrap servers for your Kafka brokers in the following format: ``\"KafkaBootstrapServers\": [\"abc.xyz.com:xxxx\",\"abc2.xyz.com:xxxx\"]``.",
+          "$ref": "#/definitions/Endpoints"
         }
       }
     },
-    "SelfManagedKafkaEventSourceConfig": {
-      "description": "Specific configuration settings for a self-managed Apache Kafka event source.",
-      "additionalProperties": false,
+    "Endpoints": {
       "type": "object",
-      "properties": {
-        "ConsumerGroupId": {
-          "description": "The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see [Customizable consumer group ID](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id).",
-          "$ref": "#/definitions/ConsumerGroupId"
-        }
-      }
-    },
-    "DocumentDBEventSourceConfig": {
-      "description": "Specific configuration settings for a DocumentDB event source.",
       "additionalProperties": false,
-      "type": "object",
-      "properties": {
-        "FullDocument": {
-          "description": "Determines what DocumentDB sends to your event stream during document update operations. If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.",
-          "type": "string",
-          "enum": [
-            "UpdateLookup",
-            "Default"
-          ]
-        },
-        "CollectionName": {
-          "minLength": 1,
-          "description": "The name of the collection to consume within the database. If you do not specify a collection, Lambda consumes all collections.",
-          "type": "string",
-          "maxLength": 57
-        },
-        "DatabaseName": {
-          "minLength": 1,
-          "description": "The name of the database to consume within the DocumentDB cluster.",
-          "type": "string",
-          "maxLength": 63
-        }
-      }
-    },
-    "Endpoints": {
       "description": "The list of bootstrap servers for your Kafka brokers in the following format: ``\"KafkaBootstrapServers\": [\"abc.xyz.com:xxxx\",\"abc2.xyz.com:xxxx\"]``.",
-      "additionalProperties": false,
-      "type": "object",
       "properties": {
         "KafkaBootstrapServers": {
-          "minItems": 1,
-          "maxItems": 10,
-          "uniqueItems": true,
-          "description": "The list of bootstrap servers for your Kafka brokers in the following format: ``\"KafkaBootstrapServers\": [\"abc.xyz.com:xxxx\",\"abc2.xyz.com:xxxx\"]``.",
           "type": "array",
+          "description": "The list of bootstrap servers for your Kafka brokers in the following format: ``\"KafkaBootstrapServers\": [\"abc.xyz.com:xxxx\",\"abc2.xyz.com:xxxx\"]``.",
+          "uniqueItems": true,
           "items": {
-            "minLength": 1,
-            "pattern": "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9]):[0-9]{1,5}",
-            "description": "The URL of a Kafka server.",
             "type": "string",
+            "description": "The URL of a Kafka server.",
+            "pattern": "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9]):[0-9]{1,5}",
+            "minLength": 1,
             "maxLength": 300
-          }
-        }
-      }
-    },
-    "DestinationConfig": {
-      "description": "A configuration object that specifies the destination of an event after Lambda processes it.",
-      "additionalProperties": false,
-      "type": "object",
-      "properties": {
-        "OnFailure": {
-          "description": "The destination configuration for failed invocations.",
-          "$ref": "#/definitions/OnFailure"
+          },
+          "minItems": 1,
+          "maxItems": 10
         }
       }
     },
     "ConsumerGroupId": {
-      "minLength": 1,
-      "pattern": "[a-zA-Z0-9-\\/*:_+=.@-]*",
       "description": "The identifier for the Kafka Consumer Group to join.",
       "type": "string",
+      "pattern": "[a-zA-Z0-9-\\/*:_+=.@-]*",
+      "minLength": 1,
       "maxLength": 200
     },
-    "Filter": {
-      "description": "A structure within a ``FilterCriteria`` object that defines an event filtering pattern.",
-      "additionalProperties": false,
+    "AmazonManagedKafkaEventSourceConfig": {
+      "description": "Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.",
       "type": "object",
+      "additionalProperties": false,
       "properties": {
-        "Pattern": {
-          "minLength": 0,
-          "pattern": ".*",
-          "description": "A filter pattern. For more information on the syntax of a filter pattern, see [Filter rule syntax](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax).",
-          "type": "string",
-          "maxLength": 4096
+        "ConsumerGroupId": {
+          "description": "The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see [Customizable consumer group ID](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id).",
+          "$ref": "#/definitions/ConsumerGroupId"
         }
       }
     },
-    "AmazonManagedKafkaEventSourceConfig": {
-      "description": "Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.",
-      "additionalProperties": false,
+    "SelfManagedKafkaEventSourceConfig": {
+      "description": "Specific configuration settings for a self-managed Apache Kafka event source.",
       "type": "object",
+      "additionalProperties": false,
       "properties": {
         "ConsumerGroupId": {
           "description": "The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see [Customizable consumer group ID](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id).",
@@ -231,17 +310,47 @@
         }
       }
     },
-    "OnFailure": {
-      "description": "A destination for events that failed processing.",
+    "MaximumConcurrency": {
+      "description": "The maximum number of concurrent functions that an event source can invoke.",
+      "type": "integer",
+      "minimum": 2,
+      "maximum": 1000
+    },
+    "ScalingConfig": {
+      "description": "(Amazon SQS only) The scaling configuration for the event source. To remove the configuration, pass an empty value.",
+      "type": "object",
       "additionalProperties": false,
+      "properties": {
+        "MaximumConcurrency": {
+          "description": "Limits the number of concurrent instances that the SQS event source can invoke.",
+          "$ref": "#/definitions/MaximumConcurrency"
+        }
+      }
+    },
+    "DocumentDBEventSourceConfig": {
+      "description": "Specific configuration settings for a DocumentDB event source.",
       "type": "object",
+      "additionalProperties": false,
       "properties": {
-        "Destination": {
-          "minLength": 12,
-          "pattern": "arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?(-iso([a-z])?)?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)",
-          "description": "The Amazon Resource Name (ARN) of the destination resource.\n To retain records of [asynchronous invocations](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations), you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination.\n To retain records of failed invocations from [Kinesis and DynamoDB event sources](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html#event-source-mapping-destinations), you can configure an Amazon SNS topic or Amazon SQS queue as the destination.\n To retain records of failed invocations from [self-managed Kafka](https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination) or [Amazon MSK](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination), you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.",
+        "DatabaseName": {
+          "description": "The name of the database to consume within the DocumentDB cluster.",
           "type": "string",
-          "maxLength": 1024
+          "minLength": 1,
+          "maxLength": 63
+        },
+        "CollectionName": {
+          "description": "The name of the collection to consume within the database. If you do not specify a collection, Lambda consumes all collections.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 57
+        },
+        "FullDocument": {
+          "description": "Determines what DocumentDB sends to your event stream during document update operations. If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.",
+          "type": "string",
+          "enum": [
+            "UpdateLookup",
+            "Default"
+          ]
         }
       }
     }
@@ -249,159 +358,65 @@
   "required": [
     "FunctionName"
   ],
-  "properties": {
-    "StartingPosition": {
-      "minLength": 6,
-      "pattern": "(LATEST|TRIM_HORIZON|AT_TIMESTAMP)+",
-      "description": "The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB.\n  +   *LATEST* - Read only new records.\n  +   *TRIM_HORIZON* - Process all available records.\n  +   *AT_TIMESTAMP* - Specify a time from which to start reading records.",
-      "type": "string",
-      "maxLength": 12
-    },
-    "SelfManagedEventSource": {
-      "description": "The self-managed Apache Kafka cluster for your event source.",
-      "$ref": "#/definitions/SelfManagedEventSource"
-    },
-    "ParallelizationFactor": {
-      "description": "(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.",
-      "maximum": 10,
-      "type": "integer",
-      "minimum": 1
-    },
-    "FilterCriteria": {
-      "description": "An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see [Lambda event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html).",
-      "$ref": "#/definitions/FilterCriteria"
-    },
-    "FunctionName": {
-      "minLength": 1,
-      "pattern": "(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}(-gov)?(-iso([a-z])?)?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?",
-      "description": "The name or ARN of the Lambda function.\n  **Name formats**\n +   *Function name* – ``MyFunction``.\n  +   *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction``.\n  +   *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD``.\n  +   *Partial ARN* – ``123456789012:function:MyFunction``.\n  \n The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.",
-      "type": "string",
-      "maxLength": 140
-    },
-    "DestinationConfig": {
-      "description": "(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.",
-      "$ref": "#/definitions/DestinationConfig"
-    },
-    "AmazonManagedKafkaEventSourceConfig": {
-      "description": "Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.",
-      "$ref": "#/definitions/AmazonManagedKafkaEventSourceConfig"
-    },
-    "SourceAccessConfigurations": {
-      "minItems": 1,
-      "maxItems": 22,
-      "uniqueItems": true,
-      "description": "An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.",
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/SourceAccessConfiguration"
-      }
-    },
-    "MaximumBatchingWindowInSeconds": {
-      "description": "The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.\n  *Default (, , event sources)*: 0\n  *Default (, Kafka, , event sources)*: 500 ms\n  *Related setting:* For SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.",
-      "maximum": 300,
-      "type": "integer",
-      "minimum": 0
-    },
-    "BatchSize": {
-      "description": "The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).\n  +   *Amazon Kinesis* – Default 100. Max 10,000.\n  +   *Amazon DynamoDB Streams* – Default 100. Max 10,000.\n  +   *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10.\n  +   *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000.\n  +   *Self-managed Apache Kafka* – Default 100. Max 10,000.\n  +   *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000.\n  +   *DocumentDB* – Default 100. Max 10,000.",
-      "maximum": 10000,
-      "type": "integer",
-      "minimum": 1
-    },
-    "MaximumRetryAttempts": {
-      "description": "(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.",
-      "maximum": 10000,
-      "type": "integer",
-      "minimum": -1
-    },
-    "Topics": {
-      "minItems": 1,
-      "maxItems": 1,
-      "uniqueItems": true,
-      "description": "The name of the Kafka topic.",
-      "type": "array",
-      "items": {
-        "minLength": 1,
-        "pattern": "^[^.]([a-zA-Z0-9\\-_.]+)",
-        "type": "string",
-        "maxLength": 249
-      }
-    },
-    "ScalingConfig": {
-      "description": "(Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency).",
-      "$ref": "#/definitions/ScalingConfig"
-    },
-    "Enabled": {
-      "description": "When true, the event source mapping is active. When false, Lambda pauses polling and invocation.\n Default: True",
-      "type": "boolean"
-    },
-    "EventSourceArn": {
-      "minLength": 12,
-      "pattern": "arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?(-iso([a-z])?)?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)",
-      "description": "The Amazon Resource Name (ARN) of the event source.\n  +   *Amazon Kinesis* – The ARN of the data stream or a stream consumer.\n  +   *Amazon DynamoDB Streams* – The ARN of the stream.\n  +   *Amazon Simple Queue Service* – The ARN of the queue.\n  +   *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for [cross-account event source mappings](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc)).\n  +   *Amazon MQ* – The ARN of the broker.\n  +   *Amazon DocumentDB* – The ARN of the DocumentDB change stream.",
-      "type": "string",
-      "maxLength": 1024
-    },
-    "SelfManagedKafkaEventSourceConfig": {
-      "description": "Specific configuration settings for a self-managed Apache Kafka event source.",
-      "$ref": "#/definitions/SelfManagedKafkaEventSourceConfig"
-    },
-    "DocumentDBEventSourceConfig": {
-      "description": "Specific configuration settings for a DocumentDB event source.",
-      "$ref": "#/definitions/DocumentDBEventSourceConfig"
-    },
-    "TumblingWindowInSeconds": {
-      "description": "(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.",
-      "maximum": 900,
-      "type": "integer",
-      "minimum": 0
-    },
-    "BisectBatchOnFunctionError": {
-      "description": "(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false.",
-      "type": "boolean"
-    },
-    "MaximumRecordAgeInSeconds": {
-      "description": "(Kinesis and DynamoDB Streams only) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records.\n  The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed",
-      "maximum": 604800,
-      "type": "integer",
-      "minimum": -1
+  "createOnlyProperties": [
+    "/properties/EventSourceArn",
+    "/properties/StartingPosition",
+    "/properties/StartingPositionTimestamp",
+    "/properties/SelfManagedEventSource",
+    "/properties/AmazonManagedKafkaEventSourceConfig",
+    "/properties/SelfManagedKafkaEventSourceConfig"
+  ],
+  "readOnlyProperties": [
+    "/properties/Id"
+  ],
+  "primaryIdentifier": [
+    "/properties/Id"
+  ],
+  "propertyTransform": {
+    "/properties/StartingPositionTimestamp": "StartingPositionTimestamp * 1000"
+  },
+  "handlers": {
+    "create": {
+      "permissions": [
+        "lambda:CreateEventSourceMapping",
+        "lambda:GetEventSourceMapping",
+        "kms:DescribeKey",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
     },
-    "StartingPositionTimestamp": {
-      "description": "With ``StartingPosition`` set to ``AT_TIMESTAMP``, the time from which to start reading, in Unix time seconds. ``StartingPositionTimestamp`` cannot be in the future.",
-      "type": "number"
+    "delete": {
+      "permissions": [
+        "lambda:DeleteEventSourceMapping",
+        "lambda:GetEventSourceMapping",
+        "kms:Decrypt"
+      ]
     },
-    "Queues": {
-      "minItems": 1,
-      "maxItems": 1,
-      "uniqueItems": true,
-      "description": "(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.",
-      "type": "array",
-      "items": {
-        "minLength": 1,
-        "pattern": "[\\s\\S]*",
-        "type": "string",
-        "maxLength": 1000
-      }
+    "list": {
+      "permissions": [
+        "lambda:ListEventSourceMappings"
+      ]
     },
-    "Id": {
-      "minLength": 36,
-      "pattern": "[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}",
-      "description": "",
-      "type": "string",
-      "maxLength": 36
+    "read": {
+      "permissions": [
+        "lambda:GetEventSourceMapping",
+        "kms:Decrypt"
+      ]
     },
-    "FunctionResponseTypes": {
-      "uniqueItems": true,
-      "minLength": 0,
-      "description": "(Streams and SQS) A list of current response type enums applied to the event source mapping.\n Valid Values: ``ReportBatchItemFailures``",
-      "type": "array",
-      "items": {
-        "type": "string",
-        "enum": [
-          "ReportBatchItemFailures"
-        ]
-      },
-      "maxLength": 1
+    "update": {
+      "permissions": [
+        "lambda:UpdateEventSourceMapping",
+        "lambda:GetEventSourceMapping",
+        "kms:DescribeKey",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
     }
+  },
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/lambda/function.json b/internal/aws/cfn/schemas/aws/lambda/function.json
index 9377411d..9ee62e82 100644
--- a/internal/aws/cfn/schemas/aws/lambda/function.json
+++ b/internal/aws/cfn/schemas/aws/lambda/function.json
@@ -10,7 +10,8 @@
     "read": {
       "permissions": [
         "lambda:GetFunction",
-        "lambda:GetFunctionCodeSigningConfig"
+        "lambda:GetFunctionCodeSigningConfig",
+        "lambda:GetFunctionRecursionConfig"
       ]
     },
     "create": {
@@ -34,7 +35,9 @@
         "lambda:GetLayerVersion",
         "lambda:GetRuntimeManagementConfig",
         "lambda:PutRuntimeManagementConfig",
-        "lambda:TagResource"
+        "lambda:TagResource",
+        "lambda:PutFunctionRecursionConfig",
+        "lambda:GetFunctionRecursionConfig"
       ]
     },
     "update": {
@@ -62,7 +65,9 @@
         "lambda:PutFunctionCodeSigningConfig",
         "lambda:DeleteFunctionCodeSigningConfig",
         "lambda:GetCodeSigningConfig",
-        "lambda:GetFunctionCodeSigningConfig"
+        "lambda:GetFunctionCodeSigningConfig",
+        "lambda:PutFunctionRecursionConfig",
+        "lambda:GetFunctionRecursionConfig"
       ]
     },
     "list": {
@@ -335,6 +340,14 @@
         }
       }
     },
+    "RecursiveLoop": {
+      "description": "The function recursion configuration.",
+      "type": "string",
+      "enum": [
+        "Allow",
+        "Terminate"
+      ]
+    },
     "Environment": {
       "description": "A function's environment variable settings. You can use environment variables to adjust your function's behavior without updating code. An environment variable is a pair of strings that are stored in a function's version-specific configuration.",
       "additionalProperties": false,
@@ -537,6 +550,10 @@
       "description": "The function's Amazon CloudWatch Logs configuration settings.",
       "$ref": "#/definitions/LoggingConfig"
     },
+    "RecursiveLoop": {
+      "description": "",
+      "$ref": "#/definitions/RecursiveLoop"
+    },
     "Environment": {
       "description": "Environment variables that are accessible from function code during execution.",
       "$ref": "#/definitions/Environment"
diff --git a/internal/aws/cfn/schemas/aws/lambda/permission.json b/internal/aws/cfn/schemas/aws/lambda/permission.json
index 779ba407..b7c95d18 100644
--- a/internal/aws/cfn/schemas/aws/lambda/permission.json
+++ b/internal/aws/cfn/schemas/aws/lambda/permission.json
@@ -1,36 +1,91 @@
 {
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
+  "propertyTransform": {
+    "/properties/Principal": "$join([\"^arn:aws[a-zA-Z-]*:iam::\",Principal,\":[a-zA-Z-]*\"]) $OR Principal"
+  },
+  "handlers": {
+    "read": {
+      "permissions": [
+        "lambda:GetPolicy"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "lambda:AddPermission"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "lambda:GetPolicy"
+      ],
+      "handlerSchema": {
+        "properties": {
+          "FunctionName": {
+            "minLength": 1,
+            "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+            "description": "The name of the Lambda function, version, or alias.",
+            "type": "string",
+            "maxLength": 140
+          }
+        },
+        "required": [
+          "FunctionName"
+        ]
+      }
+    },
+    "delete": {
+      "permissions": [
+        "lambda:RemovePermission"
+      ]
+    }
+  },
   "typeName": "AWS::Lambda::Permission",
+  "readOnlyProperties": [
+    "/properties/Id"
+  ],
   "description": "The ``AWS::Lambda::Permission`` resource grants an AWS service or another account permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function.\n To grant permission to another account, specify the account ID as the ``Principal``. To grant permission to an organization defined in AOlong, specify the organization ID as the ``PrincipalOrgID``. For AWS services, the principal is a domain-style identifier defined by the service, like ``s3.amazonaws.com`` or ``sns.amazonaws.com``. For AWS services, you can also specify the ARN of the associated resource as the ``SourceArn``. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function.\n If your function has a function URL, you can specify the ``FunctionUrlAuthType`` parameter. This adds a condition to your permission that only applies when your function URL's ``AuthType`` matches the specified ``FunctionUrlAuthType``. For more information about the ``AuthType`` parameter, see [Security and auth model for function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html).\n This resource adds a statement to a resource-based permission policy for the function. For more information about function policies, see [Lambda Function Policies](https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html).",
+  "createOnlyProperties": [
+    "/properties/FunctionName",
+    "/properties/FunctionUrlAuthType",
+    "/properties/SourceAccount",
+    "/properties/SourceArn",
+    "/properties/Principal",
+    "/properties/PrincipalOrgID",
+    "/properties/Action",
+    "/properties/EventSourceToken"
+  ],
   "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/FunctionName",
+    "/properties/Id"
+  ],
   "properties": {
-    "Id": {
-      "description": "",
-      "type": "string",
-      "pattern": "^.*$",
+    "FunctionName": {
       "minLength": 1,
-      "maxLength": 256
+      "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+      "description": "The name or ARN of the Lambda function, version, or alias.\n  **Name formats**\n +   *Function name* – ``my-function`` (name-only), ``my-function:v1`` (with alias).\n  +   *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:my-function``.\n  +   *Partial ARN* – ``123456789012:function:my-function``.\n  \n You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.",
+      "type": "string",
+      "maxLength": 140
     },
     "Action": {
+      "minLength": 1,
+      "pattern": "^(lambda:[*]|lambda:[a-zA-Z]+|[*])$",
       "description": "The action that the principal can use on the function. For example, ``lambda:InvokeFunction`` or ``lambda:GetFunction``.",
       "type": "string",
-      "pattern": "^(lambda:[*]|lambda:[a-zA-Z]+|[*])$",
-      "minLength": 1,
       "maxLength": 256
     },
     "EventSourceToken": {
+      "minLength": 1,
+      "pattern": "^[a-zA-Z0-9._\\-]+$",
       "description": "For Alexa Smart Home functions, a token that the invoker must supply.",
       "type": "string",
-      "pattern": "^[a-zA-Z0-9._\\-]+$",
-      "minLength": 1,
       "maxLength": 256
     },
-    "FunctionName": {
-      "description": "The name or ARN of the Lambda function, version, or alias.\n  **Name formats**\n +   *Function name* ? ``my-function`` (name-only), ``my-function:v1`` (with alias).\n  +   *Function ARN* ? ``arn:aws:lambda:us-west-2:123456789012:function:my-function``.\n  +   *Partial ARN* ? ``123456789012:function:my-function``.\n  \n You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.",
-      "type": "string",
-      "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
-      "minLength": 1,
-      "maxLength": 140
-    },
     "FunctionUrlAuthType": {
       "description": "The type of authentication that your function URL uses. Set to ``AWS_IAM`` if you want to restrict access to authenticated users only. Set to ``NONE`` if you want to bypass IAM authentication to create a public endpoint. For more information, see [Security and auth model for Lambda function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html).",
       "type": "string",
@@ -39,100 +94,45 @@
         "NONE"
       ]
     },
-    "Principal": {
-      "description": "The AWS-service or AWS-account that invokes the function. If you specify a service, use ``SourceArn`` or ``SourceAccount`` to limit who can invoke the function through that service.",
+    "SourceArn": {
+      "minLength": 12,
+      "pattern": "^arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)$",
+      "description": "For AWS-services, the ARN of the AWS resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic.\n Note that Lambda configures the comparison using the ``StringLike`` operator.",
       "type": "string",
-      "pattern": "^.*$",
-      "minLength": 1,
-      "maxLength": 256
+      "maxLength": 1024
+    },
+    "SourceAccount": {
+      "minLength": 12,
+      "pattern": "^\\d{12}$",
+      "description": "For AWS-service, the ID of the AWS-account that owns the resource. Use this together with ``SourceArn`` to ensure that the specified account owns the resource. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.",
+      "type": "string",
+      "maxLength": 12
     },
     "PrincipalOrgID": {
+      "minLength": 12,
+      "pattern": "^o-[a-z0-9]{10,32}$",
       "description": "The identifier for your organization in AOlong. Use this to grant permissions to all the AWS-accounts under this organization.",
       "type": "string",
-      "pattern": "^o-[a-z0-9]{10,32}$",
-      "minLength": 12,
       "maxLength": 34
     },
-    "SourceAccount": {
-      "description": "For AWS-service, the ID of the AWS-account that owns the resource. Use this together with ``SourceArn`` to ensure that the specified account owns the resource. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.",
+    "Id": {
+      "minLength": 1,
+      "pattern": "^.*$",
+      "description": "",
       "type": "string",
-      "pattern": "^\\d{12}$",
-      "minLength": 12,
-      "maxLength": 12
+      "maxLength": 256
     },
-    "SourceArn": {
-      "description": "For AWS-services, the ARN of the AWS resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic.\n Note that Lambda configures the comparison using the ``StringLike`` operator.",
+    "Principal": {
+      "minLength": 1,
+      "pattern": "^.*$",
+      "description": "The AWS-service or AWS-account that invokes the function. If you specify a service, use ``SourceArn`` or ``SourceAccount`` to limit who can invoke the function through that service.",
       "type": "string",
-      "pattern": "^arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)$",
-      "minLength": 12,
-      "maxLength": 1024
+      "maxLength": 256
     }
   },
   "required": [
     "FunctionName",
     "Action",
     "Principal"
-  ],
-  "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
-  },
-  "createOnlyProperties": [
-    "/properties/FunctionName",
-    "/properties/FunctionUrlAuthType",
-    "/properties/SourceAccount",
-    "/properties/SourceArn",
-    "/properties/Principal",
-    "/properties/PrincipalOrgID",
-    "/properties/Action",
-    "/properties/EventSourceToken"
-  ],
-  "primaryIdentifier": [
-    "/properties/FunctionName",
-    "/properties/Id"
-  ],
-  "propertyTransform": {
-    "/properties/Principal": "$join([\"^arn:aws[a-zA-Z-]*:iam::\",Principal,\":[a-zA-Z-]*\"]) $OR Principal"
-  },
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "handlers": {
-    "create": {
-      "permissions": [
-        "lambda:AddPermission"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "lambda:GetPolicy"
-      ]
-    },
-    "delete": {
-      "permissions": [
-        "lambda:RemovePermission"
-      ]
-    },
-    "list": {
-      "handlerSchema": {
-        "properties": {
-          "FunctionName": {
-            "description": "The name of the Lambda function, version, or alias.",
-            "type": "string",
-            "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
-            "minLength": 1,
-            "maxLength": 140
-          }
-        },
-        "required": [
-          "FunctionName"
-        ]
-      },
-      "permissions": [
-        "lambda:GetPolicy"
-      ]
-    }
-  }
+  ]
 }
diff --git a/internal/aws/cfn/schemas/aws/location/apikey.json b/internal/aws/cfn/schemas/aws/location/apikey.json
index 2ecdeae7..843b2392 100644
--- a/internal/aws/cfn/schemas/aws/location/apikey.json
+++ b/internal/aws/cfn/schemas/aws/location/apikey.json
@@ -13,7 +13,7 @@
             "minLength": 5,
             "pattern": "^geo:\\w*\\*?$"
           },
-          "maxItems": 7,
+          "maxItems": 24,
           "minItems": 1,
           "insertionOrder": false
         },
@@ -24,7 +24,7 @@
             "maxLength": 1600,
             "pattern": "(^arn(:[a-z0-9]+([.-][a-z0-9]+)*):geo(:([a-z0-9]+([.-][a-z0-9]+)*))(:[0-9]+):((\\*)|([-a-z]+[/][*-._\\w]+))$)|(^arn(:[a-z0-9]+([.-][a-z0-9]+)*):(geo-routes|geo-places|geo-maps)(:((\\*)|([a-z0-9]+([.-][a-z0-9]+)*)))::((provider[\\/][*-._\\w]+))$)"
           },
-          "maxItems": 5,
+          "maxItems": 8,
           "minItems": 1,
           "insertionOrder": false
         },
diff --git a/internal/aws/cfn/schemas/aws/logs/deliverydestination.json b/internal/aws/cfn/schemas/aws/logs/deliverydestination.json
index f3f17b1b..4430b06e 100644
--- a/internal/aws/cfn/schemas/aws/logs/deliverydestination.json
+++ b/internal/aws/cfn/schemas/aws/logs/deliverydestination.json
@@ -69,7 +69,7 @@
       "$ref": "#/definitions/Arn"
     },
     "DestinationResourceArn": {
-      "description": "The ARN of the AWS resource that will receive the logs.",
+      "description": "The ARN of the Amazon Web Services destination that this delivery destination represents. That Amazon Web Services destination can be a log group in CloudWatch Logs, an Amazon S3 bucket, or a delivery stream in Firehose.",
       "$ref": "#/definitions/Arn"
     },
     "Tags": {
diff --git a/internal/aws/cfn/schemas/aws/msk/replicator.json b/internal/aws/cfn/schemas/aws/msk/replicator.json
index e6455752..32c9c4db 100644
--- a/internal/aws/cfn/schemas/aws/msk/replicator.json
+++ b/internal/aws/cfn/schemas/aws/msk/replicator.json
@@ -7,7 +7,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "kafka:UntagResource",
+      "kafka:ListTagsForResource",
+      "kafka:TagResource"
+    ]
   },
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-msk-replicator.git",
   "properties": {
@@ -132,6 +137,10 @@
         "StartingPosition": {
           "description": "Configuration for specifying the position in the topics to start replicating from.",
           "$ref": "#/definitions/ReplicationStartingPosition"
+        },
+        "TopicNameConfiguration": {
+          "description": "Configuration for specifying replicated topic names should be the same as their corresponding upstream topics or prefixed with source cluster alias.",
+          "$ref": "#/definitions/ReplicationTopicNameConfiguration"
         }
       },
       "required": [
@@ -157,6 +166,25 @@
         "EARLIEST"
       ]
     },
+    "ReplicationTopicNameConfiguration": {
+      "description": "Configuration for specifying replicated topic names should be the same as their corresponding upstream topics or prefixed with source cluster alias.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Type": {
+          "$ref": "#/definitions/ReplicationTopicNameConfigurationType"
+        }
+      },
+      "required": []
+    },
+    "ReplicationTopicNameConfigurationType": {
+      "description": "The type of replicated topic name.",
+      "type": "string",
+      "enum": [
+        "PREFIXED_WITH_SOURCE_CLUSTER_ALIAS",
+        "IDENTICAL"
+      ]
+    },
     "ConsumerGroupReplication": {
       "description": "Configuration relating to consumer group replication.",
       "type": "object",
@@ -330,8 +358,7 @@
     "/properties/ReplicatorName",
     "/properties/Description",
     "/properties/KafkaClusters",
-    "/properties/ServiceExecutionRoleArn",
-    "/properties/ReplicationInfoList/-/TopicReplication/StartingPosition/Type"
+    "/properties/ServiceExecutionRoleArn"
   ],
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/neptune/dbcluster.json b/internal/aws/cfn/schemas/aws/neptune/dbcluster.json
index 6d7b27c8..fad8b1a2 100644
--- a/internal/aws/cfn/schemas/aws/neptune/dbcluster.json
+++ b/internal/aws/cfn/schemas/aws/neptune/dbcluster.json
@@ -88,7 +88,7 @@
       "type": "boolean"
     },
     "KmsKeyId": {
-      "description": "If `StorageEncrypted` is true, the Amazon KMS key identifier for the encrypted DB cluster.",
+      "description": "The Amazon Resource Name (ARN) of the AWS KMS key that is used to encrypt the database instances in the DB cluster, such as arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef. If you enable the StorageEncrypted property but don't specify this property, the default KMS key is used. If you specify this property, you must set the StorageEncrypted property to true.",
       "type": "string"
     },
     "Port": {
@@ -125,7 +125,7 @@
       "type": "string"
     },
     "StorageEncrypted": {
-      "description": "Indicates whether the DB cluster is encrypted.\n\nIf you specify the `DBClusterIdentifier`, `DBSnapshotIdentifier`, or `SourceDBInstanceIdentifier` property, don't specify this property. The value is inherited from the cluster, snapshot, or source DB instance. If you specify the KmsKeyId property, you must enable encryption.\n\nIf you specify the KmsKeyId, you must enable encryption by setting StorageEncrypted to true.",
+      "description": "Indicates whether the DB cluster is encrypted.\n\nIf you specify the KmsKeyId property, then you must enable encryption and set this property to true.\n\nIf you enable the StorageEncrypted property but don't specify KmsKeyId property, then the default KMS key is used. If you specify KmsKeyId property, then that KMS Key is used to encrypt the database instances in the DB cluster.\n\nIf you specify the SourceDBClusterIdentifier property and don't specify this property or disable it. The value is inherited from the source DB cluster, and if the DB cluster is encrypted, the KmsKeyId property from the source cluster is used.\n\nIf you specify the DBSnapshotIdentifier and don't specify this property or disable it. The value is inherited from the snapshot, and the specified KmsKeyId property from the snapshot is used.",
       "type": "boolean"
     },
     "Tags": {
diff --git a/internal/aws/cfn/schemas/aws/qbusiness/application.json b/internal/aws/cfn/schemas/aws/qbusiness/application.json
index 58b85369..fb0bbf48 100644
--- a/internal/aws/cfn/schemas/aws/qbusiness/application.json
+++ b/internal/aws/cfn/schemas/aws/qbusiness/application.json
@@ -189,7 +189,8 @@
         "sso:DeleteApplication",
         "sso:PutApplicationAccessScope",
         "sso:PutApplicationAuthenticationMethod",
-        "sso:PutApplicationGrant"
+        "sso:PutApplicationGrant",
+        "sso:DescribeInstance"
       ]
     },
     "read": {
@@ -210,7 +211,8 @@
         "sso:DeleteApplication",
         "sso:PutApplicationAccessScope",
         "sso:PutApplicationAuthenticationMethod",
-        "sso:PutApplicationGrant"
+        "sso:PutApplicationGrant",
+        "sso:DescribeInstance"
       ]
     },
     "delete": {
diff --git a/internal/aws/cfn/schemas/aws/quicksight/dashboard.json b/internal/aws/cfn/schemas/aws/quicksight/dashboard.json
index 096ae55f..a2796553 100644
--- a/internal/aws/cfn/schemas/aws/quicksight/dashboard.json
+++ b/internal/aws/cfn/schemas/aws/quicksight/dashboard.json
@@ -2212,6 +2212,12 @@
         "SheetControlsOption": {
           "$ref": "#/definitions/SheetControlsOption"
         },
+        "ExportToCSVOption": {
+          "$ref": "#/definitions/ExportToCSVOption"
+        },
+        "DataPointMenuLabelOption": {
+          "$ref": "#/definitions/DataPointMenuLabelOption"
+        },
         "DataPointDrillUpDownOption": {
           "$ref": "#/definitions/DataPointDrillUpDownOption"
         },
@@ -2221,24 +2227,18 @@
         "VisualPublishOptions": {
           "$ref": "#/definitions/DashboardVisualPublishOptions"
         },
-        "VisualAxisSortOption": {
-          "$ref": "#/definitions/VisualAxisSortOption"
-        },
-        "ExportWithHiddenFieldsOption": {
-          "$ref": "#/definitions/ExportWithHiddenFieldsOption"
-        },
-        "ExportToCSVOption": {
-          "$ref": "#/definitions/ExportToCSVOption"
-        },
-        "DataPointMenuLabelOption": {
-          "$ref": "#/definitions/DataPointMenuLabelOption"
-        },
         "VisualMenuOption": {
           "$ref": "#/definitions/VisualMenuOption"
         },
         "DataPointTooltipOption": {
           "$ref": "#/definitions/DataPointTooltipOption"
         },
+        "VisualAxisSortOption": {
+          "$ref": "#/definitions/VisualAxisSortOption"
+        },
+        "ExportWithHiddenFieldsOption": {
+          "$ref": "#/definitions/ExportWithHiddenFieldsOption"
+        },
         "SheetLayoutElementMaximizationOption": {
           "$ref": "#/definitions/SheetLayoutElementMaximizationOption"
         }
diff --git a/internal/aws/cfn/schemas/aws/rds/dbinstance.json b/internal/aws/cfn/schemas/aws/rds/dbinstance.json
index a55dd97d..c9b3ba96 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbinstance.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbinstance.json
@@ -405,7 +405,7 @@
       "type": "string"
     },
     "RestoreTime": {
-      "description": "The date and time to restore from.\n Constraints:\n  +  Must be a time in Universal Coordinated Time (UTC) format.\n  +  Must be before the latest restorable time for the DB instance.\n  +  Can't be specified if the ``UseLatestRestorableTime`` parameter is enabled.\n  \n Example: ``2009-09-07T23:45:00Z``",
+      "description": "The date and time to restore from. This parameter applies to point-in-time recovery. For more information, see [Restoring a DB instance to a specified time](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIT.html) in the in the *Amazon RDS User Guide*.\n Constraints:\n  +  Must be a time in Universal Coordinated Time (UTC) format.\n  +  Must be before the latest restorable time for the DB instance.\n  +  Can't be specified if the ``UseLatestRestorableTime`` parameter is enabled.\n  \n Example: ``2009-09-07T23:45:00Z``",
       "type": "string",
       "format": "date-time"
     },
@@ -468,7 +468,7 @@
     },
     "UseLatestRestorableTime": {
       "type": "boolean",
-      "description": "Specifies whether the DB instance is restored from the latest backup time. By default, the DB instance isn't restored from the latest backup time.\n Constraints:\n  +  Can't be specified if the ``RestoreTime`` parameter is provided."
+      "description": "Specifies whether the DB instance is restored from the latest backup time. By default, the DB instance isn't restored from the latest backup time. This parameter applies to point-in-time recovery. For more information, see [Restoring a DB instance to a specified time](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIT.html) in the in the *Amazon RDS User Guide*.\n Constraints:\n  +  Can't be specified if the ``RestoreTime`` parameter is provided."
     },
     "VPCSecurityGroups": {
       "type": "array",
diff --git a/internal/aws/cfn/schemas/aws/rds/globalcluster.json b/internal/aws/cfn/schemas/aws/rds/globalcluster.json
index ec6fe837..86637ef1 100644
--- a/internal/aws/cfn/schemas/aws/rds/globalcluster.json
+++ b/internal/aws/cfn/schemas/aws/rds/globalcluster.json
@@ -27,7 +27,9 @@
     "GlobalClusterIdentifier": {
       "description": "The cluster identifier of the new global database cluster. This parameter is stored as a lowercase string.",
       "type": "string",
-      "pattern": "^[a-zA-Z]{1}(?:-?[a-zA-Z0-9]){0,62}$"
+      "pattern": "^[a-zA-Z]{1}(?:-?[a-zA-Z0-9]){0,62}$",
+      "minLength": 1,
+      "maxLength": 63
     },
     "SourceDBClusterIdentifier": {
       "description": "The Amazon Resource Name (ARN) to use as the primary cluster of the global database. This parameter is optional. This parameter is stored as a lowercase string.",
diff --git a/internal/aws/cfn/schemas/aws/route53/hostedzone.json b/internal/aws/cfn/schemas/aws/route53/hostedzone.json
index ad4dc05f..96190c71 100644
--- a/internal/aws/cfn/schemas/aws/route53/hostedzone.json
+++ b/internal/aws/cfn/schemas/aws/route53/hostedzone.json
@@ -137,6 +137,17 @@
   "propertyTransform": {
     "/properties/Name": "Name $OR $join([Name, \".\"])"
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/HostedZoneTags",
+    "permissions": [
+      "route53:ChangeTagsForResource",
+      "route53:ListTagsForResource"
+    ]
+  },
   "handlers": {
     "create": {
       "permissions": [
diff --git a/internal/aws/cfn/schemas/aws/s3/bucket.json b/internal/aws/cfn/schemas/aws/s3/bucket.json
index 10516870..30aa76f3 100644
--- a/internal/aws/cfn/schemas/aws/s3/bucket.json
+++ b/internal/aws/cfn/schemas/aws/s3/bucket.json
@@ -1,215 +1,264 @@
 {
-  "typeName": "AWS::S3::Bucket",
-  "description": "The ``AWS::S3::Bucket`` resource creates an Amazon S3 bucket in the same AWS Region where you create the AWS CloudFormation stack.\n To control how AWS CloudFormation handles the bucket when the stack is deleted, you can set a deletion policy for your bucket. You can choose to *retain* the bucket or to *delete* the bucket. For more information, see [DeletionPolicy Attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html).\n  You can only delete empty buckets. Deletion fails for buckets that have contents.",
-  "additionalProperties": false,
-  "properties": {
-    "AccelerateConfiguration": {
-      "$ref": "#/definitions/AccelerateConfiguration",
-      "description": "Configures the transfer acceleration state for an Amazon S3 bucket. For more information, see [Amazon S3 Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html) in the *Amazon S3 User Guide*."
-    },
-    "AccessControl": {
-      "description": "This is a legacy property, and it is not recommended for most use cases. A majority of modern use cases in Amazon S3 no longer require the use of ACLs, and we recommend that you keep ACLs disabled. For more information, see [Controlling object ownership](https://docs.aws.amazon.com//AmazonS3/latest/userguide/about-object-ownership.html) in the *Amazon S3 User Guide*.\n  A canned access control list (ACL) that grants predefined permissions to the bucket. For more information about canned ACLs, see [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) in the *Amazon S3 User Guide*.\n  S3 buckets are created with ACLs disabled by default. Therefore, unless you explicitly set the [AWS::S3::OwnershipControls](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-ownershipcontrols.html) property to enable ACLs, your resource will fail to deploy with any value other than Private. Use cases requiring ACLs are uncommon.\n  The majority of access control configurations can be successfully and more easily achieved with bucket policies. For more information, see [AWS::S3::BucketPolicy](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html). For examples of common policy configurations, including S3 Server Access Logs buckets and more, see [Bucket policy examples](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html) in the *Amazon S3 User Guide*.",
-      "enum": [
-        "AuthenticatedRead",
-        "AwsExecRead",
-        "BucketOwnerFullControl",
-        "BucketOwnerRead",
-        "LogDeliveryWrite",
-        "Private",
-        "PublicRead",
-        "PublicReadWrite"
-      ],
-      "type": "string"
-    },
-    "AnalyticsConfigurations": {
-      "description": "Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.",
-      "items": {
-        "$ref": "#/definitions/AnalyticsConfiguration"
-      },
-      "type": "array",
-      "uniqueItems": true,
-      "insertionOrder": true
-    },
-    "BucketEncryption": {
-      "$ref": "#/definitions/BucketEncryption",
-      "description": "Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS). For information about the Amazon S3 default encryption feature, see [Amazon S3 Default Encryption for S3 Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) in the *Amazon S3 User Guide*."
-    },
-    "BucketName": {
-      "description": "A name for the bucket. If you don't specify a name, AWS CloudFormation generates a unique ID and uses that ID for the bucket name. The bucket name must contain only lowercase letters, numbers, periods (.), and dashes (-) and must follow [Amazon S3 bucket restrictions and limitations](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html). For more information, see [Rules for naming Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html#bucketnamingrules) in the *Amazon S3 User Guide*. \n  If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you need to replace the resource, specify a new name.",
-      "type": "string"
-    },
-    "CorsConfiguration": {
-      "$ref": "#/definitions/CorsConfiguration",
-      "description": "Describes the cross-origin access configuration for objects in an Amazon S3 bucket. For more information, see [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) in the *Amazon S3 User Guide*."
-    },
-    "IntelligentTieringConfigurations": {
-      "description": "Defines how Amazon S3 handles Intelligent-Tiering storage.",
-      "items": {
-        "$ref": "#/definitions/IntelligentTieringConfiguration"
-      },
-      "type": "array",
-      "uniqueItems": true,
-      "insertionOrder": true
-    },
-    "InventoryConfigurations": {
-      "description": "Specifies the inventory configuration for an Amazon S3 bucket. For more information, see [GET Bucket inventory](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETInventoryConfig.html) in the *Amazon S3 API Reference*.",
-      "items": {
-        "$ref": "#/definitions/InventoryConfiguration"
-      },
-      "type": "array",
-      "uniqueItems": true,
-      "insertionOrder": true
-    },
-    "LifecycleConfiguration": {
-      "$ref": "#/definitions/LifecycleConfiguration",
-      "description": "Specifies the lifecycle configuration for objects in an Amazon S3 bucket. For more information, see [Object Lifecycle Management](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) in the *Amazon S3 User Guide*."
-    },
-    "LoggingConfiguration": {
-      "$ref": "#/definitions/LoggingConfiguration",
-      "description": "Settings that define where logs are stored."
-    },
-    "MetricsConfigurations": {
-      "description": "Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased. For more information, see [PutBucketMetricsConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTMetricConfiguration.html).",
-      "items": {
-        "$ref": "#/definitions/MetricsConfiguration"
-      },
-      "type": "array",
-      "uniqueItems": true,
-      "insertionOrder": true
-    },
-    "NotificationConfiguration": {
-      "$ref": "#/definitions/NotificationConfiguration",
-      "description": "Configuration that defines how Amazon S3 handles bucket notifications."
-    },
-    "ObjectLockConfiguration": {
-      "$ref": "#/definitions/ObjectLockConfiguration",
-      "description": "This operation is not supported by directory buckets.\n  Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see [Locking Objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html). \n   +  The ``DefaultRetention`` settings require both a mode and a period.\n  +  The ``DefaultRetention`` period can be either ``Days`` or ``Years`` but you must select one. You cannot specify ``Days`` and ``Years`` at the same time.\n  +  You can enable Object Lock for new or existing buckets. For more information, see [Configuring Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-configure.html)."
-    },
-    "ObjectLockEnabled": {
-      "description": "Indicates whether this bucket has an Object Lock configuration enabled. Enable ``ObjectLockEnabled`` when you apply ``ObjectLockConfiguration`` to a bucket.",
-      "type": "boolean"
-    },
-    "OwnershipControls": {
-      "description": "Configuration that defines how Amazon S3 handles Object Ownership rules.",
-      "$ref": "#/definitions/OwnershipControls"
-    },
-    "PublicAccessBlockConfiguration": {
-      "$ref": "#/definitions/PublicAccessBlockConfiguration",
-      "description": "Configuration that defines how Amazon S3 handles public access."
-    },
-    "ReplicationConfiguration": {
-      "$ref": "#/definitions/ReplicationConfiguration",
-      "description": "Configuration for replicating objects in an S3 bucket. To enable replication, you must also enable versioning by using the ``VersioningConfiguration`` property.\n Amazon S3 can store replicated objects in a single destination bucket or multiple destination buckets. The destination bucket or buckets must already exist."
-    },
-    "Tags": {
-      "description": "An arbitrary set of tags (key-value pairs) for this S3 bucket.",
-      "insertionOrder": false,
-      "items": {
-        "$ref": "#/definitions/Tag"
-      },
-      "type": "array"
-    },
-    "VersioningConfiguration": {
-      "$ref": "#/definitions/VersioningConfiguration",
-      "description": "Enables multiple versions of all objects in this bucket. You might enable versioning to prevent objects from being deleted or overwritten by mistake or to archive objects so that you can retrieve previous versions of them."
-    },
-    "WebsiteConfiguration": {
-      "$ref": "#/definitions/WebsiteConfiguration",
-      "description": "Information used to configure the bucket as a static website. For more information, see [Hosting Websites on Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html)."
-    },
-    "Arn": {
-      "$ref": "#/definitions/Arn",
-      "description": "",
-      "examples": [
-        "arn:aws:s3:::mybucket"
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
+  "propertyTransform": {
+    "/properties/NotificationConfiguration/LambdaConfigurations/*/Filter/S3Key/Rules/*/Name": "$replace(Name, \"prefix\", \"Prefix\") $OR $replace(Name, \"suffix\", \"Suffix\")",
+    "/properties/NotificationConfiguration/QueueConfigurations/*/Filter/S3Key/Rules/*/Name": "$replace(Name, \"prefix\", \"Prefix\") $OR $replace(Name, \"suffix\", \"Suffix\")",
+    "/properties/NotificationConfiguration/TopicConfigurations/*/Filter/S3Key/Rules/*/Name": "$replace(Name, \"prefix\", \"Prefix\") $OR $replace(Name, \"suffix\", \"Suffix\")"
+  },
+  "handlers": {
+    "read": {
+      "permissions": [
+        "s3:GetAccelerateConfiguration",
+        "s3:GetLifecycleConfiguration",
+        "s3:GetBucketPublicAccessBlock",
+        "s3:GetAnalyticsConfiguration",
+        "s3:GetBucketCORS",
+        "s3:GetEncryptionConfiguration",
+        "s3:GetInventoryConfiguration",
+        "s3:GetBucketLogging",
+        "s3:GetMetricsConfiguration",
+        "s3:GetBucketNotification",
+        "s3:GetBucketVersioning",
+        "s3:GetReplicationConfiguration",
+        "S3:GetBucketWebsite",
+        "s3:GetBucketPublicAccessBlock",
+        "s3:GetBucketObjectLockConfiguration",
+        "s3:GetBucketTagging",
+        "s3:GetBucketOwnershipControls",
+        "s3:GetIntelligentTieringConfiguration",
+        "s3:ListBucket"
       ]
     },
-    "DomainName": {
-      "description": "",
-      "examples": [
-        "mystack-mybucket-kdwwxmddtr2g.s3.amazonaws.com"
-      ],
-      "type": "string"
+    "create": {
+      "permissions": [
+        "s3:CreateBucket",
+        "s3:PutBucketTagging",
+        "s3:PutAnalyticsConfiguration",
+        "s3:PutEncryptionConfiguration",
+        "s3:PutBucketCORS",
+        "s3:PutInventoryConfiguration",
+        "s3:PutLifecycleConfiguration",
+        "s3:PutMetricsConfiguration",
+        "s3:PutBucketNotification",
+        "s3:PutBucketReplication",
+        "s3:PutBucketWebsite",
+        "s3:PutAccelerateConfiguration",
+        "s3:PutBucketPublicAccessBlock",
+        "s3:PutReplicationConfiguration",
+        "s3:PutObjectAcl",
+        "s3:PutBucketObjectLockConfiguration",
+        "s3:GetBucketAcl",
+        "s3:ListBucket",
+        "iam:PassRole",
+        "s3:DeleteObject",
+        "s3:PutBucketLogging",
+        "s3:PutBucketVersioning",
+        "s3:PutObjectLockConfiguration",
+        "s3:PutBucketOwnershipControls",
+        "s3:PutIntelligentTieringConfiguration"
+      ]
     },
-    "DualStackDomainName": {
-      "description": "",
-      "examples": [
-        "mystack-mybucket-kdwwxmddtr2g.s3.dualstack.us-east-2.amazonaws.com"
-      ],
-      "type": "string"
+    "update": {
+      "permissions": [
+        "s3:PutBucketAcl",
+        "s3:PutBucketTagging",
+        "s3:PutAnalyticsConfiguration",
+        "s3:PutEncryptionConfiguration",
+        "s3:PutBucketCORS",
+        "s3:PutInventoryConfiguration",
+        "s3:PutLifecycleConfiguration",
+        "s3:PutMetricsConfiguration",
+        "s3:PutBucketNotification",
+        "s3:PutBucketReplication",
+        "s3:PutBucketWebsite",
+        "s3:PutAccelerateConfiguration",
+        "s3:PutBucketPublicAccessBlock",
+        "s3:PutReplicationConfiguration",
+        "s3:PutBucketOwnershipControls",
+        "s3:PutIntelligentTieringConfiguration",
+        "s3:DeleteBucketWebsite",
+        "s3:PutBucketLogging",
+        "s3:PutBucketVersioning",
+        "s3:PutObjectLockConfiguration",
+        "s3:PutBucketObjectLockConfiguration",
+        "s3:DeleteBucketAnalyticsConfiguration",
+        "s3:DeleteBucketCors",
+        "s3:DeleteBucketMetricsConfiguration",
+        "s3:DeleteBucketEncryption",
+        "s3:DeleteBucketLifecycle",
+        "s3:DeleteBucketReplication",
+        "iam:PassRole",
+        "s3:ListBucket"
+      ]
     },
-    "RegionalDomainName": {
-      "description": "",
-      "examples": [
-        "mystack-mybucket-kdwwxmddtr2g.s3.us-east-2.amazonaws.com"
-      ],
-      "type": "string"
+    "list": {
+      "permissions": [
+        "s3:ListAllMyBuckets"
+      ]
     },
-    "WebsiteURL": {
-      "description": "",
-      "examples": [
-        "Example (IPv4): http://mystack-mybucket-kdwwxmddtr2g.s3-website-us-east-2.amazonaws.com/",
-        "Example (IPv6): http://mystack-mybucket-kdwwxmddtr2g.s3.dualstack.us-east-2.amazonaws.com/"
-      ],
-      "format": "uri",
-      "type": "string"
+    "delete": {
+      "permissions": [
+        "s3:DeleteBucket",
+        "s3:ListBucket"
+      ]
     }
   },
+  "typeName": "AWS::S3::Bucket",
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/DomainName",
+    "/properties/DualStackDomainName",
+    "/properties/RegionalDomainName",
+    "/properties/WebsiteURL"
+  ],
+  "description": "The ``AWS::S3::Bucket`` resource creates an Amazon S3 bucket in the same AWS Region where you create the AWS CloudFormation stack.\n To control how AWS CloudFormation handles the bucket when the stack is deleted, you can set a deletion policy for your bucket. You can choose to *retain* the bucket or to *delete* the bucket. For more information, see [DeletionPolicy Attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html).\n  You can only delete empty buckets. Deletion fails for buckets that have contents.",
+  "writeOnlyProperties": [
+    "/properties/AccessControl",
+    "/properties/LifecycleConfiguration/Rules/*/NoncurrentVersionExpirationInDays",
+    "/properties/LifecycleConfiguration/Rules/*/NoncurrentVersionTransition",
+    "/properties/LifecycleConfiguration/Rules/*/Transition",
+    "/properties/ReplicationConfiguration/Rules/*/Prefix",
+    "/properties/LifecycleConfiguration/Rules/*/ExpiredObjectDeleteMarker"
+  ],
+  "createOnlyProperties": [
+    "/properties/BucketName"
+  ],
+  "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/BucketName"
+  ],
   "definitions": {
-    "TagFilter": {
-      "description": "Specifies tags to use to identify a subset of objects for an Amazon S3 bucket.",
+    "DefaultRetention": {
+      "description": "The container element for optionally specifying the default Object Lock retention settings for new objects placed in the specified bucket.\n   +  The ``DefaultRetention`` settings require both a mode and a period.\n  +  The ``DefaultRetention`` period can be either ``Days`` or ``Years`` but you must select one. You cannot specify ``Days`` and ``Years`` at the same time.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Years": {
+          "description": "The number of years that you want to specify for the default retention period. If Object Lock is turned on, you must specify ``Mode`` and specify either ``Days`` or ``Years``.",
+          "type": "integer"
+        },
+        "Days": {
+          "description": "The number of days that you want to specify for the default retention period. If Object Lock is turned on, you must specify ``Mode`` and specify either ``Days`` or ``Years``.",
+          "type": "integer"
+        },
+        "Mode": {
+          "description": "The default Object Lock retention mode you want to apply to new objects placed in the specified bucket. If Object Lock is turned on, you must specify ``Mode`` and specify either ``Days`` or ``Years``.",
+          "type": "string",
+          "enum": [
+            "COMPLIANCE",
+            "GOVERNANCE"
+          ]
+        }
+      }
+    },
+    "SourceSelectionCriteria": {
+      "description": "A container that describes additional filters for identifying the source objects that you want to replicate. You can choose to enable or disable the replication of these objects.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "ReplicaModifications": {
+          "description": "A filter that you can specify for selection for modifications on replicas.",
+          "$ref": "#/definitions/ReplicaModifications"
+        },
+        "SseKmsEncryptedObjects": {
+          "description": "A container for filter information for the selection of Amazon S3 objects encrypted with AWS KMS.",
+          "$ref": "#/definitions/SseKmsEncryptedObjects"
+        }
+      }
+    },
+    "ReplicationTimeValue": {
+      "description": "A container specifying the time value for S3 Replication Time Control (S3 RTC) and replication metrics ``EventThreshold``.",
+      "additionalProperties": false,
       "type": "object",
+      "properties": {
+        "Minutes": {
+          "description": "Contains an integer specifying time in minutes. \n  Valid value: 15",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "Minutes"
+      ]
+    },
+    "FilterRule": {
+      "description": "Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as ``2023-`` or ``engineering/``. Then, you can use ``FilterRule`` to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "Value": {
-          "type": "string",
-          "description": "The tag value."
+          "description": "The value that the filter searches for in object key names.",
+          "type": "string"
         },
-        "Key": {
+        "Name": {
+          "description": "The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see [Configuring Event Notifications](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
           "type": "string",
-          "description": "The tag key."
+          "maxLength": 1024
         }
       },
       "required": [
         "Value",
-        "Key"
+        "Name"
       ]
     },
-    "Destination": {
-      "description": "Specifies information about where to publish analysis or configuration results for an Amazon S3 bucket.",
-      "type": "object",
+    "ReplicationRule": {
+      "description": "Specifies which Amazon S3 objects to replicate and where to store the replicas.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "BucketArn": {
-          "description": "The Amazon Resource Name (ARN) of the bucket to which data is exported.",
-          "type": "string"
-        },
-        "BucketAccountId": {
-          "description": "The account ID that owns the destination S3 bucket. If no account ID is provided, the owner is not validated before exporting data.\n   Although this value is optional, we strongly recommend that you set it to help prevent problems if the destination bucket ownership changes.",
-          "type": "string"
-        },
-        "Format": {
-          "description": "Specifies the file format used when exporting data to Amazon S3.\n  *Allowed values*: ``CSV`` | ``ORC`` | ``Parquet``",
+        "Status": {
+          "description": "Specifies whether the rule is enabled.",
           "type": "string",
           "enum": [
-            "CSV",
-            "ORC",
-            "Parquet"
+            "Disabled",
+            "Enabled"
           ]
         },
+        "Destination": {
+          "description": "A container for information about the replication destination and its configurations including enabling the S3 Replication Time Control (S3 RTC).",
+          "$ref": "#/definitions/ReplicationDestination"
+        },
+        "Filter": {
+          "description": "A filter that identifies the subset of objects to which the replication rule applies. A ``Filter`` must specify exactly one ``Prefix``, ``TagFilter``, or an ``And`` child element. The use of the filter field indicates that this is a V2 replication configuration. This field isn't supported in a V1 replication configuration.\n  V1 replication configuration only supports filtering by key prefix. To filter using a V1 replication configuration, add the ``Prefix`` directly as a child element of the ``Rule`` element.",
+          "$ref": "#/definitions/ReplicationRuleFilter"
+        },
+        "Priority": {
+          "description": "The priority indicates which rule has precedence whenever two or more replication rules conflict. Amazon S3 will attempt to replicate objects according to all replication rules. However, if there are two or more rules with the same destination bucket, then objects will be replicated according to the rule with the highest priority. The higher the number, the higher the priority. \n For more information, see [Replication](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication.html) in the *Amazon S3 User Guide*.",
+          "type": "integer"
+        },
+        "SourceSelectionCriteria": {
+          "description": "A container that describes additional filters for identifying the source objects that you want to replicate. You can choose to enable or disable the replication of these objects.",
+          "$ref": "#/definitions/SourceSelectionCriteria"
+        },
+        "Id": {
+          "description": "A unique identifier for the rule. The maximum value is 255 characters. If you don't specify a value, AWS CloudFormation generates a random ID. When using a V2 replication configuration this property is capitalized as \"ID\".",
+          "type": "string",
+          "maxLength": 255
+        },
         "Prefix": {
-          "description": "The prefix to use when exporting data. The prefix is prepended to all results.",
-          "type": "string"
+          "description": "An object key name prefix that identifies the object or objects to which the rule applies. The maximum prefix length is 1,024 characters. To include all objects in a bucket, specify an empty string. To filter using a V1 replication configuration, add the ``Prefix`` directly as a child element of the ``Rule`` element.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
+          "type": "string",
+          "maxLength": 1024
+        },
+        "DeleteMarkerReplication": {
+          "description": "Specifies whether Amazon S3 replicates delete markers. If you specify a ``Filter`` in your replication configuration, you must also include a ``DeleteMarkerReplication`` element. If your ``Filter`` includes a ``Tag`` element, the ``DeleteMarkerReplication`` ``Status`` must be set to Disabled, because Amazon S3 does not support replicating delete markers for tag-based rules. For an example configuration, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-config-min-rule-config). \n For more information about delete marker replication, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/delete-marker-replication.html). \n  If you are using an earlier version of the replication configuration, Amazon S3 handles replication of delete markers differently. For more information, see [Backward Compatibility](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-backward-compat-considerations).",
+          "$ref": "#/definitions/DeleteMarkerReplication"
         }
       },
       "required": [
-        "BucketArn",
-        "Format"
+        "Destination",
+        "Status"
       ]
     },
     "AccelerateConfiguration": {
-      "type": "object",
+      "description": "Configures the transfer acceleration state for an Amazon S3 bucket. For more information, see [Amazon S3 Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "AccelerationStatus": {
           "description": "Specifies the transfer acceleration status of the bucket.",
@@ -222,799 +271,637 @@
       },
       "required": [
         "AccelerationStatus"
+      ]
+    },
+    "TargetObjectKeyFormat": {
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "SimplePrefix": {
+              "description": "This format defaults the prefix to the given log file prefix for delivering server access log file.",
+              "additionalProperties": false,
+              "type": "object"
+            }
+          },
+          "required": [
+            "SimplePrefix"
+          ]
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "PartitionedPrefix": {
+              "$ref": "#/definitions/PartitionedPrefix"
+            }
+          },
+          "required": [
+            "PartitionedPrefix"
+          ]
+        }
       ],
-      "description": "Configures the transfer acceleration state for an Amazon S3 bucket. For more information, see [Amazon S3 Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html) in the *Amazon S3 User Guide*."
+      "description": "Describes the key format for server access log file in the target bucket. You can choose between SimplePrefix and PartitionedPrefix.",
+      "type": "object"
     },
-    "AnalyticsConfiguration": {
-      "description": "Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.",
-      "type": "object",
+    "Metrics": {
+      "description": "A container specifying replication metrics-related settings enabling replication metrics and events.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "TagFilters": {
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/TagFilter"
-          },
-          "description": "The tags to use when evaluating an analytics filter.\n The analytics only includes objects that meet the filter's criteria. If no filter is specified, all of the contents of the bucket are included in the analysis."
-        },
-        "StorageClassAnalysis": {
-          "$ref": "#/definitions/StorageClassAnalysis",
-          "description": "Contains data related to access patterns to be collected and made available to analyze the tradeoffs between different storage classes."
-        },
-        "Id": {
-          "description": "The ID that identifies the analytics configuration.",
-          "type": "string"
+        "Status": {
+          "description": "Specifies whether the replication metrics are enabled.",
+          "type": "string",
+          "enum": [
+            "Disabled",
+            "Enabled"
+          ]
         },
-        "Prefix": {
-          "description": "The prefix that an object must have to be included in the analytics results.",
-          "type": "string"
+        "EventThreshold": {
+          "description": "A container specifying the time threshold for emitting the ``s3:Replication:OperationMissedThreshold`` event.",
+          "$ref": "#/definitions/ReplicationTimeValue"
         }
       },
       "required": [
-        "StorageClassAnalysis",
-        "Id"
+        "Status"
       ]
     },
-    "StorageClassAnalysis": {
-      "description": "Specifies data related to access patterns to be collected and made available to analyze the tradeoffs between different storage classes for an Amazon S3 bucket.",
-      "type": "object",
+    "RoutingRuleCondition": {
+      "description": "A container for describing a condition that must be met for the specified redirect to apply. For example, 1. If request is for pages in the ``/docs`` folder, redirect to the ``/documents`` folder. 2. If request results in HTTP error 4xx, redirect request to another host where you might process the error.",
       "additionalProperties": false,
-      "properties": {
-        "DataExport": {
-          "$ref": "#/definitions/DataExport",
-          "description": "Specifies how data related to the storage class analysis for an Amazon S3 bucket should be exported."
-        }
-      }
-    },
-    "DataExport": {
-      "description": "Specifies how data related to the storage class analysis for an Amazon S3 bucket should be exported.",
       "type": "object",
-      "additionalProperties": false,
       "properties": {
-        "Destination": {
-          "$ref": "#/definitions/Destination",
-          "description": "The place to store the data for an analysis."
+        "KeyPrefixEquals": {
+          "description": "The object key name prefix when the redirect is applied. For example, to redirect requests for ``ExamplePage.html``, the key prefix will be ``ExamplePage.html``. To redirect request for all pages with the prefix ``docs/``, the key prefix will be ``/docs``, which identifies all objects in the docs/ folder.\n Required when the parent element ``Condition`` is specified and sibling ``HttpErrorCodeReturnedEquals`` is not specified. If both conditions are specified, both must be true for the redirect to be applied.",
+          "type": "string"
         },
-        "OutputSchemaVersion": {
-          "description": "The version of the output schema to use when exporting data. Must be ``V_1``.",
-          "type": "string",
-          "const": "V_1"
+        "HttpErrorCodeReturnedEquals": {
+          "description": "The HTTP error code when the redirect is applied. In the event of an error, if the error code equals this value, then the specified redirect is applied.\n Required when parent element ``Condition`` is specified and sibling ``KeyPrefixEquals`` is not specified. If both are specified, then both must be true for the redirect to be applied.",
+          "type": "string"
         }
-      },
-      "required": [
-        "Destination",
-        "OutputSchemaVersion"
-      ]
+      }
     },
-    "BucketEncryption": {
-      "description": "Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS). For information about the Amazon S3 default encryption feature, see [Amazon S3 Default Encryption for S3 Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) in the *Amazon S3 User Guide*.",
-      "type": "object",
+    "OwnershipControls": {
+      "description": "Specifies the container element for Object Ownership rules.\n S3 Object Ownership is an Amazon S3 bucket-level setting that you can use to disable access control lists (ACLs) and take ownership of every object in your bucket, simplifying access management for data stored in Amazon S3. For more information, see [Controlling ownership of objects and disabling ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
-      "properties": {
-        "ServerSideEncryptionConfiguration": {
-          "description": "Specifies the default server-side-encryption configuration.",
-          "type": "array",
+      "type": "object",
+      "properties": {
+        "Rules": {
           "uniqueItems": true,
+          "description": "Specifies the container element for Object Ownership rules.",
           "insertionOrder": true,
+          "type": "array",
           "items": {
-            "$ref": "#/definitions/ServerSideEncryptionRule"
+            "$ref": "#/definitions/OwnershipControlsRule"
           }
         }
       },
       "required": [
-        "ServerSideEncryptionConfiguration"
+        "Rules"
       ]
     },
-    "ServerSideEncryptionRule": {
-      "description": "Specifies the default server-side encryption configuration.",
-      "type": "object",
+    "DeleteMarkerReplication": {
+      "description": "Specifies whether Amazon S3 replicates delete markers. If you specify a ``Filter`` in your replication configuration, you must also include a ``DeleteMarkerReplication`` element. If your ``Filter`` includes a ``Tag`` element, the ``DeleteMarkerReplication`` ``Status`` must be set to Disabled, because Amazon S3 does not support replicating delete markers for tag-based rules. For an example configuration, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-config-min-rule-config). \n For more information about delete marker replication, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/delete-marker-replication.html). \n  If you are using an earlier version of the replication configuration, Amazon S3 handles replication of delete markers differently. For more information, see [Backward Compatibility](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-backward-compat-considerations).",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "BucketKeyEnabled": {
-          "description": "Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Setting the ``BucketKeyEnabled`` element to ``true`` causes Amazon S3 to use an S3 Bucket Key. By default, S3 Bucket Key is not enabled.\n For more information, see [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) in the *Amazon S3 User Guide*.",
-          "type": "boolean"
-        },
-        "ServerSideEncryptionByDefault": {
-          "$ref": "#/definitions/ServerSideEncryptionByDefault",
-          "description": "Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied."
+        "Status": {
+          "description": "Indicates whether to replicate delete markers. Disabled by default.",
+          "type": "string",
+          "enum": [
+            "Disabled",
+            "Enabled"
+          ]
         }
       }
     },
-    "ServerSideEncryptionByDefault": {
-      "description": "Describes the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied. If you don't specify a customer managed key at configuration, Amazon S3 automatically creates an AWS KMS key in your AWS account the first time that you add an object encrypted with SSE-KMS to a bucket. By default, Amazon S3 uses this KMS key for SSE-KMS. For more information, see [PUT Bucket encryption](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTencryption.html) in the *Amazon S3 API Reference*.",
+    "RoutingRule": {
+      "description": "Specifies the redirect behavior and when a redirect is applied. For more information about routing rules, see [Configuring advanced conditional redirects](https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html#advanced-conditional-redirects) in the *Amazon S3 User Guide*.",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "KMSMasterKeyID": {
-          "description": "AWS Key Management Service (KMS) customer AWS KMS key ID to use for the default encryption. This parameter is allowed if and only if ``SSEAlgorithm`` is set to ``aws:kms`` or ``aws:kms:dsse``.\n You can specify the key ID, key alias, or the Amazon Resource Name (ARN) of the KMS key.\n  +  Key ID: ``1234abcd-12ab-34cd-56ef-1234567890ab`` \n  +  Key ARN: ``arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`` \n  +  Key Alias: ``alias/alias-name`` \n  \n If you use a key ID, you can run into a LogDestination undeliverable error when creating a VPC flow log. \n If you are using encryption with cross-account or AWS service operations you must use a fully qualified KMS key ARN. For more information, see [Using encryption for cross-account operations](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-update-bucket-policy).\n  Amazon S3 only supports symmetric encryption KMS keys. For more information, see [Asymmetric keys in KMS](https://docs.aws.amazon.com//kms/latest/developerguide/symmetric-asymmetric.html) in the *Key Management Service Developer Guide*.",
-          "type": "string",
-          "anyOf": [
-            {
-              "relationshipRef": {
-                "typeName": "AWS::KMS::Key",
-                "propertyPath": "/properties/KeyId"
-              }
-            },
-            {
-              "relationshipRef": {
-                "typeName": "AWS::KMS::Key",
-                "propertyPath": "/properties/Arn"
-              }
-            },
-            {
-              "relationshipRef": {
-                "typeName": "AWS::KMS::Alias",
-                "propertyPath": "/properties/AliasName"
-              }
-            }
-          ]
+        "RedirectRule": {
+          "description": "Container for redirect information. You can redirect requests to another host, to another page, or with another protocol. In the event of an error, you can specify a different error code to return.",
+          "$ref": "#/definitions/RedirectRule"
         },
-        "SSEAlgorithm": {
-          "type": "string",
-          "enum": [
-            "aws:kms",
-            "AES256",
-            "aws:kms:dsse"
-          ],
-          "description": "Server-side encryption algorithm to use for the default encryption."
+        "RoutingRuleCondition": {
+          "description": "A container for describing a condition that must be met for the specified redirect to apply. For example, 1. If request is for pages in the ``/docs`` folder, redirect to the ``/documents`` folder. 2. If request results in HTTP error 4xx, redirect request to another host where you might process the error.",
+          "$ref": "#/definitions/RoutingRuleCondition"
         }
       },
-      "additionalProperties": false,
       "required": [
-        "SSEAlgorithm"
+        "RedirectRule"
       ]
     },
-    "CorsConfiguration": {
-      "type": "object",
+    "NotificationFilter": {
+      "description": "Specifies object key name filtering rules. For information about key name filtering, see [Configuring event notifications using object key name filtering](https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
-      "properties": {
-        "CorsRules": {
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/CorsRule",
-            "maxLength": 100
-          },
-          "description": "A set of origins and methods (cross-origin access that you want to allow). You can add up to 100 rules to the configuration."
-        }
-      },
-      "required": [
-        "CorsRules"
-      ],
-      "description": "Describes the cross-origin access configuration for objects in an Amazon S3 bucket. For more information, see [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) in the *Amazon S3 User Guide*."
-    },
-    "CorsRule": {
       "type": "object",
-      "description": "Specifies a cross-origin access rule for an Amazon S3 bucket.",
-      "additionalProperties": false,
       "properties": {
-        "AllowedHeaders": {
-          "description": "Headers that are specified in the ``Access-Control-Request-Headers`` header. These headers are allowed in a preflight OPTIONS request. In response to any preflight OPTIONS request, Amazon S3 returns any requested headers that are allowed.",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "type": "string"
-          }
-        },
-        "AllowedMethods": {
-          "description": "An HTTP method that you allow the origin to run.\n  *Allowed values*: ``GET`` | ``PUT`` | ``HEAD`` | ``POST`` | ``DELETE``",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "type": "string",
-            "enum": [
-              "GET",
-              "PUT",
-              "HEAD",
-              "POST",
-              "DELETE"
-            ]
-          }
-        },
-        "AllowedOrigins": {
-          "description": "One or more origins you want customers to be able to access the bucket from.",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "type": "string"
-          }
-        },
-        "ExposedHeaders": {
-          "description": "One or more headers in the response that you want customers to be able to access from their applications (for example, from a JavaScript ``XMLHttpRequest`` object).",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "type": "string"
-          }
-        },
-        "Id": {
-          "description": "A unique identifier for this rule. The value must be no more than 255 characters.",
-          "type": "string",
-          "maxLength": 255
-        },
-        "MaxAge": {
-          "description": "The time in seconds that your browser is to cache the preflight response for the specified resource.",
-          "type": "integer",
-          "minimum": 0
+        "S3Key": {
+          "description": "A container for object key name prefix and suffix filtering rules.",
+          "$ref": "#/definitions/S3KeyFilter"
         }
       },
       "required": [
-        "AllowedMethods",
-        "AllowedOrigins"
+        "S3Key"
       ]
     },
-    "IntelligentTieringConfiguration": {
-      "type": "object",
+    "ReplicationConfiguration": {
+      "description": "A container for replication rules. You can add up to 1,000 rules. The maximum size of a replication configuration is 2 MB. The latest version of the replication configuration XML is V2. For more information about XML V2 replication configurations, see [Replication configuration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-add-config.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Id": {
-          "description": "The ID used to identify the S3 Intelligent-Tiering configuration.",
-          "type": "string"
-        },
-        "Prefix": {
-          "description": "An object key name prefix that identifies the subset of objects to which the rule applies.",
+        "Role": {
+          "description": "The Amazon Resource Name (ARN) of the IAMlong (IAM) role that Amazon S3 assumes when replicating objects. For more information, see [How to Set Up Replication](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-how-setup.html) in the *Amazon S3 User Guide*.",
           "type": "string"
         },
-        "Status": {
-          "description": "Specifies the status of the configuration.",
-          "type": "string",
-          "enum": [
-            "Disabled",
-            "Enabled"
-          ]
-        },
-        "TagFilters": {
-          "description": "A container for a key-value pair.",
-          "type": "array",
+        "Rules": {
           "uniqueItems": true,
+          "description": "A container for one or more replication rules. A replication configuration must have at least one rule and can contain a maximum of 1,000 rules.",
           "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/TagFilter"
-          }
-        },
-        "Tierings": {
-          "description": "Specifies a list of S3 Intelligent-Tiering storage class tiers in the configuration. At least one tier must be defined in the list. At most, you can specify two tiers in the list, one for each available AccessTier: ``ARCHIVE_ACCESS`` and ``DEEP_ARCHIVE_ACCESS``.\n  You only need Intelligent Tiering Configuration enabled on a bucket if you want to automatically move objects stored in the Intelligent-Tiering storage class to Archive Access or Deep Archive Access tiers.",
           "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
           "items": {
-            "$ref": "#/definitions/Tiering"
+            "minLength": 1,
+            "$ref": "#/definitions/ReplicationRule",
+            "maxLength": 1000
           }
         }
       },
       "required": [
-        "Id",
-        "Status",
-        "Tierings"
-      ],
-      "description": "Specifies the S3 Intelligent-Tiering configuration for an Amazon S3 bucket.\n For information about the S3 Intelligent-Tiering storage class, see [Storage class for automatically optimizing frequently and infrequently accessed objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html#sc-dynamic-data-access)."
+        "Role",
+        "Rules"
+      ]
     },
-    "Tiering": {
-      "type": "object",
+    "ServerSideEncryptionRule": {
+      "description": "Specifies the default server-side encryption configuration.\n  If you're specifying a customer managed KMS key, we recommend using a fully qualified KMS key ARN. If you use a KMS key alias instead, then KMS resolves the key within the requester’s account. This behavior can result in data that's encrypted with a KMS key that belongs to the requester, and not the bucket owner.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "AccessTier": {
-          "description": "S3 Intelligent-Tiering access tier. See [Storage class for automatically optimizing frequently and infrequently accessed objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html#sc-dynamic-data-access) for a list of access tiers in the S3 Intelligent-Tiering storage class.",
-          "type": "string",
-          "enum": [
-            "ARCHIVE_ACCESS",
-            "DEEP_ARCHIVE_ACCESS"
-          ]
+        "BucketKeyEnabled": {
+          "description": "Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Setting the ``BucketKeyEnabled`` element to ``true`` causes Amazon S3 to use an S3 Bucket Key. By default, S3 Bucket Key is not enabled.\n For more information, see [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) in the *Amazon S3 User Guide*.",
+          "type": "boolean"
         },
-        "Days": {
-          "description": "The number of consecutive days of no access after which an object will be eligible to be transitioned to the corresponding tier. The minimum number of days specified for Archive Access tier must be at least 90 days and Deep Archive Access tier must be at least 180 days. The maximum can be up to 2 years (730 days).",
-          "type": "integer"
+        "ServerSideEncryptionByDefault": {
+          "description": "Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied.",
+          "$ref": "#/definitions/ServerSideEncryptionByDefault"
         }
-      },
-      "required": [
-        "AccessTier",
-        "Days"
-      ],
-      "description": "The S3 Intelligent-Tiering storage class is designed to optimize storage costs by automatically moving data to the most cost-effective storage access tier, without additional operational overhead."
+      }
     },
-    "InventoryConfiguration": {
-      "type": "object",
+    "ReplicationDestination": {
+      "description": "A container for information about the replication destination and its configurations including enabling the S3 Replication Time Control (S3 RTC).",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Destination": {
-          "$ref": "#/definitions/Destination",
-          "description": "Contains information about where to publish the inventory results."
-        },
-        "Enabled": {
-          "description": "Specifies whether the inventory is enabled or disabled. If set to ``True``, an inventory list is generated. If set to ``False``, no inventory list is generated.",
-          "type": "boolean"
+        "AccessControlTranslation": {
+          "description": "Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS-account that owns the destination bucket. If this is not specified in the replication configuration, the replicas are owned by same AWS-account that owns the source object.",
+          "$ref": "#/definitions/AccessControlTranslation"
         },
-        "Id": {
-          "description": "The ID used to identify the inventory configuration.",
+        "Account": {
+          "description": "Destination bucket owner account ID. In a cross-account scenario, if you direct Amazon S3 to change replica ownership to the AWS-account that owns the destination bucket by specifying the ``AccessControlTranslation`` property, this is the account ID of the destination bucket owner. For more information, see [Cross-Region Replication Additional Configuration: Change Replica Owner](https://docs.aws.amazon.com/AmazonS3/latest/dev/crr-change-owner.html) in the *Amazon S3 User Guide*.\n If you specify the ``AccessControlTranslation`` property, the ``Account`` property is required.",
           "type": "string"
         },
-        "IncludedObjectVersions": {
-          "description": "Object versions to include in the inventory list. If set to ``All``, the list includes all the object versions, which adds the version-related fields ``VersionId``, ``IsLatest``, and ``DeleteMarker`` to the list. If set to ``Current``, the list does not contain these version-related fields.",
-          "type": "string",
-          "enum": [
-            "All",
-            "Current"
-          ]
-        },
-        "OptionalFields": {
-          "description": "Contains the optional fields that are included in the inventory results.",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "type": "string",
-            "enum": [
-              "Size",
-              "LastModifiedDate",
-              "StorageClass",
-              "ETag",
-              "IsMultipartUploaded",
-              "ReplicationStatus",
-              "EncryptionStatus",
-              "ObjectLockRetainUntilDate",
-              "ObjectLockMode",
-              "ObjectLockLegalHoldStatus",
-              "IntelligentTieringAccessTier",
-              "BucketKeyStatus",
-              "ChecksumAlgorithm",
-              "ObjectAccessControlList",
-              "ObjectOwner"
-            ]
-          }
+        "Metrics": {
+          "description": "A container specifying replication metrics-related settings enabling replication metrics and events.",
+          "$ref": "#/definitions/Metrics"
         },
-        "Prefix": {
-          "description": "Specifies the inventory filter prefix.",
+        "Bucket": {
+          "description": "The Amazon Resource Name (ARN) of the bucket where you want Amazon S3 to store the results.",
           "type": "string"
         },
-        "ScheduleFrequency": {
-          "description": "Specifies the schedule for generating inventory results.",
+        "EncryptionConfiguration": {
+          "description": "Specifies encryption-related information.",
+          "$ref": "#/definitions/EncryptionConfiguration"
+        },
+        "StorageClass": {
+          "description": "The storage class to use when replicating objects, such as S3 Standard or reduced redundancy. By default, Amazon S3 uses the storage class of the source object to create the object replica. \n For valid values, see the ``StorageClass`` element of the [PUT Bucket replication](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTreplication.html) action in the *Amazon S3 API Reference*.",
           "type": "string",
           "enum": [
-            "Daily",
-            "Weekly"
+            "DEEP_ARCHIVE",
+            "GLACIER",
+            "GLACIER_IR",
+            "INTELLIGENT_TIERING",
+            "ONEZONE_IA",
+            "REDUCED_REDUNDANCY",
+            "STANDARD",
+            "STANDARD_IA"
           ]
+        },
+        "ReplicationTime": {
+          "description": "A container specifying S3 Replication Time Control (S3 RTC), including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated. Must be specified together with a ``Metrics`` block.",
+          "$ref": "#/definitions/ReplicationTime"
         }
       },
       "required": [
-        "Destination",
-        "Enabled",
-        "Id",
-        "IncludedObjectVersions",
-        "ScheduleFrequency"
-      ],
-      "description": "Specifies the inventory configuration for an Amazon S3 bucket. For more information, see [GET Bucket inventory](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETInventoryConfig.html) in the *Amazon S3 API Reference*."
+        "Bucket"
+      ]
     },
-    "LifecycleConfiguration": {
+    "OwnershipControlsRule": {
+      "description": "Specifies an Object Ownership rule.\n S3 Object Ownership is an Amazon S3 bucket-level setting that you can use to disable access control lists (ACLs) and take ownership of every object in your bucket, simplifying access management for data stored in Amazon S3. For more information, see [Controlling ownership of objects and disabling ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) in the *Amazon S3 User Guide*.",
+      "additionalProperties": false,
       "type": "object",
+      "properties": {
+        "ObjectOwnership": {
+          "description": "Specifies an object ownership rule.",
+          "type": "string",
+          "enum": [
+            "ObjectWriter",
+            "BucketOwnerPreferred",
+            "BucketOwnerEnforced"
+          ]
+        }
+      }
+    },
+    "EventBridgeConfiguration": {
+      "description": "Amazon S3 can send events to Amazon EventBridge whenever certain events happen in your bucket, see [Using EventBridge](https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html) in the *Amazon S3 User Guide*.\n Unlike other destinations, delivery of events to EventBridge can be either enabled or disabled for a bucket. If enabled, all events will be sent to EventBridge and you can use EventBridge rules to route events to additional targets. For more information, see [What Is Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-what-is.html) in the *Amazon EventBridge User Guide*",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Rules": {
-          "description": "A lifecycle rule for individual objects in an Amazon S3 bucket.",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/Rule"
-          }
+        "EventBridgeEnabled": {
+          "default": "true",
+          "description": "Enables delivery of events to Amazon EventBridge.",
+          "type": "boolean"
         }
       },
       "required": [
-        "Rules"
-      ],
-      "description": "Specifies the lifecycle configuration for objects in an Amazon S3 bucket. For more information, see [Object Lifecycle Management](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) in the *Amazon S3 User Guide*."
+        "EventBridgeEnabled"
+      ]
     },
-    "Rule": {
-      "type": "object",
-      "description": "Specifies lifecycle rules for an Amazon S3 bucket. For more information, see [Put Bucket Lifecycle Configuration](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTlifecycle.html) in the *Amazon S3 API Reference*.\n You must specify at least one of the following properties: ``AbortIncompleteMultipartUpload``, ``ExpirationDate``, ``ExpirationInDays``, ``NoncurrentVersionExpirationInDays``, ``NoncurrentVersionTransition``, ``NoncurrentVersionTransitions``, ``Transition``, or ``Transitions``.",
+    "CorsRule": {
+      "description": "Specifies a cross-origin access rule for an Amazon S3 bucket.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "AbortIncompleteMultipartUpload": {
-          "$ref": "#/definitions/AbortIncompleteMultipartUpload",
-          "description": "Specifies a lifecycle rule that stops incomplete multipart uploads to an Amazon S3 bucket."
-        },
-        "ExpirationDate": {
-          "$ref": "#/definitions/iso8601UTC",
-          "description": "Indicates when objects are deleted from Amazon S3 and Amazon S3 Glacier. The date value must be in ISO 8601 format. The time is always midnight UTC. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time."
-        },
-        "ExpirationInDays": {
-          "type": "integer",
-          "description": "Indicates the number of days after creation when objects are deleted from Amazon S3 and Amazon S3 Glacier. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time."
-        },
-        "ExpiredObjectDeleteMarker": {
-          "type": "boolean",
-          "description": "Indicates whether Amazon S3 will remove a delete marker without any noncurrent versions. If set to true, the delete marker will be removed if there are no noncurrent versions. This cannot be specified with ``ExpirationInDays``, ``ExpirationDate``, or ``TagFilters``."
-        },
-        "Id": {
-          "type": "string",
-          "maxLength": 255,
-          "description": "Unique identifier for the rule. The value can't be longer than 255 characters."
-        },
-        "NoncurrentVersionExpirationInDays": {
-          "type": "integer",
-          "description": "(Deprecated.) For buckets with versioning enabled (or suspended), specifies the time, in days, between when a new version of the object is uploaded to the bucket and when old versions of the object expire. When object versions expire, Amazon S3 permanently deletes them. If you specify a transition and expiration time, the expiration time must be later than the transition time."
-        },
-        "NoncurrentVersionExpiration": {
-          "$ref": "#/definitions/NoncurrentVersionExpiration",
-          "description": "Specifies when noncurrent object versions expire. Upon expiration, S3 permanently deletes the noncurrent object versions. You set this lifecycle configuration action on a bucket that has versioning enabled (or suspended) to request that S3 delete noncurrent object versions at a specific period in the object's lifetime."
-        },
-        "NoncurrentVersionTransition": {
-          "$ref": "#/definitions/NoncurrentVersionTransition",
-          "description": "(Deprecated.) For buckets with versioning enabled (or suspended), specifies when non-current objects transition to a specified storage class. If you specify a transition and expiration time, the expiration time must be later than the transition time. If you specify this property, don't specify the ``NoncurrentVersionTransitions`` property."
-        },
-        "NoncurrentVersionTransitions": {
-          "type": "array",
+        "ExposedHeaders": {
           "uniqueItems": true,
+          "description": "One or more headers in the response that you want customers to be able to access from their applications (for example, from a JavaScript ``XMLHttpRequest`` object).",
           "insertionOrder": true,
+          "type": "array",
           "items": {
-            "$ref": "#/definitions/NoncurrentVersionTransition"
-          },
-          "description": "For buckets with versioning enabled (or suspended), one or more transition rules that specify when non-current objects transition to a specified storage class. If you specify a transition and expiration time, the expiration time must be later than the transition time. If you specify this property, don't specify the ``NoncurrentVersionTransition`` property."
-        },
-        "Prefix": {
-          "type": "string",
-          "description": "Object key prefix that identifies one or more objects to which this rule applies.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints)."
-        },
-        "Status": {
-          "type": "string",
-          "enum": [
-            "Enabled",
-            "Disabled"
-          ],
-          "description": "If ``Enabled``, the rule is currently being applied. If ``Disabled``, the rule is not currently being applied."
+            "type": "string"
+          }
         },
-        "TagFilters": {
-          "type": "array",
+        "AllowedMethods": {
           "uniqueItems": true,
+          "description": "An HTTP method that you allow the origin to run.\n  *Allowed values*: ``GET`` | ``PUT`` | ``HEAD`` | ``POST`` | ``DELETE``",
           "insertionOrder": true,
+          "type": "array",
           "items": {
-            "$ref": "#/definitions/TagFilter"
-          },
-          "description": "Tags to use to identify a subset of objects to which the lifecycle rule applies."
-        },
-        "ObjectSizeGreaterThan": {
-          "type": "string",
-          "maxLength": 20,
-          "pattern": "[0-9]+",
-          "description": "Specifies the minimum object size in bytes for this rule to apply to. Objects must be larger than this value in bytes. For more information about size based rules, see [Lifecycle configuration using size-based rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lc-size-rules) in the *Amazon S3 User Guide*."
-        },
-        "ObjectSizeLessThan": {
-          "type": "string",
-          "maxLength": 20,
-          "pattern": "[0-9]+",
-          "description": "Specifies the maximum object size in bytes for this rule to apply to. Objects must be smaller than this value in bytes. For more information about sized based rules, see [Lifecycle configuration using size-based rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lc-size-rules) in the *Amazon S3 User Guide*."
-        },
-        "Transition": {
-          "$ref": "#/definitions/Transition",
-          "description": "(Deprecated.) Specifies when an object transitions to a specified storage class. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time. If you specify this property, don't specify the ``Transitions`` property."
+            "type": "string",
+            "enum": [
+              "GET",
+              "PUT",
+              "HEAD",
+              "POST",
+              "DELETE"
+            ]
+          }
         },
-        "Transitions": {
+        "AllowedOrigins": {
+          "uniqueItems": true,
+          "description": "One or more origins you want customers to be able to access the bucket from.",
+          "insertionOrder": true,
           "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "AllowedHeaders": {
           "uniqueItems": true,
+          "description": "Headers that are specified in the ``Access-Control-Request-Headers`` header. These headers are allowed in a preflight OPTIONS request. In response to any preflight OPTIONS request, Amazon S3 returns any requested headers that are allowed.",
           "insertionOrder": true,
+          "type": "array",
           "items": {
-            "$ref": "#/definitions/Transition"
-          },
-          "description": "One or more transition rules that specify when an object transitions to a specified storage class. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time. If you specify this property, don't specify the ``Transition`` property."
+            "type": "string"
+          }
+        },
+        "MaxAge": {
+          "description": "The time in seconds that your browser is to cache the preflight response for the specified resource.",
+          "type": "integer",
+          "minimum": 0
+        },
+        "Id": {
+          "description": "A unique identifier for this rule. The value must be no more than 255 characters.",
+          "type": "string",
+          "maxLength": 255
         }
       },
       "required": [
-        "Status"
+        "AllowedMethods",
+        "AllowedOrigins"
       ]
     },
-    "AbortIncompleteMultipartUpload": {
-      "description": "Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload. For more information, see [Stopping Incomplete Multipart Uploads Using a Bucket Lifecycle Policy](https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config) in the *Amazon S3 User Guide*.",
-      "type": "object",
+    "AccessControlTranslation": {
+      "description": "Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS-account that owns the destination bucket. If this is not specified in the replication configuration, the replicas are owned by same AWS-account that owns the source object.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "DaysAfterInitiation": {
-          "description": "Specifies the number of days after which Amazon S3 stops an incomplete multipart upload.",
-          "type": "integer",
-          "minimum": 0
+        "Owner": {
+          "const": "Destination",
+          "description": "Specifies the replica ownership. For default and valid values, see [PUT bucket replication](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTreplication.html) in the *Amazon S3 API Reference*.",
+          "type": "string"
         }
       },
       "required": [
-        "DaysAfterInitiation"
+        "Owner"
       ]
     },
-    "iso8601UTC": {
-      "description": "The date value in ISO 8601 format. The timezone is always UTC. (YYYY-MM-DDThh:mm:ssZ)",
-      "type": "string",
-      "pattern": "^([0-2]\\d{3})-(0[0-9]|1[0-2])-([0-2]\\d|3[01])T([01]\\d|2[0-4]):([0-5]\\d):([0-6]\\d)((\\.\\d{3})?)Z$"
-    },
-    "NoncurrentVersionExpiration": {
-      "type": "object",
-      "description": "Specifies when noncurrent object versions expire. Upon expiration, S3 permanently deletes the noncurrent object versions. You set this lifecycle configuration action on a bucket that has versioning enabled (or suspended) to request that S3 delete noncurrent object versions at a specific period in the object's lifetime. For more information about setting a lifecycle rule configuration, see [AWS::S3::Bucket Rule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-lifecycleconfig-rule.html).",
+    "ObjectLockRule": {
+      "description": "Specifies the Object Lock rule for the specified object. Enable the this rule when you apply ``ObjectLockConfiguration`` to a bucket.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "NoncurrentDays": {
-          "description": "Specifies the number of days an object is noncurrent before S3 can perform the associated action. For information about the noncurrent days calculations, see [How Amazon S3 Calculates When an Object Became Noncurrent](https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#non-current-days-calculations) in the *Amazon S3 User Guide*.",
-          "type": "integer"
-        },
-        "NewerNoncurrentVersions": {
-          "description": "Specifies how many noncurrent versions S3 will retain. If there are this many more recent noncurrent versions, S3 will take the associated action. For more information about noncurrent versions, see [Lifecycle configuration elements](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html) in the *Amazon S3 User Guide*.",
-          "type": "integer"
+        "DefaultRetention": {
+          "description": "The default Object Lock retention mode and period that you want to apply to new objects placed in the specified bucket. If Object Lock is turned on, bucket settings require both ``Mode`` and a period of either ``Days`` or ``Years``. You cannot specify ``Days`` and ``Years`` at the same time. For more information about allowable values for mode and period, see [DefaultRetention](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-defaultretention.html).",
+          "$ref": "#/definitions/DefaultRetention"
         }
-      },
-      "required": [
-        "NoncurrentDays"
-      ]
+      }
     },
-    "NoncurrentVersionTransition": {
-      "type": "object",
-      "description": "Container for the transition rule that describes when noncurrent objects transition to the ``STANDARD_IA``, ``ONEZONE_IA``, ``INTELLIGENT_TIERING``, ``GLACIER_IR``, ``GLACIER``, or ``DEEP_ARCHIVE`` storage class. If your bucket is versioning-enabled (or versioning is suspended), you can set this action to request that Amazon S3 transition noncurrent object versions to the ``STANDARD_IA``, ``ONEZONE_IA``, ``INTELLIGENT_TIERING``, ``GLACIER_IR``, ``GLACIER``, or ``DEEP_ARCHIVE`` storage class at a specific period in the object's lifetime. If you specify this property, don't specify the ``NoncurrentVersionTransitions`` property.",
+    "Rule": {
+      "description": "Specifies lifecycle rules for an Amazon S3 bucket. For more information, see [Put Bucket Lifecycle Configuration](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTlifecycle.html) in the *Amazon S3 API Reference*.\n You must specify at least one of the following properties: ``AbortIncompleteMultipartUpload``, ``ExpirationDate``, ``ExpirationInDays``, ``NoncurrentVersionExpirationInDays``, ``NoncurrentVersionTransition``, ``NoncurrentVersionTransitions``, ``Transition``, or ``Transitions``.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "StorageClass": {
-          "description": "The class of storage used to store the object.",
+        "Status": {
+          "description": "If ``Enabled``, the rule is currently being applied. If ``Disabled``, the rule is not currently being applied.",
           "type": "string",
           "enum": [
-            "DEEP_ARCHIVE",
-            "GLACIER",
-            "Glacier",
-            "GLACIER_IR",
-            "INTELLIGENT_TIERING",
-            "ONEZONE_IA",
-            "STANDARD_IA"
+            "Enabled",
+            "Disabled"
           ]
         },
-        "TransitionInDays": {
-          "description": "Specifies the number of days an object is noncurrent before Amazon S3 can perform the associated action. For information about the noncurrent days calculations, see [How Amazon S3 Calculates How Long an Object Has Been Noncurrent](https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#non-current-days-calculations) in the *Amazon S3 User Guide*.",
+        "ExpiredObjectDeleteMarker": {
+          "description": "Indicates whether Amazon S3 will remove a delete marker without any noncurrent versions. If set to true, the delete marker will be removed if there are no noncurrent versions. This cannot be specified with ``ExpirationInDays``, ``ExpirationDate``, or ``TagFilters``.",
+          "type": "boolean"
+        },
+        "NoncurrentVersionExpirationInDays": {
+          "description": "(Deprecated.) For buckets with versioning enabled (or suspended), specifies the time, in days, between when a new version of the object is uploaded to the bucket and when old versions of the object expire. When object versions expire, Amazon S3 permanently deletes them. If you specify a transition and expiration time, the expiration time must be later than the transition time.",
           "type": "integer"
         },
-        "NewerNoncurrentVersions": {
-          "description": "Specifies how many noncurrent versions S3 will retain. If there are this many more recent noncurrent versions, S3 will take the associated action. For more information about noncurrent versions, see [Lifecycle configuration elements](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html) in the *Amazon S3 User Guide*.",
+        "Transitions": {
+          "uniqueItems": true,
+          "description": "One or more transition rules that specify when an object transitions to a specified storage class. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time. If you specify this property, don't specify the ``Transition`` property.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Transition"
+          }
+        },
+        "ObjectSizeGreaterThan": {
+          "pattern": "[0-9]+",
+          "description": "Specifies the minimum object size in bytes for this rule to apply to. Objects must be larger than this value in bytes. For more information about size based rules, see [Lifecycle configuration using size-based rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lc-size-rules) in the *Amazon S3 User Guide*.",
+          "type": "string",
+          "maxLength": 20
+        },
+        "TagFilters": {
+          "uniqueItems": true,
+          "description": "Tags to use to identify a subset of objects to which the lifecycle rule applies.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TagFilter"
+          }
+        },
+        "NoncurrentVersionTransitions": {
+          "uniqueItems": true,
+          "description": "For buckets with versioning enabled (or suspended), one or more transition rules that specify when non-current objects transition to a specified storage class. If you specify a transition and expiration time, the expiration time must be later than the transition time. If you specify this property, don't specify the ``NoncurrentVersionTransition`` property.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/NoncurrentVersionTransition"
+          }
+        },
+        "Prefix": {
+          "description": "Object key prefix that identifies one or more objects to which this rule applies.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
+          "type": "string"
+        },
+        "ObjectSizeLessThan": {
+          "pattern": "[0-9]+",
+          "description": "Specifies the maximum object size in bytes for this rule to apply to. Objects must be smaller than this value in bytes. For more information about sized based rules, see [Lifecycle configuration using size-based rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html#lc-size-rules) in the *Amazon S3 User Guide*.",
+          "type": "string",
+          "maxLength": 20
+        },
+        "NoncurrentVersionTransition": {
+          "description": "(Deprecated.) For buckets with versioning enabled (or suspended), specifies when non-current objects transition to a specified storage class. If you specify a transition and expiration time, the expiration time must be later than the transition time. If you specify this property, don't specify the ``NoncurrentVersionTransitions`` property.",
+          "$ref": "#/definitions/NoncurrentVersionTransition"
+        },
+        "ExpirationDate": {
+          "description": "Indicates when objects are deleted from Amazon S3 and Amazon S3 Glacier. The date value must be in ISO 8601 format. The time is always midnight UTC. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time.",
+          "$ref": "#/definitions/iso8601UTC"
+        },
+        "NoncurrentVersionExpiration": {
+          "description": "Specifies when noncurrent object versions expire. Upon expiration, S3 permanently deletes the noncurrent object versions. You set this lifecycle configuration action on a bucket that has versioning enabled (or suspended) to request that S3 delete noncurrent object versions at a specific period in the object's lifetime.",
+          "$ref": "#/definitions/NoncurrentVersionExpiration"
+        },
+        "ExpirationInDays": {
+          "description": "Indicates the number of days after creation when objects are deleted from Amazon S3 and Amazon S3 Glacier. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time.",
           "type": "integer"
+        },
+        "Transition": {
+          "description": "(Deprecated.) Specifies when an object transitions to a specified storage class. If you specify an expiration and transition time, you must use the same time unit for both properties (either in days or by date). The expiration time must also be later than the transition time. If you specify this property, don't specify the ``Transitions`` property.",
+          "$ref": "#/definitions/Transition"
+        },
+        "Id": {
+          "description": "Unique identifier for the rule. The value can't be longer than 255 characters.",
+          "type": "string",
+          "maxLength": 255
+        },
+        "AbortIncompleteMultipartUpload": {
+          "description": "Specifies a lifecycle rule that stops incomplete multipart uploads to an Amazon S3 bucket.",
+          "$ref": "#/definitions/AbortIncompleteMultipartUpload"
         }
       },
       "required": [
-        "StorageClass",
-        "TransitionInDays"
+        "Status"
       ]
     },
-    "Transition": {
+    "Arn": {
+      "description": "the Amazon Resource Name (ARN) of the specified bucket.",
+      "type": "string"
+    },
+    "S3KeyFilter": {
+      "description": "A container for object key name prefix and suffix filtering rules. For more information about object key name filtering, see [Configuring event notifications using object key name filtering](https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html) in the *Amazon S3 User Guide*.\n  The same type of filter rule cannot be used more than once. For example, you cannot specify two prefix rules.",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "StorageClass": {
-          "type": "string",
-          "enum": [
-            "DEEP_ARCHIVE",
-            "GLACIER",
-            "Glacier",
-            "GLACIER_IR",
-            "INTELLIGENT_TIERING",
-            "ONEZONE_IA",
-            "STANDARD_IA"
-          ],
-          "description": "The storage class to which you want the object to transition."
-        },
-        "TransitionDate": {
-          "$ref": "#/definitions/iso8601UTC",
-          "description": "Indicates when objects are transitioned to the specified storage class. The date value must be in ISO 8601 format. The time is always midnight UTC."
-        },
-        "TransitionInDays": {
-          "type": "integer",
-          "description": "Indicates the number of days after creation when objects are transitioned to the specified storage class. The value must be a positive integer."
+        "Rules": {
+          "uniqueItems": true,
+          "description": "A list of containers for the key-value pair that defines the criteria for the filter rule.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FilterRule"
+          }
         }
       },
-      "additionalProperties": false,
-      "description": "Specifies when an object transitions to a specified storage class. For more information about Amazon S3 lifecycle configuration rules, see [Transitioning Objects Using Amazon S3 Lifecycle](https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-transition-general-considerations.html) in the *Amazon S3 User Guide*.",
       "required": [
-        "StorageClass"
+        "Rules"
       ]
     },
-    "LoggingConfiguration": {
+    "iso8601UTC": {
+      "pattern": "^([0-2]\\d{3})-(0[0-9]|1[0-2])-([0-2]\\d|3[01])T([01]\\d|2[0-4]):([0-5]\\d):([0-6]\\d)((\\.\\d{3})?)Z$",
+      "description": "The date value in ISO 8601 format. The timezone is always UTC. (YYYY-MM-DDThh:mm:ssZ)",
+      "type": "string"
+    },
+    "AnalyticsConfiguration": {
+      "description": "Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "DestinationBucketName": {
-          "type": "string",
-          "description": "The name of the bucket where Amazon S3 should store server access log files. You can store log files in any bucket that you own. By default, logs are stored in the bucket where the ``LoggingConfiguration`` property is defined."
+        "StorageClassAnalysis": {
+          "description": "Contains data related to access patterns to be collected and made available to analyze the tradeoffs between different storage classes.",
+          "$ref": "#/definitions/StorageClassAnalysis"
         },
-        "LogFilePrefix": {
-          "type": "string",
-          "description": "A prefix for all log object keys. If you store log files from multiple Amazon S3 buckets in a single bucket, you can use a prefix to distinguish which log files came from which bucket."
+        "TagFilters": {
+          "uniqueItems": true,
+          "description": "The tags to use when evaluating an analytics filter.\n The analytics only includes objects that meet the filter's criteria. If no filter is specified, all of the contents of the bucket are included in the analysis.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TagFilter"
+          }
         },
-        "TargetObjectKeyFormat": {
-          "$ref": "#/definitions/TargetObjectKeyFormat",
-          "description": "Amazon S3 key format for log objects. Only one format, either PartitionedPrefix or SimplePrefix, is allowed."
+        "Id": {
+          "description": "The ID that identifies the analytics configuration.",
+          "type": "string"
+        },
+        "Prefix": {
+          "description": "The prefix that an object must have to be included in the analytics results.",
+          "type": "string"
         }
       },
-      "additionalProperties": false,
-      "description": "Describes where logs are stored and the prefix that Amazon S3 assigns to all log object keys for a bucket. For examples and more information, see [PUT Bucket logging](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTlogging.html) in the *Amazon S3 API Reference*.\n  To successfully complete the ``AWS::S3::Bucket LoggingConfiguration`` request, you must have ``s3:PutObject`` and ``s3:PutObjectAcl`` in your IAM permissions."
+      "required": [
+        "StorageClassAnalysis",
+        "Id"
+      ]
     },
-    "TargetObjectKeyFormat": {
+    "Destination": {
+      "description": "Specifies information about where to publish analysis or configuration results for an Amazon S3 bucket.",
+      "additionalProperties": false,
       "type": "object",
-      "description": "Describes the key format for server access log file in the target bucket. You can choose between SimplePrefix and PartitionedPrefix.",
-      "oneOf": [
-        {
-          "additionalProperties": false,
-          "properties": {
-            "SimplePrefix": {
-              "description": "This format defaults the prefix to the given log file prefix for delivering server access log file.",
-              "type": "object",
-              "additionalProperties": false
-            }
-          },
-          "required": [
-            "SimplePrefix"
-          ]
+      "properties": {
+        "BucketArn": {
+          "description": "The Amazon Resource Name (ARN) of the bucket to which data is exported.",
+          "type": "string"
         },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "PartitionedPrefix": {
-              "$ref": "#/definitions/PartitionedPrefix"
-            }
-          },
-          "required": [
-            "PartitionedPrefix"
+        "Format": {
+          "description": "Specifies the file format used when exporting data to Amazon S3.\n  *Allowed values*: ``CSV`` | ``ORC`` | ``Parquet``",
+          "type": "string",
+          "enum": [
+            "CSV",
+            "ORC",
+            "Parquet"
           ]
+        },
+        "BucketAccountId": {
+          "description": "The account ID that owns the destination S3 bucket. If no account ID is provided, the owner is not validated before exporting data.\n   Although this value is optional, we strongly recommend that you set it to help prevent problems if the destination bucket ownership changes.",
+          "type": "string"
+        },
+        "Prefix": {
+          "description": "The prefix to use when exporting data. The prefix is prepended to all results.",
+          "type": "string"
         }
+      },
+      "required": [
+        "BucketArn",
+        "Format"
       ]
     },
     "PartitionedPrefix": {
-      "type": "object",
       "description": "Amazon S3 keys for log objects are partitioned in the following format:\n  ``[DestinationPrefix][SourceAccountId]/[SourceRegion]/[SourceBucket]/[YYYY]/[MM]/[DD]/[YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]`` \n PartitionedPrefix defaults to EventTime delivery when server access logs are delivered.",
+      "additionalProperties": false,
+      "type": "object",
       "properties": {
         "PartitionDateSource": {
+          "description": "Specifies the partition date source for the partitioned prefix. ``PartitionDateSource`` can be ``EventTime`` or ``DeliveryTime``.\n For ``DeliveryTime``, the time in the log file names corresponds to the delivery time for the log files. \n  For ``EventTime``, The logs delivered are for a specific day only. The year, month, and day correspond to the day on which the event occurred, and the hour, minutes and seconds are set to 00 in the key.",
           "type": "string",
-          "description": "Specifies the partition date source for the partitioned prefix. PartitionDateSource can be EventTime or DeliveryTime.",
           "enum": [
             "EventTime",
             "DeliveryTime"
           ]
         }
-      },
-      "additionalProperties": false
+      }
     },
-    "MetricsConfiguration": {
-      "type": "object",
+    "RedirectAllRequestsTo": {
+      "description": "Specifies the redirect behavior of all requests to a website endpoint of an Amazon S3 bucket.",
       "additionalProperties": false,
-      "properties": {
-        "AccessPointArn": {
-          "type": "string",
-          "description": "The access point that was used while performing operations on the object. The metrics configuration only includes objects that meet the filter's criteria."
-        },
-        "Id": {
-          "type": "string",
-          "description": "The ID used to identify the metrics configuration. This can be any value you choose that helps you identify your metrics configuration."
-        },
-        "Prefix": {
-          "type": "string",
-          "description": "The prefix that an object must have to be included in the metrics results."
-        },
-        "TagFilters": {
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/TagFilter"
-          },
-          "description": "Specifies a list of tag filters to use as a metrics configuration filter. The metrics configuration includes only objects that meet the filter's criteria."
-        }
-      },
-      "required": [
-        "Id"
-      ],
-      "description": "Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased. For examples, see [AWS::S3::Bucket](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html#aws-properties-s3-bucket--examples). For more information, see [PUT Bucket metrics](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTMetricConfiguration.html) in the *Amazon S3 API Reference*."
-    },
-    "NotificationConfiguration": {
-      "description": "Describes the notification configuration for an Amazon S3 bucket.\n  If you create the target resource and related permissions in the same template, you might have a circular dependency.\n For example, you might use the ``AWS::Lambda::Permission`` resource to grant the bucket permission to invoke an AWS Lambda function. However, AWS CloudFormation can't create the bucket until the bucket has permission to invoke the function (AWS CloudFormation checks whether the bucket can invoke the function). If you're using Refs to pass the bucket name, this leads to a circular dependency.\n To avoid this dependency, you can create all resources without specifying the notification configuration. Then, update the stack with a notification configuration.\n For more information on permissions, see [AWS::Lambda::Permission](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html) and [Granting Permissions to Publish Event Notification Messages to a Destination](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#grant-destinations-permissions-to-s3).",
       "type": "object",
-      "additionalProperties": false,
       "properties": {
-        "EventBridgeConfiguration": {
-          "$ref": "#/definitions/EventBridgeConfiguration",
-          "description": "Enables delivery of events to Amazon EventBridge."
-        },
-        "LambdaConfigurations": {
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/LambdaConfiguration"
-          },
-          "description": "Describes the LAMlong functions to invoke and the events for which to invoke them."
-        },
-        "QueueConfigurations": {
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/QueueConfiguration"
-          },
-          "description": "The Amazon Simple Queue Service queues to publish messages to and the events for which to publish messages."
+        "Protocol": {
+          "description": "Protocol to use when redirecting requests. The default is the protocol that is used in the original request.",
+          "type": "string",
+          "enum": [
+            "http",
+            "https"
+          ]
         },
-        "TopicConfigurations": {
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/TopicConfiguration"
-          },
-          "description": "The topic to which notifications are sent and the events for which notifications are generated."
-        }
-      }
-    },
-    "EventBridgeConfiguration": {
-      "type": "object",
-      "description": "Amazon S3 can send events to Amazon EventBridge whenever certain events happen in your bucket, see [Using EventBridge](https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html) in the *Amazon S3 User Guide*.\n Unlike other destinations, delivery of events to EventBridge can be either enabled or disabled for a bucket. If enabled, all events will be sent to EventBridge and you can use EventBridge rules to route events to additional targets. For more information, see [What Is Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-what-is.html) in the *Amazon EventBridge User Guide*",
-      "additionalProperties": false,
-      "properties": {
-        "EventBridgeEnabled": {
-          "description": "Enables delivery of events to Amazon EventBridge.",
-          "type": "boolean",
-          "default": "true"
+        "HostName": {
+          "description": "Name of the host where requests are redirected.",
+          "type": "string"
         }
       },
       "required": [
-        "EventBridgeEnabled"
+        "HostName"
       ]
     },
-    "LambdaConfiguration": {
-      "type": "object",
-      "description": "Describes the LAMlong functions to invoke and the events for which to invoke them.",
+    "TagFilter": {
+      "description": "Specifies tags to use to identify a subset of objects for an Amazon S3 bucket.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Event": {
-          "description": "The Amazon S3 bucket event for which to invoke the LAMlong function. For more information, see [Supported Event Types](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
+        "Value": {
+          "description": "The tag value.",
           "type": "string"
         },
-        "Filter": {
-          "description": "The filtering rules that determine which objects invoke the AWS Lambda function. For example, you can create a filter so that only image files with a ``.jpg`` extension invoke the function when they are added to the Amazon S3 bucket.",
-          "$ref": "#/definitions/NotificationFilter"
-        },
-        "Function": {
-          "description": "The Amazon Resource Name (ARN) of the LAMlong function that Amazon S3 invokes when the specified event type occurs.",
+        "Key": {
+          "description": "The tag key.",
           "type": "string"
         }
       },
       "required": [
-        "Function",
-        "Event"
+        "Value",
+        "Key"
       ]
     },
-    "QueueConfiguration": {
-      "type": "object",
-      "description": "Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.",
+    "WebsiteConfiguration": {
+      "description": "Specifies website configuration parameters for an Amazon S3 bucket.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Event": {
-          "description": "The Amazon S3 bucket event about which you want to publish messages to Amazon SQS. For more information, see [Supported Event Types](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
+        "IndexDocument": {
+          "description": "The name of the index document for the website.",
           "type": "string"
         },
-        "Filter": {
-          "description": "The filtering rules that determine which objects trigger notifications. For example, you can create a filter so that Amazon S3 sends notifications only when image files with a ``.jpg`` extension are added to the bucket. For more information, see [Configuring event notifications using object key name filtering](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/notification-how-to-filtering.html) in the *Amazon S3 User Guide*.",
-          "$ref": "#/definitions/NotificationFilter"
+        "RedirectAllRequestsTo": {
+          "description": "The redirect behavior for every request to this bucket's website endpoint.\n  If you specify this property, you can't specify any other property.",
+          "$ref": "#/definitions/RedirectAllRequestsTo"
         },
-        "Queue": {
-          "description": "The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type. FIFO queues are not allowed when enabling an SQS queue as the event notification destination.",
+        "RoutingRules": {
+          "description": "Rules that define when a redirect is applied and the redirect behavior.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/RoutingRule"
+          }
+        },
+        "ErrorDocument": {
+          "description": "The name of the error document for the website.",
           "type": "string"
         }
-      },
-      "required": [
-        "Event",
-        "Queue"
-      ]
+      }
     },
     "TopicConfiguration": {
-      "type": "object",
       "description": "A container for specifying the configuration for publication of messages to an Amazon Simple Notification Service (Amazon SNS) topic when Amazon S3 detects specified events.",
       "additionalProperties": false,
-      "properties": {
-        "Event": {
-          "description": "The Amazon S3 bucket event about which to send notifications. For more information, see [Supported Event Types](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
-          "type": "string"
-        },
+      "type": "object",
+      "properties": {
         "Filter": {
           "description": "The filtering rules that determine for which objects to send notifications. For example, you can create a filter so that Amazon S3 sends notifications only when image files with a ``.jpg`` extension are added to the bucket.",
           "$ref": "#/definitions/NotificationFilter"
         },
+        "Event": {
+          "description": "The Amazon S3 bucket event about which to send notifications. For more information, see [Supported Event Types](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
+          "type": "string"
+        },
         "Topic": {
           "description": "The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon S3 publishes a message when it detects events of the specified type.",
           "type": "string"
@@ -1025,324 +912,350 @@
         "Topic"
       ]
     },
-    "NotificationFilter": {
-      "type": "object",
-      "description": "Specifies object key name filtering rules. For information about key name filtering, see [Configuring event notifications using object key name filtering](https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html) in the *Amazon S3 User Guide*.",
+    "IntelligentTieringConfiguration": {
+      "description": "Specifies the S3 Intelligent-Tiering configuration for an Amazon S3 bucket.\n For information about the S3 Intelligent-Tiering storage class, see [Storage class for automatically optimizing frequently and infrequently accessed objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html#sc-dynamic-data-access).",
       "additionalProperties": false,
-      "properties": {
-        "S3Key": {
-          "$ref": "#/definitions/S3KeyFilter",
-          "description": "A container for object key name prefix and suffix filtering rules."
-        }
-      },
-      "required": [
-        "S3Key"
-      ]
-    },
-    "S3KeyFilter": {
       "type": "object",
-      "description": "A container for object key name prefix and suffix filtering rules. For more information about object key name filtering, see [Configuring event notifications using object key name filtering](https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html) in the *Amazon S3 User Guide*.\n  The same type of filter rule cannot be used more than once. For example, you cannot specify two prefix rules.",
-      "additionalProperties": false,
       "properties": {
-        "Rules": {
+        "Status": {
+          "description": "Specifies the status of the configuration.",
+          "type": "string",
+          "enum": [
+            "Disabled",
+            "Enabled"
+          ]
+        },
+        "Tierings": {
+          "uniqueItems": true,
+          "description": "Specifies a list of S3 Intelligent-Tiering storage class tiers in the configuration. At least one tier must be defined in the list. At most, you can specify two tiers in the list, one for each available AccessTier: ``ARCHIVE_ACCESS`` and ``DEEP_ARCHIVE_ACCESS``.\n  You only need Intelligent Tiering Configuration enabled on a bucket if you want to automatically move objects stored in the Intelligent-Tiering storage class to Archive Access or Deep Archive Access tiers.",
+          "insertionOrder": true,
           "type": "array",
+          "items": {
+            "$ref": "#/definitions/Tiering"
+          }
+        },
+        "TagFilters": {
           "uniqueItems": true,
-          "insertionOrder": false,
+          "description": "A container for a key-value pair.",
+          "insertionOrder": true,
+          "type": "array",
           "items": {
-            "$ref": "#/definitions/FilterRule"
-          },
-          "description": "A list of containers for the key-value pair that defines the criteria for the filter rule."
+            "$ref": "#/definitions/TagFilter"
+          }
+        },
+        "Id": {
+          "description": "The ID used to identify the S3 Intelligent-Tiering configuration.",
+          "type": "string"
+        },
+        "Prefix": {
+          "description": "An object key name prefix that identifies the subset of objects to which the rule applies.",
+          "type": "string"
         }
       },
       "required": [
-        "Rules"
+        "Id",
+        "Status",
+        "Tierings"
       ]
     },
-    "FilterRule": {
-      "type": "object",
-      "description": "Specifies the Amazon S3 object key name to filter on. An object key name is the name assigned to an object in your Amazon S3 bucket. You specify whether to filter on the suffix or prefix of the object key name. A prefix is a specific string of characters at the beginning of an object key name, which you can use to organize objects. For example, you can start the key names of related objects with a prefix, such as ``2023-`` or ``engineering/``. Then, you can use ``FilterRule`` to find objects in a bucket with key names that have the same prefix. A suffix is similar to a prefix, but it is at the end of the object key name instead of at the beginning.",
+    "PublicAccessBlockConfiguration": {
+      "description": "The PublicAccessBlock configuration that you want to apply to this Amazon S3 bucket. You can enable the configuration options in any combination. For more information about when Amazon S3 considers a bucket or object public, see [The Meaning of \"Public\"](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Name": {
-          "type": "string",
-          "maxLength": 1024,
-          "description": "The object key name prefix or suffix identifying one or more objects to which the filtering rule applies. The maximum length is 1,024 characters. Overlapping prefixes and suffixes are not supported. For more information, see [Configuring Event Notifications](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*."
+        "RestrictPublicBuckets": {
+          "description": "Specifies whether Amazon S3 should restrict public bucket policies for this bucket. Setting this element to ``TRUE`` restricts access to this bucket to only AWS-service principals and authorized users within this account if the bucket has a public policy.\n Enabling this setting doesn't affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.",
+          "type": "boolean"
         },
-        "Value": {
-          "type": "string",
-          "description": "The value that the filter searches for in object key names."
+        "BlockPublicPolicy": {
+          "description": "Specifies whether Amazon S3 should block public bucket policies for this bucket. Setting this element to ``TRUE`` causes Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access. \n Enabling this setting doesn't affect existing bucket policies.",
+          "type": "boolean"
+        },
+        "BlockPublicAcls": {
+          "description": "Specifies whether Amazon S3 should block public access control lists (ACLs) for this bucket and objects in this bucket. Setting this element to ``TRUE`` causes the following behavior:\n  +  PUT Bucket ACL and PUT Object ACL calls fail if the specified ACL is public.\n  +  PUT Object calls fail if the request includes a public ACL.\n  +  PUT Bucket calls fail if the request includes a public ACL.\n  \n Enabling this setting doesn't affect existing policies or ACLs.",
+          "type": "boolean"
+        },
+        "IgnorePublicAcls": {
+          "description": "Specifies whether Amazon S3 should ignore public ACLs for this bucket and objects in this bucket. Setting this element to ``TRUE`` causes Amazon S3 to ignore all public ACLs on this bucket and objects in this bucket.\n Enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set.",
+          "type": "boolean"
         }
-      },
-      "required": [
-        "Value",
-        "Name"
-      ]
+      }
     },
-    "ObjectLockConfiguration": {
-      "type": "object",
+    "NoncurrentVersionTransition": {
+      "description": "Container for the transition rule that describes when noncurrent objects transition to the ``STANDARD_IA``, ``ONEZONE_IA``, ``INTELLIGENT_TIERING``, ``GLACIER_IR``, ``GLACIER``, or ``DEEP_ARCHIVE`` storage class. If your bucket is versioning-enabled (or versioning is suspended), you can set this action to request that Amazon S3 transition noncurrent object versions to the ``STANDARD_IA``, ``ONEZONE_IA``, ``INTELLIGENT_TIERING``, ``GLACIER_IR``, ``GLACIER``, or ``DEEP_ARCHIVE`` storage class at a specific period in the object's lifetime. If you specify this property, don't specify the ``NoncurrentVersionTransitions`` property.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "ObjectLockEnabled": {
+        "StorageClass": {
+          "description": "The class of storage used to store the object.",
           "type": "string",
-          "const": "Enabled",
-          "description": "Indicates whether this bucket has an Object Lock configuration enabled. Enable ``ObjectLockEnabled`` when you apply ``ObjectLockConfiguration`` to a bucket."
+          "enum": [
+            "DEEP_ARCHIVE",
+            "GLACIER",
+            "Glacier",
+            "GLACIER_IR",
+            "INTELLIGENT_TIERING",
+            "ONEZONE_IA",
+            "STANDARD_IA"
+          ]
         },
-        "Rule": {
-          "$ref": "#/definitions/ObjectLockRule",
-          "description": "Specifies the Object Lock rule for the specified object. Enable this rule when you apply ``ObjectLockConfiguration`` to a bucket. If Object Lock is turned on, bucket settings require both ``Mode`` and a period of either ``Days`` or ``Years``. You cannot specify ``Days`` and ``Years`` at the same time. For more information, see [ObjectLockRule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-objectlockrule.html) and [DefaultRetention](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-defaultretention.html)."
+        "TransitionInDays": {
+          "description": "Specifies the number of days an object is noncurrent before Amazon S3 can perform the associated action. For information about the noncurrent days calculations, see [How Amazon S3 Calculates How Long an Object Has Been Noncurrent](https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#non-current-days-calculations) in the *Amazon S3 User Guide*.",
+          "type": "integer"
+        },
+        "NewerNoncurrentVersions": {
+          "description": "Specifies how many noncurrent versions S3 will retain. If there are this many more recent noncurrent versions, S3 will take the associated action. For more information about noncurrent versions, see [Lifecycle configuration elements](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html) in the *Amazon S3 User Guide*.",
+          "type": "integer"
         }
       },
-      "description": "Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see [Locking Objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html)."
+      "required": [
+        "StorageClass",
+        "TransitionInDays"
+      ]
     },
-    "ObjectLockRule": {
-      "type": "object",
-      "description": "Specifies the Object Lock rule for the specified object. Enable the this rule when you apply ``ObjectLockConfiguration`` to a bucket.",
+    "StorageClassAnalysis": {
+      "description": "Specifies data related to access patterns to be collected and made available to analyze the tradeoffs between different storage classes for an Amazon S3 bucket.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "DefaultRetention": {
-          "$ref": "#/definitions/DefaultRetention",
-          "description": "The default Object Lock retention mode and period that you want to apply to new objects placed in the specified bucket. If Object Lock is turned on, bucket settings require both ``Mode`` and a period of either ``Days`` or ``Years``. You cannot specify ``Days`` and ``Years`` at the same time. For more information about allowable values for mode and period, see [DefaultRetention](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-defaultretention.html)."
+        "DataExport": {
+          "description": "Specifies how data related to the storage class analysis for an Amazon S3 bucket should be exported.",
+          "$ref": "#/definitions/DataExport"
         }
       }
     },
-    "DefaultRetention": {
-      "type": "object",
-      "description": "The container element for optionally specifying the default Object Lock retention settings for new objects placed in the specified bucket.\n   +  The ``DefaultRetention`` settings require both a mode and a period.\n  +  The ``DefaultRetention`` period can be either ``Days`` or ``Years`` but you must select one. You cannot specify ``Days`` and ``Years`` at the same time.",
+    "ServerSideEncryptionByDefault": {
+      "description": "Describes the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied. If you don't specify a customer managed key at configuration, Amazon S3 automatically creates an AWS KMS key in your AWS account the first time that you add an object encrypted with SSE-KMS to a bucket. By default, Amazon S3 uses this KMS key for SSE-KMS. For more information, see [PUT Bucket encryption](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTencryption.html) in the *Amazon S3 API Reference*.\n  If you're specifying a customer managed KMS key, we recommend using a fully qualified KMS key ARN. If you use a KMS key alias instead, then KMS resolves the key within the requester’s account. This behavior can result in data that's encrypted with a KMS key that belongs to the requester, and not the bucket owner.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Years": {
-          "type": "integer",
-          "description": "The number of years that you want to specify for the default retention period. If Object Lock is turned on, you must specify ``Mode`` and specify either ``Days`` or ``Years``."
-        },
-        "Days": {
-          "type": "integer",
-          "description": "The number of days that you want to specify for the default retention period. If Object Lock is turned on, you must specify ``Mode`` and specify either ``Days`` or ``Years``."
-        },
-        "Mode": {
+        "SSEAlgorithm": {
+          "description": "Server-side encryption algorithm to use for the default encryption.",
           "type": "string",
           "enum": [
-            "COMPLIANCE",
-            "GOVERNANCE"
-          ],
-          "description": "The default Object Lock retention mode you want to apply to new objects placed in the specified bucket. If Object Lock is turned on, you must specify ``Mode`` and specify either ``Days`` or ``Years``."
+            "aws:kms",
+            "AES256",
+            "aws:kms:dsse"
+          ]
+        },
+        "KMSMasterKeyID": {
+          "description": "AWS Key Management Service (KMS) customer AWS KMS key ID to use for the default encryption. This parameter is allowed if and only if ``SSEAlgorithm`` is set to ``aws:kms`` or ``aws:kms:dsse``.\n You can specify the key ID, key alias, or the Amazon Resource Name (ARN) of the KMS key.\n  +  Key ID: ``1234abcd-12ab-34cd-56ef-1234567890ab`` \n  +  Key ARN: ``arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`` \n  +  Key Alias: ``alias/alias-name`` \n  \n If you use a key ID, you can run into a LogDestination undeliverable error when creating a VPC flow log. \n If you are using encryption with cross-account or AWS service operations you must use a fully qualified KMS key ARN. For more information, see [Using encryption for cross-account operations](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-update-bucket-policy).\n  Amazon S3 only supports symmetric encryption KMS keys. For more information, see [Asymmetric keys in KMS](https://docs.aws.amazon.com//kms/latest/developerguide/symmetric-asymmetric.html) in the *Key Management Service Developer Guide*.",
+          "type": "string"
         }
-      }
+      },
+      "required": [
+        "SSEAlgorithm"
+      ]
     },
-    "OwnershipControls": {
-      "type": "object",
+    "MetricsConfiguration": {
+      "description": "Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased. For examples, see [AWS::S3::Bucket](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html#aws-properties-s3-bucket--examples). For more information, see [PUT Bucket metrics](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTMetricConfiguration.html) in the *Amazon S3 API Reference*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Rules": {
-          "type": "array",
+        "AccessPointArn": {
+          "description": "The access point that was used while performing operations on the object. The metrics configuration only includes objects that meet the filter's criteria.",
+          "type": "string"
+        },
+        "TagFilters": {
           "uniqueItems": true,
+          "description": "Specifies a list of tag filters to use as a metrics configuration filter. The metrics configuration includes only objects that meet the filter's criteria.",
           "insertionOrder": true,
+          "type": "array",
           "items": {
-            "$ref": "#/definitions/OwnershipControlsRule"
-          },
-          "description": "Specifies the container element for Object Ownership rules."
+            "$ref": "#/definitions/TagFilter"
+          }
+        },
+        "Id": {
+          "description": "The ID used to identify the metrics configuration. This can be any value you choose that helps you identify your metrics configuration.",
+          "type": "string"
+        },
+        "Prefix": {
+          "description": "The prefix that an object must have to be included in the metrics results.",
+          "type": "string"
         }
       },
       "required": [
-        "Rules"
-      ],
-      "description": "Specifies the container element for Object Ownership rules.\n S3 Object Ownership is an Amazon S3 bucket-level setting that you can use to disable access control lists (ACLs) and take ownership of every object in your bucket, simplifying access management for data stored in Amazon S3. For more information, see [Controlling ownership of objects and disabling ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) in the *Amazon S3 User Guide*."
+        "Id"
+      ]
     },
-    "OwnershipControlsRule": {
-      "type": "object",
+    "ObjectLockConfiguration": {
+      "description": "Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see [Locking Objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html).",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "ObjectOwnership": {
-          "description": "Specifies an object ownership rule.",
-          "type": "string",
-          "enum": [
-            "ObjectWriter",
-            "BucketOwnerPreferred",
-            "BucketOwnerEnforced"
-          ]
+        "ObjectLockEnabled": {
+          "const": "Enabled",
+          "description": "Indicates whether this bucket has an Object Lock configuration enabled. Enable ``ObjectLockEnabled`` when you apply ``ObjectLockConfiguration`` to a bucket.",
+          "type": "string"
+        },
+        "Rule": {
+          "description": "Specifies the Object Lock rule for the specified object. Enable this rule when you apply ``ObjectLockConfiguration`` to a bucket. If Object Lock is turned on, bucket settings require both ``Mode`` and a period of either ``Days`` or ``Years``. You cannot specify ``Days`` and ``Years`` at the same time. For more information, see [ObjectLockRule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-objectlockrule.html) and [DefaultRetention](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-defaultretention.html).",
+          "$ref": "#/definitions/ObjectLockRule"
         }
-      },
-      "description": "Specifies an Object Ownership rule.\n S3 Object Ownership is an Amazon S3 bucket-level setting that you can use to disable access control lists (ACLs) and take ownership of every object in your bucket, simplifying access management for data stored in Amazon S3. For more information, see [Controlling ownership of objects and disabling ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) in the *Amazon S3 User Guide*."
+      }
     },
-    "PublicAccessBlockConfiguration": {
-      "description": "The PublicAccessBlock configuration that you want to apply to this Amazon S3 bucket. You can enable the configuration options in any combination. For more information about when Amazon S3 considers a bucket or object public, see [The Meaning of \"Public\"](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status) in the *Amazon S3 User Guide*.",
-      "type": "object",
+    "LoggingConfiguration": {
+      "description": "Describes where logs are stored and the prefix that Amazon S3 assigns to all log object keys for a bucket. For examples and more information, see [PUT Bucket logging](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTlogging.html) in the *Amazon S3 API Reference*.\n  To successfully complete the ``AWS::S3::Bucket LoggingConfiguration`` request, you must have ``s3:PutObject`` and ``s3:PutObjectAcl`` in your IAM permissions.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "BlockPublicAcls": {
-          "type": "boolean",
-          "description": "Specifies whether Amazon S3 should block public access control lists (ACLs) for this bucket and objects in this bucket. Setting this element to ``TRUE`` causes the following behavior:\n  +  PUT Bucket ACL and PUT Object ACL calls fail if the specified ACL is public.\n  +  PUT Object calls fail if the request includes a public ACL.\n  +  PUT Bucket calls fail if the request includes a public ACL.\n  \n Enabling this setting doesn't affect existing policies or ACLs."
-        },
-        "BlockPublicPolicy": {
-          "type": "boolean",
-          "description": "Specifies whether Amazon S3 should block public bucket policies for this bucket. Setting this element to ``TRUE`` causes Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access. \n Enabling this setting doesn't affect existing bucket policies."
+        "TargetObjectKeyFormat": {
+          "description": "Amazon S3 key format for log objects. Only one format, either PartitionedPrefix or SimplePrefix, is allowed.",
+          "$ref": "#/definitions/TargetObjectKeyFormat"
         },
-        "IgnorePublicAcls": {
-          "type": "boolean",
-          "description": "Specifies whether Amazon S3 should ignore public ACLs for this bucket and objects in this bucket. Setting this element to ``TRUE`` causes Amazon S3 to ignore all public ACLs on this bucket and objects in this bucket.\n Enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set."
+        "LogFilePrefix": {
+          "description": "A prefix for all log object keys. If you store log files from multiple Amazon S3 buckets in a single bucket, you can use a prefix to distinguish which log files came from which bucket.",
+          "type": "string"
         },
-        "RestrictPublicBuckets": {
-          "type": "boolean",
-          "description": "Specifies whether Amazon S3 should restrict public bucket policies for this bucket. Setting this element to ``TRUE`` restricts access to this bucket to only AWS-service principals and authorized users within this account if the bucket has a public policy.\n Enabling this setting doesn't affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked."
+        "DestinationBucketName": {
+          "description": "The name of the bucket where Amazon S3 should store server access log files. You can store log files in any bucket that you own. By default, logs are stored in the bucket where the ``LoggingConfiguration`` property is defined.",
+          "type": "string"
         }
       }
     },
-    "ReplicationConfiguration": {
-      "type": "object",
-      "description": "A container for replication rules. You can add up to 1,000 rules. The maximum size of a replication configuration is 2 MB. The latest version of the replication configuration XML is V2. For more information about XML V2 replication configurations, see [Replication configuration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-add-config.html) in the *Amazon S3 User Guide*.",
+    "LambdaConfiguration": {
+      "description": "Describes the LAMlong functions to invoke and the events for which to invoke them.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Role": {
-          "description": "The Amazon Resource Name (ARN) of the IAMlong (IAM) role that Amazon S3 assumes when replicating objects. For more information, see [How to Set Up Replication](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-how-setup.html) in the *Amazon S3 User Guide*.",
+        "Function": {
+          "description": "The Amazon Resource Name (ARN) of the LAMlong function that Amazon S3 invokes when the specified event type occurs.",
           "type": "string"
         },
-        "Rules": {
-          "description": "A container for one or more replication rules. A replication configuration must have at least one rule and can contain a maximum of 1,000 rules.",
-          "type": "array",
-          "uniqueItems": true,
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/ReplicationRule",
-            "maxLength": 1000,
-            "minLength": 1
-          }
+        "Filter": {
+          "description": "The filtering rules that determine which objects invoke the AWS Lambda function. For example, you can create a filter so that only image files with a ``.jpg`` extension invoke the function when they are added to the Amazon S3 bucket.",
+          "$ref": "#/definitions/NotificationFilter"
+        },
+        "Event": {
+          "description": "The Amazon S3 bucket event for which to invoke the LAMlong function. For more information, see [Supported Event Types](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
+          "type": "string"
         }
       },
       "required": [
-        "Role",
-        "Rules"
+        "Function",
+        "Event"
       ]
     },
-    "ReplicationRule": {
+    "DataExport": {
+      "description": "Specifies how data related to the storage class analysis for an Amazon S3 bucket should be exported.",
+      "additionalProperties": false,
       "type": "object",
-      "description": "Specifies which Amazon S3 objects to replicate and where to store the replicas.",
+      "properties": {
+        "Destination": {
+          "description": "The place to store the data for an analysis.",
+          "$ref": "#/definitions/Destination"
+        },
+        "OutputSchemaVersion": {
+          "const": "V_1",
+          "description": "The version of the output schema to use when exporting data. Must be ``V_1``.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "Destination",
+        "OutputSchemaVersion"
+      ]
+    },
+    "Tiering": {
+      "description": "The S3 Intelligent-Tiering storage class is designed to optimize storage costs by automatically moving data to the most cost-effective storage access tier, without additional operational overhead.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "DeleteMarkerReplication": {
-          "$ref": "#/definitions/DeleteMarkerReplication",
-          "description": "Specifies whether Amazon S3 replicates delete markers. If you specify a ``Filter`` in your replication configuration, you must also include a ``DeleteMarkerReplication`` element. If your ``Filter`` includes a ``Tag`` element, the ``DeleteMarkerReplication`` ``Status`` must be set to Disabled, because Amazon S3 does not support replicating delete markers for tag-based rules. For an example configuration, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-config-min-rule-config). \n For more information about delete marker replication, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/delete-marker-replication.html). \n  If you are using an earlier version of the replication configuration, Amazon S3 handles replication of delete markers differently. For more information, see [Backward Compatibility](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-backward-compat-considerations)."
-        },
-        "Destination": {
-          "$ref": "#/definitions/ReplicationDestination",
-          "description": "A container for information about the replication destination and its configurations including enabling the S3 Replication Time Control (S3 RTC)."
-        },
-        "Filter": {
-          "$ref": "#/definitions/ReplicationRuleFilter",
-          "description": "A filter that identifies the subset of objects to which the replication rule applies. A ``Filter`` must specify exactly one ``Prefix``, ``TagFilter``, or an ``And`` child element. The use of the filter field indicates that this is a V2 replication configuration. This field isn't supported in a V1 replication configuration.\n  V1 replication configuration only supports filtering by key prefix. To filter using a V1 replication configuration, add the ``Prefix`` directly as a child element of the ``Rule`` element."
-        },
-        "Id": {
-          "description": "A unique identifier for the rule. The maximum value is 255 characters. If you don't specify a value, AWS CloudFormation generates a random ID. When using a V2 replication configuration this property is capitalized as \"ID\".",
-          "type": "string",
-          "maxLength": 255
-        },
-        "Prefix": {
-          "description": "An object key name prefix that identifies the object or objects to which the rule applies. The maximum prefix length is 1,024 characters. To include all objects in a bucket, specify an empty string. To filter using a V1 replication configuration, add the ``Prefix`` directly as a child element of the ``Rule`` element.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
-          "type": "string",
-          "maxLength": 1024
-        },
-        "Priority": {
-          "type": "integer",
-          "description": "The priority indicates which rule has precedence whenever two or more replication rules conflict. Amazon S3 will attempt to replicate objects according to all replication rules. However, if there are two or more rules with the same destination bucket, then objects will be replicated according to the rule with the highest priority. The higher the number, the higher the priority. \n For more information, see [Replication](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication.html) in the *Amazon S3 User Guide*."
-        },
-        "SourceSelectionCriteria": {
-          "$ref": "#/definitions/SourceSelectionCriteria",
-          "description": "A container that describes additional filters for identifying the source objects that you want to replicate. You can choose to enable or disable the replication of these objects."
-        },
-        "Status": {
-          "description": "Specifies whether the rule is enabled.",
+        "AccessTier": {
+          "description": "S3 Intelligent-Tiering access tier. See [Storage class for automatically optimizing frequently and infrequently accessed objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html#sc-dynamic-data-access) for a list of access tiers in the S3 Intelligent-Tiering storage class.",
           "type": "string",
           "enum": [
-            "Disabled",
-            "Enabled"
+            "ARCHIVE_ACCESS",
+            "DEEP_ARCHIVE_ACCESS"
           ]
+        },
+        "Days": {
+          "description": "The number of consecutive days of no access after which an object will be eligible to be transitioned to the corresponding tier. The minimum number of days specified for Archive Access tier must be at least 90 days and Deep Archive Access tier must be at least 180 days. The maximum can be up to 2 years (730 days).",
+          "type": "integer"
         }
       },
       "required": [
-        "Destination",
-        "Status"
+        "AccessTier",
+        "Days"
       ]
     },
-    "DeleteMarkerReplication": {
-      "type": "object",
+    "ReplicationTime": {
+      "description": "A container specifying S3 Replication Time Control (S3 RTC) related information, including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated. Must be specified together with a ``Metrics`` block.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "Status": {
+          "description": "Specifies whether the replication time is enabled.",
           "type": "string",
           "enum": [
             "Disabled",
             "Enabled"
-          ],
-          "description": "Indicates whether to replicate delete markers. Disabled by default."
+          ]
+        },
+        "Time": {
+          "description": "A container specifying the time by which replication should be complete for all objects and operations on objects.",
+          "$ref": "#/definitions/ReplicationTimeValue"
         }
       },
-      "description": "Specifies whether Amazon S3 replicates delete markers. If you specify a ``Filter`` in your replication configuration, you must also include a ``DeleteMarkerReplication`` element. If your ``Filter`` includes a ``Tag`` element, the ``DeleteMarkerReplication`` ``Status`` must be set to Disabled, because Amazon S3 does not support replicating delete markers for tag-based rules. For an example configuration, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-config-min-rule-config). \n For more information about delete marker replication, see [Basic Rule Configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/delete-marker-replication.html). \n  If you are using an earlier version of the replication configuration, Amazon S3 handles replication of delete markers differently. For more information, see [Backward Compatibility](https://docs.aws.amazon.com/AmazonS3/latest/dev/replication-add-config.html#replication-backward-compat-considerations)."
+      "required": [
+        "Status",
+        "Time"
+      ]
     },
-    "ReplicationDestination": {
-      "type": "object",
-      "description": "A container for information about the replication destination and its configurations including enabling the S3 Replication Time Control (S3 RTC).",
+    "ReplicationRuleFilter": {
+      "description": "A filter that identifies the subset of objects to which the replication rule applies. A ``Filter`` must specify exactly one ``Prefix``, ``TagFilter``, or an ``And`` child element.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "AccessControlTranslation": {
-          "$ref": "#/definitions/AccessControlTranslation",
-          "description": "Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS-account that owns the destination bucket. If this is not specified in the replication configuration, the replicas are owned by same AWS-account that owns the source object."
-        },
-        "Account": {
-          "type": "string",
-          "description": "Destination bucket owner account ID. In a cross-account scenario, if you direct Amazon S3 to change replica ownership to the AWS-account that owns the destination bucket by specifying the ``AccessControlTranslation`` property, this is the account ID of the destination bucket owner. For more information, see [Cross-Region Replication Additional Configuration: Change Replica Owner](https://docs.aws.amazon.com/AmazonS3/latest/dev/crr-change-owner.html) in the *Amazon S3 User Guide*.\n If you specify the ``AccessControlTranslation`` property, the ``Account`` property is required."
-        },
-        "Bucket": {
-          "type": "string",
-          "description": "The Amazon Resource Name (ARN) of the bucket where you want Amazon S3 to store the results."
-        },
-        "EncryptionConfiguration": {
-          "$ref": "#/definitions/EncryptionConfiguration",
-          "description": "Specifies encryption-related information."
-        },
-        "Metrics": {
-          "$ref": "#/definitions/Metrics",
-          "description": "A container specifying replication metrics-related settings enabling replication metrics and events."
+        "And": {
+          "description": "A container for specifying rule filters. The filters determine the subset of objects to which the rule applies. This element is required only if you specify more than one filter. For example: \n  +  If you specify both a ``Prefix`` and a ``TagFilter``, wrap these filters in an ``And`` tag.\n  +  If you specify a filter based on multiple tags, wrap the ``TagFilter`` elements in an ``And`` tag.",
+          "$ref": "#/definitions/ReplicationRuleAndOperator"
         },
-        "ReplicationTime": {
-          "$ref": "#/definitions/ReplicationTime",
-          "description": "A container specifying S3 Replication Time Control (S3 RTC), including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated. Must be specified together with a ``Metrics`` block."
+        "TagFilter": {
+          "description": "A container for specifying a tag key and value. \n The rule applies only to objects that have the tag in their tag set.",
+          "$ref": "#/definitions/TagFilter"
         },
-        "StorageClass": {
-          "description": "The storage class to use when replicating objects, such as S3 Standard or reduced redundancy. By default, Amazon S3 uses the storage class of the source object to create the object replica. \n For valid values, see the ``StorageClass`` element of the [PUT Bucket replication](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTreplication.html) action in the *Amazon S3 API Reference*.",
-          "type": "string",
-          "enum": [
-            "DEEP_ARCHIVE",
-            "GLACIER",
-            "GLACIER_IR",
-            "INTELLIGENT_TIERING",
-            "ONEZONE_IA",
-            "REDUCED_REDUNDANCY",
-            "STANDARD",
-            "STANDARD_IA"
-          ]
+        "Prefix": {
+          "description": "An object key name prefix that identifies the subset of objects to which the rule applies.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
+          "type": "string"
         }
-      },
-      "required": [
-        "Bucket"
-      ]
+      }
     },
-    "AccessControlTranslation": {
-      "type": "object",
-      "description": "Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS-account that owns the destination bucket. If this is not specified in the replication configuration, the replicas are owned by same AWS-account that owns the source object.",
+    "RedirectRule": {
+      "description": "Specifies how requests are redirected. In the event of an error, you can specify a different error code to return.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Owner": {
+        "ReplaceKeyWith": {
+          "description": "The specific object key to use in the redirect request. For example, redirect request to ``error.html``. Not required if one of the siblings is present. Can be present only if ``ReplaceKeyPrefixWith`` is not provided.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
+          "type": "string"
+        },
+        "HttpRedirectCode": {
+          "description": "The HTTP redirect code to use on the response. Not required if one of the siblings is present.",
+          "type": "string"
+        },
+        "Protocol": {
+          "description": "Protocol to use when redirecting requests. The default is the protocol that is used in the original request.",
           "type": "string",
-          "const": "Destination",
-          "description": "Specifies the replica ownership. For default and valid values, see [PUT bucket replication](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTreplication.html) in the *Amazon S3 API Reference*."
+          "enum": [
+            "http",
+            "https"
+          ]
+        },
+        "HostName": {
+          "description": "The host name to use in the redirect request.",
+          "type": "string"
+        },
+        "ReplaceKeyPrefixWith": {
+          "description": "The object key prefix to use in the redirect request. For example, to redirect requests for all pages with prefix ``docs/`` (objects in the ``docs/`` folder) to ``documents/``, you can set a condition block with ``KeyPrefixEquals`` set to ``docs/`` and in the Redirect set ``ReplaceKeyPrefixWith`` to ``/documents``. Not required if one of the siblings is present. Can be present only if ``ReplaceKeyWith`` is not provided.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
+          "type": "string"
         }
-      },
-      "required": [
-        "Owner"
-      ]
+      }
     },
     "EncryptionConfiguration": {
-      "type": "object",
-      "description": "Specifies encryption-related information for an Amazon S3 bucket that is a destination for replicated objects.",
+      "description": "Specifies encryption-related information for an Amazon S3 bucket that is a destination for replicated objects.\n  If you're specifying a customer managed KMS key, we recommend using a fully qualified KMS key ARN. If you use a KMS key alias instead, then KMS resolves the key within the requester’s account. This behavior can result in data that's encrypted with a KMS key that belongs to the requester, and not the bucket owner.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "ReplicaKmsKeyID": {
           "description": "Specifies the ID (Key ARN or Alias ARN) of the customer managed AWS KMS key stored in AWS Key Management Service (KMS) for the destination bucket. Amazon S3 uses this key to encrypt replica objects. Amazon S3 only supports symmetric encryption KMS keys. For more information, see [Asymmetric keys in KMS](https://docs.aws.amazon.com//kms/latest/developerguide/symmetric-asymmetric.html) in the *Key Management Service Developer Guide*.",
@@ -1353,189 +1266,224 @@
         "ReplicaKmsKeyID"
       ]
     },
-    "Metrics": {
-      "type": "object",
+    "BucketEncryption": {
+      "description": "Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS). For information about the Amazon S3 default encryption feature, see [Amazon S3 Default Encryption for S3 Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "EventThreshold": {
-          "$ref": "#/definitions/ReplicationTimeValue",
-          "description": "A container specifying the time threshold for emitting the ``s3:Replication:OperationMissedThreshold`` event."
-        },
-        "Status": {
-          "type": "string",
-          "enum": [
-            "Disabled",
-            "Enabled"
-          ],
-          "description": "Specifies whether the replication metrics are enabled."
+        "ServerSideEncryptionConfiguration": {
+          "uniqueItems": true,
+          "description": "Specifies the default server-side-encryption configuration.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ServerSideEncryptionRule"
+          }
         }
       },
       "required": [
-        "Status"
-      ],
-      "description": "A container specifying replication metrics-related settings enabling replication metrics and events."
+        "ServerSideEncryptionConfiguration"
+      ]
     },
-    "ReplicationTimeValue": {
-      "type": "object",
+    "NotificationConfiguration": {
+      "description": "Describes the notification configuration for an Amazon S3 bucket.\n  If you create the target resource and related permissions in the same template, you might have a circular dependency.\n For example, you might use the ``AWS::Lambda::Permission`` resource to grant the bucket permission to invoke an AWS Lambda function. However, AWS CloudFormation can't create the bucket until the bucket has permission to invoke the function (AWS CloudFormation checks whether the bucket can invoke the function). If you're using Refs to pass the bucket name, this leads to a circular dependency.\n To avoid this dependency, you can create all resources without specifying the notification configuration. Then, update the stack with a notification configuration.\n For more information on permissions, see [AWS::Lambda::Permission](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html) and [Granting Permissions to Publish Event Notification Messages to a Destination](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#grant-destinations-permissions-to-s3).",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Minutes": {
-          "type": "integer",
-          "description": "Contains an integer specifying time in minutes. \n  Valid value: 15"
+        "TopicConfigurations": {
+          "uniqueItems": true,
+          "description": "The topic to which notifications are sent and the events for which notifications are generated.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TopicConfiguration"
+          }
+        },
+        "QueueConfigurations": {
+          "uniqueItems": true,
+          "description": "The Amazon Simple Queue Service queues to publish messages to and the events for which to publish messages.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/QueueConfiguration"
+          }
+        },
+        "LambdaConfigurations": {
+          "uniqueItems": true,
+          "description": "Describes the LAMlong functions to invoke and the events for which to invoke them.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/LambdaConfiguration"
+          }
+        },
+        "EventBridgeConfiguration": {
+          "description": "Enables delivery of events to Amazon EventBridge.",
+          "$ref": "#/definitions/EventBridgeConfiguration"
         }
-      },
-      "required": [
-        "Minutes"
-      ],
-      "description": "A container specifying the time value for S3 Replication Time Control (S3 RTC) and replication metrics ``EventThreshold``."
+      }
     },
-    "ReplicationTime": {
-      "type": "object",
+    "LifecycleConfiguration": {
+      "description": "Specifies the lifecycle configuration for objects in an Amazon S3 bucket. For more information, see [Object Lifecycle Management](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Status": {
-          "type": "string",
-          "enum": [
-            "Disabled",
-            "Enabled"
-          ],
-          "description": "Specifies whether the replication time is enabled."
-        },
-        "Time": {
-          "$ref": "#/definitions/ReplicationTimeValue",
-          "description": "A container specifying the time by which replication should be complete for all objects and operations on objects."
+        "Rules": {
+          "uniqueItems": true,
+          "description": "A lifecycle rule for individual objects in an Amazon S3 bucket.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Rule"
+          }
         }
       },
       "required": [
-        "Status",
-        "Time"
-      ],
-      "description": "A container specifying S3 Replication Time Control (S3 RTC) related information, including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated. Must be specified together with a ``Metrics`` block."
+        "Rules"
+      ]
     },
-    "ReplicationRuleFilter": {
-      "type": "object",
+    "InventoryConfiguration": {
+      "description": "Specifies the inventory configuration for an Amazon S3 bucket. For more information, see [GET Bucket inventory](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETInventoryConfig.html) in the *Amazon S3 API Reference*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "And": {
-          "$ref": "#/definitions/ReplicationRuleAndOperator",
-          "description": "A container for specifying rule filters. The filters determine the subset of objects to which the rule applies. This element is required only if you specify more than one filter. For example: \n  +  If you specify both a ``Prefix`` and a ``TagFilter``, wrap these filters in an ``And`` tag.\n  +  If you specify a filter based on multiple tags, wrap the ``TagFilter`` elements in an ``And`` tag."
+        "Destination": {
+          "description": "Contains information about where to publish the inventory results.",
+          "$ref": "#/definitions/Destination"
+        },
+        "OptionalFields": {
+          "uniqueItems": true,
+          "description": "Contains the optional fields that are included in the inventory results.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "Size",
+              "LastModifiedDate",
+              "StorageClass",
+              "ETag",
+              "IsMultipartUploaded",
+              "ReplicationStatus",
+              "EncryptionStatus",
+              "ObjectLockRetainUntilDate",
+              "ObjectLockMode",
+              "ObjectLockLegalHoldStatus",
+              "IntelligentTieringAccessTier",
+              "BucketKeyStatus",
+              "ChecksumAlgorithm",
+              "ObjectAccessControlList",
+              "ObjectOwner"
+            ]
+          }
+        },
+        "IncludedObjectVersions": {
+          "description": "Object versions to include in the inventory list. If set to ``All``, the list includes all the object versions, which adds the version-related fields ``VersionId``, ``IsLatest``, and ``DeleteMarker`` to the list. If set to ``Current``, the list does not contain these version-related fields.",
+          "type": "string",
+          "enum": [
+            "All",
+            "Current"
+          ]
+        },
+        "Enabled": {
+          "description": "Specifies whether the inventory is enabled or disabled. If set to ``True``, an inventory list is generated. If set to ``False``, no inventory list is generated.",
+          "type": "boolean"
+        },
+        "Id": {
+          "description": "The ID used to identify the inventory configuration.",
+          "type": "string"
         },
         "Prefix": {
-          "type": "string",
-          "description": "An object key name prefix that identifies the subset of objects to which the rule applies.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints)."
+          "description": "Specifies the inventory filter prefix.",
+          "type": "string"
         },
-        "TagFilter": {
-          "$ref": "#/definitions/TagFilter",
-          "description": "A container for specifying a tag key and value. \n The rule applies only to objects that have the tag in their tag set."
+        "ScheduleFrequency": {
+          "description": "Specifies the schedule for generating inventory results.",
+          "type": "string",
+          "enum": [
+            "Daily",
+            "Weekly"
+          ]
         }
       },
-      "description": "A filter that identifies the subset of objects to which the replication rule applies. A ``Filter`` must specify exactly one ``Prefix``, ``TagFilter``, or an ``And`` child element."
+      "required": [
+        "Destination",
+        "Enabled",
+        "Id",
+        "IncludedObjectVersions",
+        "ScheduleFrequency"
+      ]
     },
     "ReplicationRuleAndOperator": {
-      "type": "object",
+      "description": "A container for specifying rule filters. The filters determine the subset of objects to which the rule applies. This element is required only if you specify more than one filter. \n For example:\n  +  If you specify both a ``Prefix`` and a ``TagFilter``, wrap these filters in an ``And`` tag. \n  +  If you specify a filter based on multiple tags, wrap the ``TagFilter`` elements in an ``And`` tag",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Prefix": {
-          "type": "string",
-          "description": "An object key name prefix that identifies the subset of objects to which the rule applies."
-        },
         "TagFilters": {
-          "type": "array",
           "uniqueItems": true,
+          "description": "An array of tags containing key and value pairs.",
           "insertionOrder": true,
+          "type": "array",
           "items": {
             "$ref": "#/definitions/TagFilter"
-          },
-          "description": "An array of tags containing key and value pairs."
-        }
-      },
-      "description": "A container for specifying rule filters. The filters determine the subset of objects to which the rule applies. This element is required only if you specify more than one filter. \n For example:\n  +  If you specify both a ``Prefix`` and a ``TagFilter``, wrap these filters in an ``And`` tag. \n  +  If you specify a filter based on multiple tags, wrap the ``TagFilter`` elements in an ``And`` tag"
-    },
-    "SourceSelectionCriteria": {
-      "description": "A container that describes additional filters for identifying the source objects that you want to replicate. You can choose to enable or disable the replication of these objects.",
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "ReplicaModifications": {
-          "description": "A filter that you can specify for selection for modifications on replicas.",
-          "$ref": "#/definitions/ReplicaModifications"
+          }
         },
-        "SseKmsEncryptedObjects": {
-          "description": "A container for filter information for the selection of Amazon S3 objects encrypted with AWS KMS.",
-          "$ref": "#/definitions/SseKmsEncryptedObjects"
+        "Prefix": {
+          "description": "An object key name prefix that identifies the subset of objects to which the rule applies.",
+          "type": "string"
         }
       }
     },
-    "ReplicaModifications": {
-      "type": "object",
+    "VersioningConfiguration": {
+      "description": "Describes the versioning state of an Amazon S3 bucket. For more information, see [PUT Bucket versioning](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTVersioningStatus.html) in the *Amazon S3 API Reference*.\n  When you enable versioning on a bucket for the first time, it might take a short amount of time for the change to be fully propagated. We recommend that you wait for 15 minutes after enabling versioning before issuing write operations (``PUT`` or ``DELETE``) on objects in the bucket.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "Status": {
-          "description": "Specifies whether Amazon S3 replicates modifications on replicas.\n  *Allowed values*: ``Enabled`` | ``Disabled``",
+          "default": "Suspended",
+          "description": "The versioning state of the bucket.",
           "type": "string",
           "enum": [
             "Enabled",
-            "Disabled"
+            "Suspended"
           ]
         }
       },
       "required": [
         "Status"
-      ],
-      "description": "A filter that you can specify for selection for modifications on replicas."
+      ]
     },
-    "SseKmsEncryptedObjects": {
-      "type": "object",
-      "description": "A container for filter information for the selection of S3 objects encrypted with AWS KMS.",
+    "CorsConfiguration": {
+      "description": "Describes the cross-origin access configuration for objects in an Amazon S3 bucket. For more information, see [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Status": {
-          "description": "Specifies whether Amazon S3 replicates objects created with server-side encryption using an AWS KMS key stored in AWS Key Management Service.",
-          "type": "string",
-          "enum": [
-            "Disabled",
-            "Enabled"
-          ]
+        "CorsRules": {
+          "uniqueItems": true,
+          "description": "A set of origins and methods (cross-origin access that you want to allow). You can add up to 100 rules to the configuration.",
+          "insertionOrder": true,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/CorsRule",
+            "maxLength": 100
+          }
         }
       },
       "required": [
-        "Status"
+        "CorsRules"
       ]
     },
-    "Tag": {
-      "type": "object",
+    "ReplicaModifications": {
+      "description": "A filter that you can specify for selection for modifications on replicas.",
       "additionalProperties": false,
-      "properties": {
-        "Key": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 128,
-          "description": "Name of the object key."
-        },
-        "Value": {
-          "type": "string",
-          "maxLength": 256,
-          "description": "Value of the tag."
-        }
-      },
-      "required": [
-        "Value",
-        "Key"
-      ],
-      "description": "A container of a key value name pair."
-    },
-    "VersioningConfiguration": {
-      "description": "Describes the versioning state of an Amazon S3 bucket. For more information, see [PUT Bucket versioning](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTVersioningStatus.html) in the *Amazon S3 API Reference*.",
       "type": "object",
-      "additionalProperties": false,
       "properties": {
         "Status": {
-          "description": "The versioning state of the bucket.",
+          "description": "Specifies whether Amazon S3 replicates modifications on replicas.\n  *Allowed values*: ``Enabled`` | ``Disabled``",
           "type": "string",
-          "default": "Suspended",
           "enum": [
             "Enabled",
-            "Suspended"
+            "Disabled"
           ]
         }
       },
@@ -1543,253 +1491,285 @@
         "Status"
       ]
     },
-    "WebsiteConfiguration": {
-      "type": "object",
-      "description": "Specifies website configuration parameters for an Amazon S3 bucket.",
+    "NoncurrentVersionExpiration": {
+      "description": "Specifies when noncurrent object versions expire. Upon expiration, S3 permanently deletes the noncurrent object versions. You set this lifecycle configuration action on a bucket that has versioning enabled (or suspended) to request that S3 delete noncurrent object versions at a specific period in the object's lifetime. For more information about setting a lifecycle rule configuration, see [AWS::S3::Bucket Rule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-lifecycleconfig-rule.html).",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "ErrorDocument": {
-          "description": "The name of the error document for the website.",
-          "type": "string"
-        },
-        "IndexDocument": {
-          "description": "The name of the index document for the website.",
-          "type": "string"
-        },
-        "RoutingRules": {
-          "type": "array",
-          "insertionOrder": true,
-          "items": {
-            "$ref": "#/definitions/RoutingRule"
-          },
-          "description": "Rules that define when a redirect is applied and the redirect behavior."
+        "NoncurrentDays": {
+          "description": "Specifies the number of days an object is noncurrent before S3 can perform the associated action. For information about the noncurrent days calculations, see [How Amazon S3 Calculates When an Object Became Noncurrent](https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#non-current-days-calculations) in the *Amazon S3 User Guide*.",
+          "type": "integer"
         },
-        "RedirectAllRequestsTo": {
-          "$ref": "#/definitions/RedirectAllRequestsTo",
-          "description": "The redirect behavior for every request to this bucket's website endpoint.\n  If you specify this property, you can't specify any other property."
+        "NewerNoncurrentVersions": {
+          "description": "Specifies how many noncurrent versions S3 will retain. If there are this many more recent noncurrent versions, S3 will take the associated action. For more information about noncurrent versions, see [Lifecycle configuration elements](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html) in the *Amazon S3 User Guide*.",
+          "type": "integer"
         }
-      }
+      },
+      "required": [
+        "NoncurrentDays"
+      ]
     },
-    "RoutingRule": {
-      "description": "Specifies the redirect behavior and when a redirect is applied. For more information about routing rules, see [Configuring advanced conditional redirects](https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html#advanced-conditional-redirects) in the *Amazon S3 User Guide*.",
-      "type": "object",
+    "QueueConfiguration": {
+      "description": "Specifies the configuration for publishing messages to an Amazon Simple Queue Service (Amazon SQS) queue when Amazon S3 detects specified events.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "RedirectRule": {
-          "description": "Container for redirect information. You can redirect requests to another host, to another page, or with another protocol. In the event of an error, you can specify a different error code to return.",
-          "$ref": "#/definitions/RedirectRule"
+        "Filter": {
+          "description": "The filtering rules that determine which objects trigger notifications. For example, you can create a filter so that Amazon S3 sends notifications only when image files with a ``.jpg`` extension are added to the bucket. For more information, see [Configuring event notifications using object key name filtering](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/notification-how-to-filtering.html) in the *Amazon S3 User Guide*.",
+          "$ref": "#/definitions/NotificationFilter"
         },
-        "RoutingRuleCondition": {
-          "$ref": "#/definitions/RoutingRuleCondition",
-          "description": "A container for describing a condition that must be met for the specified redirect to apply. For example, 1. If request is for pages in the ``/docs`` folder, redirect to the ``/documents`` folder. 2. If request results in HTTP error 4xx, redirect request to another host where you might process the error."
+        "Event": {
+          "description": "The Amazon S3 bucket event about which you want to publish messages to Amazon SQS. For more information, see [Supported Event Types](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) in the *Amazon S3 User Guide*.",
+          "type": "string"
+        },
+        "Queue": {
+          "description": "The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3 publishes a message when it detects events of the specified type. FIFO queues are not allowed when enabling an SQS queue as the event notification destination.",
+          "type": "string"
         }
       },
       "required": [
-        "RedirectRule"
+        "Event",
+        "Queue"
       ]
     },
-    "RedirectRule": {
-      "type": "object",
-      "description": "Specifies how requests are redirected. In the event of an error, you can specify a different error code to return.",
+    "Transition": {
+      "description": "Specifies when an object transitions to a specified storage class. For more information about Amazon S3 lifecycle configuration rules, see [Transitioning Objects Using Amazon S3 Lifecycle](https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-transition-general-considerations.html) in the *Amazon S3 User Guide*.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "HostName": {
-          "description": "The host name to use in the redirect request.",
-          "type": "string"
-        },
-        "HttpRedirectCode": {
-          "description": "The HTTP redirect code to use on the response. Not required if one of the siblings is present.",
-          "type": "string"
+        "TransitionDate": {
+          "description": "Indicates when objects are transitioned to the specified storage class. The date value must be in ISO 8601 format. The time is always midnight UTC.",
+          "$ref": "#/definitions/iso8601UTC"
         },
-        "Protocol": {
-          "description": "Protocol to use when redirecting requests. The default is the protocol that is used in the original request.",
+        "StorageClass": {
+          "description": "The storage class to which you want the object to transition.",
+          "type": "string",
           "enum": [
-            "http",
-            "https"
-          ],
-          "type": "string"
-        },
-        "ReplaceKeyPrefixWith": {
-          "description": "The object key prefix to use in the redirect request. For example, to redirect requests for all pages with prefix ``docs/`` (objects in the ``docs/`` folder) to ``documents/``, you can set a condition block with ``KeyPrefixEquals`` set to ``docs/`` and in the Redirect set ``ReplaceKeyPrefixWith`` to ``/documents``. Not required if one of the siblings is present. Can be present only if ``ReplaceKeyWith`` is not provided.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
-          "type": "string"
+            "DEEP_ARCHIVE",
+            "GLACIER",
+            "Glacier",
+            "GLACIER_IR",
+            "INTELLIGENT_TIERING",
+            "ONEZONE_IA",
+            "STANDARD_IA"
+          ]
         },
-        "ReplaceKeyWith": {
-          "description": "The specific object key to use in the redirect request. For example, redirect request to ``error.html``. Not required if one of the siblings is present. Can be present only if ``ReplaceKeyPrefixWith`` is not provided.\n  Replacement must be made for object keys containing special characters (such as carriage returns) when using XML requests. For more information, see [XML related object key constraints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-xml-related-constraints).",
-          "type": "string"
+        "TransitionInDays": {
+          "description": "Indicates the number of days after creation when objects are transitioned to the specified storage class. The value must be a positive integer.",
+          "type": "integer"
         }
-      }
+      },
+      "required": [
+        "StorageClass"
+      ]
     },
-    "RoutingRuleCondition": {
-      "description": "A container for describing a condition that must be met for the specified redirect to apply. For example, 1. If request is for pages in the ``/docs`` folder, redirect to the ``/documents`` folder. 2. If request results in HTTP error 4xx, redirect request to another host where you might process the error.",
-      "type": "object",
+    "SseKmsEncryptedObjects": {
+      "description": "A container for filter information for the selection of S3 objects encrypted with AWS KMS.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "KeyPrefixEquals": {
-          "description": "The object key name prefix when the redirect is applied. For example, to redirect requests for ``ExamplePage.html``, the key prefix will be ``ExamplePage.html``. To redirect request for all pages with the prefix ``docs/``, the key prefix will be ``/docs``, which identifies all objects in the docs/ folder.\n Required when the parent element ``Condition`` is specified and sibling ``HttpErrorCodeReturnedEquals`` is not specified. If both conditions are specified, both must be true for the redirect to be applied.",
-          "type": "string"
-        },
-        "HttpErrorCodeReturnedEquals": {
-          "description": "The HTTP error code when the redirect is applied. In the event of an error, if the error code equals this value, then the specified redirect is applied.\n Required when parent element ``Condition`` is specified and sibling ``KeyPrefixEquals`` is not specified. If both are specified, then both must be true for the redirect to be applied.",
-          "type": "string"
+        "Status": {
+          "description": "Specifies whether Amazon S3 replicates objects created with server-side encryption using an AWS KMS key stored in AWS Key Management Service.",
+          "type": "string",
+          "enum": [
+            "Disabled",
+            "Enabled"
+          ]
         }
-      }
+      },
+      "required": [
+        "Status"
+      ]
     },
-    "RedirectAllRequestsTo": {
-      "description": "Specifies the redirect behavior of all requests to a website endpoint of an Amazon S3 bucket.",
-      "type": "object",
+    "Tag": {
+      "description": "A container of a key value name pair.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "HostName": {
-          "description": "Name of the host where requests are redirected.",
-          "type": "string"
+        "Value": {
+          "description": "Value of the tag.",
+          "type": "string",
+          "maxLength": 256
         },
-        "Protocol": {
-          "description": "Protocol to use when redirecting requests. The default is the protocol that is used in the original request.",
+        "Key": {
+          "minLength": 1,
+          "description": "Name of the object key.",
           "type": "string",
-          "enum": [
-            "http",
-            "https"
-          ]
+          "maxLength": 128
+        }
+      },
+      "required": [
+        "Value",
+        "Key"
+      ]
+    },
+    "AbortIncompleteMultipartUpload": {
+      "description": "Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload. For more information, see [Stopping Incomplete Multipart Uploads Using a Bucket Lifecycle Policy](https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config) in the *Amazon S3 User Guide*.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "DaysAfterInitiation": {
+          "description": "Specifies the number of days after which Amazon S3 stops an incomplete multipart upload.",
+          "type": "integer",
+          "minimum": 0
         }
       },
       "required": [
-        "HostName"
+        "DaysAfterInitiation"
       ]
-    },
-    "Arn": {
-      "description": "the Amazon Resource Name (ARN) of the specified bucket.",
-      "type": "string"
     }
   },
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
-  },
-  "createOnlyProperties": [
-    "/properties/BucketName"
-  ],
-  "primaryIdentifier": [
-    "/properties/BucketName"
-  ],
-  "readOnlyProperties": [
-    "/properties/Arn",
-    "/properties/DomainName",
-    "/properties/DualStackDomainName",
-    "/properties/RegionalDomainName",
-    "/properties/WebsiteURL"
-  ],
-  "writeOnlyProperties": [
-    "/properties/AccessControl",
-    "/properties/LifecycleConfiguration/Rules/*/NoncurrentVersionExpirationInDays",
-    "/properties/LifecycleConfiguration/Rules/*/NoncurrentVersionTransition",
-    "/properties/LifecycleConfiguration/Rules/*/Transition",
-    "/properties/ReplicationConfiguration/Rules/*/Prefix",
-    "/properties/LifecycleConfiguration/Rules/*/ExpiredObjectDeleteMarker"
-  ],
-  "propertyTransform": {
-    "/properties/NotificationConfiguration/QueueConfigurations/*/Filter/S3Key/Rules/*/Name": "$replace(Name, \"prefix\", \"Prefix\") $OR $replace(Name, \"suffix\", \"Suffix\")",
-    "/properties/NotificationConfiguration/LambdaConfigurations/*/Filter/S3Key/Rules/*/Name": "$replace(Name, \"prefix\", \"Prefix\") $OR $replace(Name, \"suffix\", \"Suffix\")",
-    "/properties/NotificationConfiguration/TopicConfigurations/*/Filter/S3Key/Rules/*/Name": "$replace(Name, \"prefix\", \"Prefix\") $OR $replace(Name, \"suffix\", \"Suffix\")"
-  },
-  "handlers": {
-    "create": {
-      "permissions": [
-        "s3:CreateBucket",
-        "s3:PutBucketTagging",
-        "s3:PutAnalyticsConfiguration",
-        "s3:PutEncryptionConfiguration",
-        "s3:PutBucketCORS",
-        "s3:PutInventoryConfiguration",
-        "s3:PutLifecycleConfiguration",
-        "s3:PutMetricsConfiguration",
-        "s3:PutBucketNotification",
-        "s3:PutBucketReplication",
-        "s3:PutBucketWebsite",
-        "s3:PutAccelerateConfiguration",
-        "s3:PutBucketPublicAccessBlock",
-        "s3:PutReplicationConfiguration",
-        "s3:PutObjectAcl",
-        "s3:PutBucketObjectLockConfiguration",
-        "s3:GetBucketAcl",
-        "s3:ListBucket",
-        "iam:PassRole",
-        "s3:DeleteObject",
-        "s3:PutBucketLogging",
-        "s3:PutBucketVersioning",
-        "s3:PutObjectLockConfiguration",
-        "s3:PutBucketOwnershipControls",
-        "s3:PutIntelligentTieringConfiguration"
-      ]
+  "properties": {
+    "InventoryConfigurations": {
+      "uniqueItems": true,
+      "description": "Specifies the inventory configuration for an Amazon S3 bucket. For more information, see [GET Bucket inventory](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETInventoryConfig.html) in the *Amazon S3 API Reference*.",
+      "insertionOrder": true,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/InventoryConfiguration"
+      }
     },
-    "read": {
-      "permissions": [
-        "s3:GetAccelerateConfiguration",
-        "s3:GetLifecycleConfiguration",
-        "s3:GetBucketPublicAccessBlock",
-        "s3:GetAnalyticsConfiguration",
-        "s3:GetBucketCORS",
-        "s3:GetEncryptionConfiguration",
-        "s3:GetInventoryConfiguration",
-        "s3:GetBucketLogging",
-        "s3:GetMetricsConfiguration",
-        "s3:GetBucketNotification",
-        "s3:GetBucketVersioning",
-        "s3:GetReplicationConfiguration",
-        "S3:GetBucketWebsite",
-        "s3:GetBucketPublicAccessBlock",
-        "s3:GetBucketObjectLockConfiguration",
-        "s3:GetBucketTagging",
-        "s3:GetBucketOwnershipControls",
-        "s3:GetIntelligentTieringConfiguration",
-        "s3:ListBucket"
-      ]
+    "WebsiteConfiguration": {
+      "description": "Information used to configure the bucket as a static website. For more information, see [Hosting Websites on Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html).",
+      "$ref": "#/definitions/WebsiteConfiguration"
     },
-    "update": {
-      "permissions": [
-        "s3:PutBucketAcl",
-        "s3:PutBucketTagging",
-        "s3:PutAnalyticsConfiguration",
-        "s3:PutEncryptionConfiguration",
-        "s3:PutBucketCORS",
-        "s3:PutInventoryConfiguration",
-        "s3:PutLifecycleConfiguration",
-        "s3:PutMetricsConfiguration",
-        "s3:PutBucketNotification",
-        "s3:PutBucketReplication",
-        "s3:PutBucketWebsite",
-        "s3:PutAccelerateConfiguration",
-        "s3:PutBucketPublicAccessBlock",
-        "s3:PutReplicationConfiguration",
-        "s3:PutBucketOwnershipControls",
-        "s3:PutIntelligentTieringConfiguration",
-        "s3:DeleteBucketWebsite",
-        "s3:PutBucketLogging",
-        "s3:PutBucketVersioning",
-        "s3:PutObjectLockConfiguration",
-        "s3:PutBucketObjectLockConfiguration",
-        "s3:DeleteBucketAnalyticsConfiguration",
-        "s3:DeleteBucketCors",
-        "s3:DeleteBucketMetricsConfiguration",
-        "s3:DeleteBucketEncryption",
-        "s3:DeleteBucketLifecycle",
-        "s3:DeleteBucketReplication",
-        "iam:PassRole",
-        "s3:ListBucket"
-      ]
+    "DualStackDomainName": {
+      "examples": [
+        "mystack-mybucket-kdwwxmddtr2g.s3.dualstack.us-east-2.amazonaws.com"
+      ],
+      "description": "",
+      "type": "string"
     },
-    "delete": {
-      "permissions": [
-        "s3:DeleteBucket",
-        "s3:ListBucket"
+    "AccessControl": {
+      "description": "This is a legacy property, and it is not recommended for most use cases. A majority of modern use cases in Amazon S3 no longer require the use of ACLs, and we recommend that you keep ACLs disabled. For more information, see [Controlling object ownership](https://docs.aws.amazon.com//AmazonS3/latest/userguide/about-object-ownership.html) in the *Amazon S3 User Guide*.\n  A canned access control list (ACL) that grants predefined permissions to the bucket. For more information about canned ACLs, see [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) in the *Amazon S3 User Guide*.\n  S3 buckets are created with ACLs disabled by default. Therefore, unless you explicitly set the [AWS::S3::OwnershipControls](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-ownershipcontrols.html) property to enable ACLs, your resource will fail to deploy with any value other than Private. Use cases requiring ACLs are uncommon.\n  The majority of access control configurations can be successfully and more easily achieved with bucket policies. For more information, see [AWS::S3::BucketPolicy](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html). For examples of common policy configurations, including S3 Server Access Logs buckets and more, see [Bucket policy examples](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html) in the *Amazon S3 User Guide*.",
+      "type": "string",
+      "enum": [
+        "AuthenticatedRead",
+        "AwsExecRead",
+        "BucketOwnerFullControl",
+        "BucketOwnerRead",
+        "LogDeliveryWrite",
+        "Private",
+        "PublicRead",
+        "PublicReadWrite"
       ]
     },
-    "list": {
-      "permissions": [
-        "s3:ListAllMyBuckets"
-      ]
+    "AnalyticsConfigurations": {
+      "uniqueItems": true,
+      "description": "Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.",
+      "insertionOrder": true,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/AnalyticsConfiguration"
+      }
+    },
+    "AccelerateConfiguration": {
+      "description": "Configures the transfer acceleration state for an Amazon S3 bucket. For more information, see [Amazon S3 Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html) in the *Amazon S3 User Guide*.",
+      "$ref": "#/definitions/AccelerateConfiguration"
+    },
+    "PublicAccessBlockConfiguration": {
+      "description": "Configuration that defines how Amazon S3 handles public access.",
+      "$ref": "#/definitions/PublicAccessBlockConfiguration"
+    },
+    "BucketName": {
+      "description": "A name for the bucket. If you don't specify a name, AWS CloudFormation generates a unique ID and uses that ID for the bucket name. The bucket name must contain only lowercase letters, numbers, periods (.), and dashes (-) and must follow [Amazon S3 bucket restrictions and limitations](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html). For more information, see [Rules for naming Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html#bucketnamingrules) in the *Amazon S3 User Guide*. \n  If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you need to replace the resource, specify a new name.",
+      "type": "string"
+    },
+    "RegionalDomainName": {
+      "examples": [
+        "mystack-mybucket-kdwwxmddtr2g.s3.us-east-2.amazonaws.com"
+      ],
+      "description": "",
+      "type": "string"
+    },
+    "OwnershipControls": {
+      "description": "Configuration that defines how Amazon S3 handles Object Ownership rules.",
+      "$ref": "#/definitions/OwnershipControls"
+    },
+    "ObjectLockConfiguration": {
+      "description": "This operation is not supported by directory buckets.\n  Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see [Locking Objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html). \n   +  The ``DefaultRetention`` settings require both a mode and a period.\n  +  The ``DefaultRetention`` period can be either ``Days`` or ``Years`` but you must select one. You cannot specify ``Days`` and ``Years`` at the same time.\n  +  You can enable Object Lock for new or existing buckets. For more information, see [Configuring Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-configure.html).",
+      "$ref": "#/definitions/ObjectLockConfiguration"
+    },
+    "ObjectLockEnabled": {
+      "description": "Indicates whether this bucket has an Object Lock configuration enabled. Enable ``ObjectLockEnabled`` when you apply ``ObjectLockConfiguration`` to a bucket.",
+      "type": "boolean"
+    },
+    "LoggingConfiguration": {
+      "description": "Settings that define where logs are stored.",
+      "$ref": "#/definitions/LoggingConfiguration"
+    },
+    "ReplicationConfiguration": {
+      "description": "Configuration for replicating objects in an S3 bucket. To enable replication, you must also enable versioning by using the ``VersioningConfiguration`` property.\n Amazon S3 can store replicated objects in a single destination bucket or multiple destination buckets. The destination bucket or buckets must already exist.",
+      "$ref": "#/definitions/ReplicationConfiguration"
+    },
+    "Tags": {
+      "description": "An arbitrary set of tags (key-value pairs) for this S3 bucket.",
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
+    },
+    "DomainName": {
+      "examples": [
+        "mystack-mybucket-kdwwxmddtr2g.s3.amazonaws.com"
+      ],
+      "description": "",
+      "type": "string"
+    },
+    "BucketEncryption": {
+      "description": "Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS). For information about the Amazon S3 default encryption feature, see [Amazon S3 Default Encryption for S3 Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) in the *Amazon S3 User Guide*.",
+      "$ref": "#/definitions/BucketEncryption"
+    },
+    "WebsiteURL": {
+      "examples": [
+        "Example (IPv4): http://mystack-mybucket-kdwwxmddtr2g.s3-website-us-east-2.amazonaws.com/",
+        "Example (IPv6): http://mystack-mybucket-kdwwxmddtr2g.s3.dualstack.us-east-2.amazonaws.com/"
+      ],
+      "format": "uri",
+      "description": "",
+      "type": "string"
+    },
+    "NotificationConfiguration": {
+      "description": "Configuration that defines how Amazon S3 handles bucket notifications.",
+      "$ref": "#/definitions/NotificationConfiguration"
+    },
+    "LifecycleConfiguration": {
+      "description": "Specifies the lifecycle configuration for objects in an Amazon S3 bucket. For more information, see [Object Lifecycle Management](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) in the *Amazon S3 User Guide*.",
+      "$ref": "#/definitions/LifecycleConfiguration"
+    },
+    "VersioningConfiguration": {
+      "description": "Enables multiple versions of all objects in this bucket. You might enable versioning to prevent objects from being deleted or overwritten by mistake or to archive objects so that you can retrieve previous versions of them.\n  When you enable versioning on a bucket for the first time, it might take a short amount of time for the change to be fully propagated. We recommend that you wait for 15 minutes after enabling versioning before issuing write operations (``PUT`` or ``DELETE``) on objects in the bucket.",
+      "$ref": "#/definitions/VersioningConfiguration"
+    },
+    "MetricsConfigurations": {
+      "uniqueItems": true,
+      "description": "Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased. For more information, see [PutBucketMetricsConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTMetricConfiguration.html).",
+      "insertionOrder": true,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/MetricsConfiguration"
+      }
+    },
+    "IntelligentTieringConfigurations": {
+      "uniqueItems": true,
+      "description": "Defines how Amazon S3 handles Intelligent-Tiering storage.",
+      "insertionOrder": true,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/IntelligentTieringConfiguration"
+      }
+    },
+    "CorsConfiguration": {
+      "description": "Describes the cross-origin access configuration for objects in an Amazon S3 bucket. For more information, see [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) in the *Amazon S3 User Guide*.",
+      "$ref": "#/definitions/CorsConfiguration"
+    },
+    "Arn": {
+      "examples": [
+        "arn:aws:s3:::mybucket"
+      ],
+      "description": "",
+      "$ref": "#/definitions/Arn"
     }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/scheduler/schedulegroup.json b/internal/aws/cfn/schemas/aws/scheduler/schedulegroup.json
index 2ac00945..d4260a53 100644
--- a/internal/aws/cfn/schemas/aws/scheduler/schedulegroup.json
+++ b/internal/aws/cfn/schemas/aws/scheduler/schedulegroup.json
@@ -125,7 +125,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "scheduler:UntagResource",
+      "scheduler:ListTagsForResource",
+      "scheduler:TagResource"
+    ]
   },
   "additionalProperties": false
 }
diff --git a/internal/aws/cfn/schemas/aws/signer/signingprofile.json b/internal/aws/cfn/schemas/aws/signer/signingprofile.json
index ea6d2c89..61f07248 100644
--- a/internal/aws/cfn/schemas/aws/signer/signingprofile.json
+++ b/internal/aws/cfn/schemas/aws/signer/signingprofile.json
@@ -18,7 +18,7 @@
       "type": "string",
       "minLength": 2,
       "maxLength": 64,
-      "pattern": "^[0-9a-zA-Z_]$"
+      "pattern": "^[0-9a-zA-Z_]{2,64}$"
     },
     "ProfileVersion": {
       "type": "string",
diff --git a/internal/aws/cfn/schemas/aws/systemsmanagersap/application.json b/internal/aws/cfn/schemas/aws/systemsmanagersap/application.json
index 3ca66792..5df25d1e 100644
--- a/internal/aws/cfn/schemas/aws/systemsmanagersap/application.json
+++ b/internal/aws/cfn/schemas/aws/systemsmanagersap/application.json
@@ -4,16 +4,17 @@
   "properties": {
     "ApplicationId": {
       "type": "string",
-      "pattern": "[\\w\\d]{1,50}"
+      "pattern": "[\\w\\d\\.-]{1,60}"
     },
     "ApplicationType": {
       "type": "string",
       "enum": [
-        "HANA"
+        "HANA",
+        "SAP_ABAP"
       ]
     },
     "Arn": {
-      "description": "The ARN of the Helix application",
+      "description": "The ARN of the SSM-SAP application",
       "type": "string",
       "pattern": "^arn:(.+:){2,4}.+$|^arn:(.+:){1,3}.+\\/.+$"
     },
@@ -48,6 +49,11 @@
         "$ref": "#/definitions/Tag"
       },
       "insertionOrder": true
+    },
+    "DatabaseArn": {
+      "description": "The ARN of the SAP HANA database",
+      "type": "string",
+      "pattern": "^arn:(.+:){2,4}.+$|^arn:(.+:){1,3}.+\\/.+$"
     }
   },
   "required": [
@@ -64,13 +70,15 @@
     "/properties/Credentials",
     "/properties/Instances",
     "/properties/SapInstanceNumber",
-    "/properties/Sid"
+    "/properties/Sid",
+    "/properties/DatabaseArn"
   ],
   "writeOnlyProperties": [
     "/properties/Credentials",
     "/properties/Instances",
     "/properties/SapInstanceNumber",
-    "/properties/Sid"
+    "/properties/Sid",
+    "/properties/DatabaseArn"
   ],
   "additionalProperties": false,
   "definitions": {
@@ -128,7 +136,8 @@
         "ssm-sap:RegisterApplication",
         "ssm-sap:GetApplication",
         "ssm-sap:TagResource",
-        "ssm-sap:ListTagsForResource"
+        "ssm-sap:ListTagsForResource",
+        "iam:CreateServiceLinkedRole"
       ]
     },
     "read": {
@@ -162,6 +171,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ssm-sap:UntagResource",
+      "ssm-sap:TagResource",
+      "ssm-sap:ListTagsForResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/vpclattice/authpolicy.json b/internal/aws/cfn/schemas/aws/vpclattice/authpolicy.json
index ab6e3458..45487ded 100644
--- a/internal/aws/cfn/schemas/aws/vpclattice/authpolicy.json
+++ b/internal/aws/cfn/schemas/aws/vpclattice/authpolicy.json
@@ -7,7 +7,7 @@
       "type": "string",
       "pattern": "^((((sn)|(svc))-[0-9a-z]{17})|(arn(:[a-z0-9]+([.-][a-z0-9]+)*){2}(:([a-z0-9]+([.-][a-z0-9]+)*)?){2}:((servicenetwork/sn)|(service/svc))-[0-9a-z]{17}))$",
       "maxLength": 200,
-      "minLength": 21
+      "minLength": 17
     },
     "Policy": {
       "type": "object"
diff --git a/internal/config/version.go b/internal/config/version.go
index ec579c16..6b7ab371 100644
--- a/internal/config/version.go
+++ b/internal/config/version.go
@@ -5,5 +5,5 @@ const (
 	NAME = "Rain"
 
 	// VERSION is the application's version string
-	VERSION = "v1.13.0"
+	VERSION = "v1.15.0"
 )